Analysis
-
max time kernel
194s -
max time network
319s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2022 20:58
Static task
static1
General
-
Target
Invoice_3406_october_PDF.iso
-
Size
3.1MB
-
MD5
76cc5f3c1d058c4f4aa3fa3904136bbd
-
SHA1
7185475768cb18a51896a83c0a1922beebee5d5b
-
SHA256
15e47fe96bdf2f5ad760bb7437fb322a865387629f85bd9596c66d414f19a91c
-
SHA512
6c92e9dc70ef41f5400cb3f96238592467f1f3564796bcb70cbb73a666a7dee750d2f24f25260238ef3fc196f789b107c7acb97f6fea8c85d4aab06caeba997d
-
SSDEEP
49152:1xkyekKLHC3c8UV3vlQeTeXeTBBJ/cEUmC6TjXXuGiNo4PjNYWPIKl+830CM3JCo:OQteTBBJ/ctmC6fXXViNoajRPtc
Malware Config
Extracted
Family
bumblebee
Botnet
0310
C2
192.119.74.28:443
54.38.138.5:443
45.141.58.37:443
146.70.147.39:443
146.70.149.48:443
103.144.139.158:443
rc4.plain
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 10 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF rundll32.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ rundll32.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions rundll32.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions rundll32.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate rundll32.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation WScript.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Wine rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Wine rundll32.exe -
Enumerates connected drives 3 TTPs 5 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: WScript.exe File opened (read-only) \??\E: cmd.exe File opened (read-only) \??\E: WScript.exe File opened (read-only) \??\E: cmd.exe File opened (read-only) \??\E: Notepad.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
pid Process 408 rundll32.exe 2356 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe 408 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeManageVolumePrivilege 2044 cmd.exe Token: SeManageVolumePrivilege 2044 cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3516 wrote to memory of 5044 3516 WScript.exe 89 PID 3516 wrote to memory of 5044 3516 WScript.exe 89 PID 5044 wrote to memory of 408 5044 cmd.exe 92 PID 5044 wrote to memory of 408 5044 cmd.exe 92 PID 4504 wrote to memory of 5000 4504 WScript.exe 94 PID 4504 wrote to memory of 5000 4504 WScript.exe 94 PID 5000 wrote to memory of 2356 5000 cmd.exe 96 PID 5000 wrote to memory of 2356 5000 cmd.exe 96
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Invoice_3406_october_PDF.iso1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1244
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "E:\refresheners\indemnitiesMesmerizing.vbs"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""E:\refresheners\beholdingSeditiousness.cmd" rundl"2⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\system32\rundll32.exerundll32 refresheners\sawn.dat,runprog3⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:408
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "E:\refresheners\indemnitiesMesmerizing.vbs"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""E:\refresheners\beholdingSeditiousness.cmd" rundl"2⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\system32\rundll32.exerundll32 refresheners\sawn.dat,runprog3⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:2356
-
-
-
C:\Windows\System32\Notepad.exe"C:\Windows\System32\Notepad.exe" E:\refresheners\indemnitiesMesmerizing.vbs1⤵
- Enumerates connected drives
PID:1060