Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/11/2022, 21:42
Static task
static1
Behavioral task
behavioral1
Sample
BOiQKiECaUzWqF.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
BOiQKiECaUzWqF.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
eLWCBMEWwlzsBt.bat
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
eLWCBMEWwlzsBt.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
required info.lnk
Resource
win7-20220812-en
General
-
Target
eLWCBMEWwlzsBt.bat
-
Size
1KB
-
MD5
a8071866320d5925502c2126defdd8e7
-
SHA1
c27c9e20cb2d75604e4eb706ef1532c45652e1ad
-
SHA256
a466d8918e30568b17a4e8e35a658070d525a6742a4e211b031e0daec7277a2b
-
SHA512
588af1181f3b85145f29d8b7c12de425d0285d76d7fdf25a04a097ae5c97556cd9f45fdc3d003c8d2af66fcdd5f0c35db82bae0f4a5daff596ad9953e0f5eee0
Malware Config
Extracted
bumblebee
0111
102.151.221.33:443
104.244.77.61:443
212.114.52.124:443
23.106.160.141:443
198.98.56.242:443
23.108.57.5:443
Signatures
-
Blocklisted process makes network request 6 IoCs
flow pid Process 1 1284 rundll32.exe 3 1284 rundll32.exe 4 1284 rundll32.exe 5 1284 rundll32.exe 6 1284 rundll32.exe 7 1284 rundll32.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1284 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2024 wrote to memory of 1284 2024 cmd.exe 27 PID 2024 wrote to memory of 1284 2024 cmd.exe 27 PID 2024 wrote to memory of 1284 2024 cmd.exe 27
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\eLWCBMEWwlzsBt.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\system32\rundll32.exerundll32 BOiQKiECaUzWqF.dll,RemoveSettings2⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:1284
-