Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02/11/2022, 17:35
Static task
static1
Behavioral task
behavioral1
Sample
LDYwFaCKXIhkuX.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
LDYwFaCKXIhkuX.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
pBLiwECeuZiHFL.bat
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
pBLiwECeuZiHFL.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
required documents.lnk
Resource
win7-20220901-en
General
-
Target
required documents.lnk
-
Size
995B
-
MD5
6b21b97785ef22f67e72c897115411ee
-
SHA1
3cc12b0994e0c25fe51d0e4596c9847ec4a2a19b
-
SHA256
b3bdf5e58460967d9837165ad1ab6bde950f55bd7ae40382d3352a054acd89c3
-
SHA512
53d20814fb3829c43e40027aa1d18273064b4272d3cddf5b52c80bf13281b90dd8e59653974d1101a292571da34e8dedde9f2f46cd37bc71df44e615681f5b0d
Malware Config
Extracted
bumblebee
0211
176.223.165.119:443
51.75.63.234:443
104.168.171.189:443
Signatures
-
Blocklisted process makes network request 6 IoCs
flow pid Process 1 892 rundll32.exe 3 892 rundll32.exe 4 892 rundll32.exe 5 892 rundll32.exe 8 892 rundll32.exe 9 892 rundll32.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 892 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1128 wrote to memory of 1296 1128 cmd.exe 28 PID 1128 wrote to memory of 1296 1128 cmd.exe 28 PID 1128 wrote to memory of 1296 1128 cmd.exe 28 PID 1296 wrote to memory of 892 1296 cmd.exe 29 PID 1296 wrote to memory of 892 1296 cmd.exe 29 PID 1296 wrote to memory of 892 1296 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\required documents.lnk"1⤵
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c pBLiwECeuZiHFL.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\system32\rundll32.exerundll32 LDYwFaCKXIhkuX.dll,Qruncore3⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:892
-
-