Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

oFWkRTFwjm.zip

windows7-x64

1

oFWkRTFwjm.zip

windows10-2004-x64

10

document.iso

windows7-x64

3

document.iso

windows10-2004-x64

10

documents.lnk

windows7-x64

10

documents.lnk

windows10-2004-x64

10

lipes.dll

windows7-x64

10

lipes.dll

windows10-2004-x64

10

Resubmissions

10/10/2022, 17:13

221010-vrjkhacggj 10

03/06/2022, 21:56

220603-1tra1seah3 1

03/06/2022, 21:55

220603-1swt4sabgp 1

03/06/2022, 21:38

220603-1hbq7adhf4 10

03/06/2022, 21:28

220603-1brttsdha7 10

Analysis

  • max time kernel
    1607s
  • max time network
    1616s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/10/2022, 17:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    document.iso

  • Size

    2.9MB

  • MD5

    f85b9913ed3c1b37defe3a83c9107ae9

  • SHA1

    bd8732ac09eb363102cf8e3060869e7799c6afb5

  • SHA256

    6daa6a247d6989fe4723a1d0868ed4abb6dfaadf09d1177fa23856b841e00644

  • SHA512

    eed53b0bfc761259edb05ebcbb53c8e603ccdba33888a550671d60a9c2747f543b0d5c0a9d8cbc30bea7d20b872b72be1c621a5f58a18dae9dfe4eb27a79522a

  • SSDEEP

    49152:2owwxiVJF/esysoUCNzUD0YLROMgd8JC:2opxiVJr

Score
10/10
bumblebee106revasiontrojan

Malware Config

Extracted

Family

bumblebee

Botnet

106r

C2

144.19.20.11:443

150.27.81.2:443

46.21.153.145:443

109.45.29.202:443

6.30.139.246:443

236.110.58.103:443

36.110.58.103:443

149.255.35.134:443

9.63.15.101:443

45.147.229.50:443

184.23.74.168:443

139.24.56.111:443

243.45.135.100:443

21.246.85.34:443

79.44.167.23:443

30.17.4.146:443

56.134.87.45:443

16.46.4.333:443

224.145.6.33:443
rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee
  • Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\document.iso
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:4676
  • C:\Windows\System32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" lipes.dll,oFWkRTFwjm
    1⤵
    • Enumerates VirtualBox registry keys
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Looks for VirtualBox Guest Additions in registry
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious behavior: EnumeratesProcesses
    PID:3180

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3180-132-0x00000260C53B0000-0x00000260C54C7000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/3180-133-0x00007FFD9C540000-0x00007FFD9C550000-memory.dmp

    Filesize

    64KB

    Download