Analysis
-
max time kernel
154s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
14/06/2022, 20:59
Static task
static1
Behavioral task
behavioral1
Sample
documents.lnk
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral2
Sample
documents.lnk
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral3
Sample
timi4r.dll
Resource
win7-20220414-en
windows7_x64
General
-
Target
documents.lnk
-
Size
2KB
-
MD5
2207b8077e12e9b9e4b99472223ef4a5
-
SHA1
8ec827a0eae5b9f604fac9df1b0a771d9f7801da
-
SHA256
f7d28026d41bf2a098bbf592d5ce2ed4f31fcc47a453ecab4e241910e3f407b1
-
SHA512
b06ef3c5a2bcf29450f32dba9208c2326b2d350a5b317be9fe1607d80dfbec35c326e3a9968e6346085988a88ef328431dfdf7ef4eb8a0f92c5b8c9d08909121
Malware Config
Extracted
bumblebee
1406r
39.57.152.217:440
69.161.201.181:382
244.6.154.71:111
193.233.203.156:443
221.106.84.123:307
194.135.33.148:443
111.99.39.11:387
223.243.46.133:147
48.165.175.199:316
78.89.31.86:229
157.17.142.85:406
90.81.8.16:370
21.29.238.98:209
154.56.0.252:443
103.175.16.108:443
188.57.4.52:357
15.209.19.148:466
160.70.24.228:486
33.145.184.132:240
235.126.132.170:106
171.78.101.85:258
188.6.218.149:317
123.67.113.210:483
115.109.212.139:461
167.28.27.185:467
185.62.58.133:443
133.57.116.243:424
47.58.200.234:159
142.182.181.207:450
57.240.143.90:256
158.35.83.74:332
135.253.243.175:300
34.229.154.31:235
104.168.219.94:443
48.209.106.172:357
68.227.158.172:411
80.9.246.19:338
45.153.241.187:443
145.239.135.155:443
188.104.94.69:348
246.20.199.100:175
80.26.101.48:372
22.83.186.45:201
146.70.125.82:443
216.254.58.191:443
80.156.1.202:305
107.44.53.47:330
67.136.243.43:323
172.244.110.160:367
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest rundll32.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ rundll32.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions rundll32.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation cmd.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Wine rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe 2664 rundll32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1260 wrote to memory of 2664 1260 cmd.exe 78 PID 1260 wrote to memory of 2664 1260 cmd.exe 78
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\documents.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" timi4r.dll,LyirJCyvGh2⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
PID:2664
-