Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
13/02/2023, 18:55
Static task
static1
Behavioral task
behavioral1
Sample
Photos.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Photos.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
project requirements.lnk
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
project requirements.lnk
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
samsung.bat
Resource
win7-20221111-en
General
-
Target
samsung.bat
-
Size
1KB
-
MD5
d9c85f2b71f3845c6eccfc9cf0d61f5f
-
SHA1
87e33805b660677abf211a026d6571929007cd45
-
SHA256
a897ba334569f2bf0fcf2741cd644d5975221f009228243b140013a6bd6a2776
-
SHA512
1ed3bebdfc33c68253d63a3290fb76c681f928c902c476e749a00cbece97aa66d8b615fce8c0ef5905c13ea71aa5049c70c076680f89e5d93e53437e69f17fd6
Malware Config
Extracted
bumblebee
102lg
146.70.29.237:443
205.185.113.34:443
23.106.223.182:443
103.144.139.146:443
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 3068 G84IrBV5PP.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 3068 G84IrBV5PP.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3444 wrote to memory of 2920 3444 cmd.exe 81 PID 3444 wrote to memory of 2920 3444 cmd.exe 81 PID 2920 wrote to memory of 4448 2920 cmd.exe 82 PID 2920 wrote to memory of 4448 2920 cmd.exe 82 PID 3444 wrote to memory of 3068 3444 cmd.exe 83 PID 3444 wrote to memory of 3068 3444 cmd.exe 83
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\samsung.bat"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\system32\cmd.execmd.exe /c start /b /min copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\G84IrBV5PP.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\G84IrBV5PP.exe3⤵PID:4448
-
-
-
C:\ProgramData\G84IrBV5PP.exe"C:\ProgramData\G84IrBV5PP.exe" Photos.dll,stProgNew2⤵
- Executes dropped EXE
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:3068
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD5ef3179d498793bf4234f708d3be28633
SHA1dd399ae46303343f9f0da189aee11c67bd868222
SHA256b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa
SHA51202aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e
-
Filesize
70KB
MD5ef3179d498793bf4234f708d3be28633
SHA1dd399ae46303343f9f0da189aee11c67bd868222
SHA256b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa
SHA51202aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e