DFIR_Quantum_Ransomware

IcedID used the `ipconfig /all` command and a batch script to gather network information.

IcedID has created a scheduled task to establish persistence.

IcedID can inject a Cobalt Strike beacon into cmd.exe via process hallowing.

IcedID has used HTTPS in communications with C2.

IcedID has the ability to identify the computer name and OS version on a compromised host.

IcedID can query LDAP and can use built-in `net` commands to identify additional users on the network to infect.

IcedID has the ability to download additional modules and a configuration file from C2.

IcedID has used the `net view /all` command to show available shares.

IcedID has been executed through Word and Excel files with malicious embedded macros and through ISO and LNK files that execute the malicious DLL.

IcedID has used rundll32.exe to execute the IcedID loader.

IcedID used Nltest during initial discovery.

IcedID can identify AV products on an infected host using the following command:
` WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get * /Format:List`.

IcedID used the following command to check the country/language of the active console:
` cmd.exe /c chcp >&2`.