Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/05/2023, 18:33

General

  • Target

    1.msi

  • Size

    3.5MB

  • MD5

    e1abe0b693e8ee3df8367caf14f8565c

  • SHA1

    14867c8c4bbcc57efe63a71bfcde4cf832be9b2a

  • SHA256

    6fed6902e05e825c5c600df452de46736263d58920d32a9346b50c6248384211

  • SHA512

    f51b5d36761d9e8443809056c508e43ff668a858c02c81bb95d10cf333af1eac587cbb14e6a3b98b23845aee6d6afa35999cb2540a13846ba0864bc90f2e9be6

  • SSDEEP

    98304:OnokaJXwylk5q30yI43EDhKgn8owQTJK/gQm5z/K:nH753iYgdOTmFK

Score
10/10

Malware Config

Extracted

Family

bumblebee

Botnet

kp2704

C2

103.175.16.119:443

146.19.173.76:443

172.93.201.2:443

rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

  • Blocklisted process makes network request 5 IoCs
  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Drops file in Windows directory 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\1.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4740
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4288
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4824
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -file "C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\pass.ps1"
        2⤵
        • Blocklisted process makes network request
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2104
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iplsnohz\iplsnohz.cmdline"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3380
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4D55.tmp" "c:\Users\Admin\AppData\Local\Temp\iplsnohz\CSC6FC86F2D9E11417281789B9913387FE3.TMP"
            4⤵
              PID:1908
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\icopf1cl\icopf1cl.cmdline"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:488
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6215.tmp" "c:\Users\Admin\AppData\Local\Temp\icopf1cl\CSCEE5311946428468B8B77CB67E535880.TMP"
              4⤵
                PID:3868
          • C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\KeePass-Setup.exe
            "C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\KeePass-Setup.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4244
            • C:\Users\Admin\AppData\Local\Temp\is-BF6UC.tmp\KeePass-Setup.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-BF6UC.tmp\KeePass-Setup.tmp" /SL5="$70058,2170270,781312,C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\KeePass-Setup.exe"
              3⤵
              • Executes dropped EXE
              PID:3124
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:2172

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Config.Msi\e574324.rbs

          Filesize

          7KB

          MD5

          2e932d0faca2d2b1442965cd9c52a20d

          SHA1

          8ede9f42ab4b16210aa99e83b35d7c09f3e0a044

          SHA256

          335e0e473d1378ae10441b5e31ef2c7f7cd34ff9f99e236a87f87ecae0282993

          SHA512

          8e04928749d3feb58ed614069cd1785cc9b78e6f166da60910ec3632e6905bfbf3e216efad97697af63f010ea23bba7ff22eabc11611e1eea2a4c751f36d39be

        • C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\KeePass-Setup.exe

          Filesize

          2.9MB

          MD5

          52afb5fab6660c027f505186d1e9ddca

          SHA1

          a57780208cc7ee4026494b077d8114152347f6b4

          SHA256

          d5cf432ac514cb5239a879a22cc3e0eef6cbc089aa40146a6a1e38c090ac79ba

          SHA512

          81e16e3f628861eb6a058bb6b4a7e41b343c09e14d230dfeaacd58135fcb1feed87cd2ee6c394f319e863c249059a69e7eff1696588b012a6bd00547cca7d54c

        • C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\KeePass-Setup.exe

          Filesize

          2.9MB

          MD5

          52afb5fab6660c027f505186d1e9ddca

          SHA1

          a57780208cc7ee4026494b077d8114152347f6b4

          SHA256

          d5cf432ac514cb5239a879a22cc3e0eef6cbc089aa40146a6a1e38c090ac79ba

          SHA512

          81e16e3f628861eb6a058bb6b4a7e41b343c09e14d230dfeaacd58135fcb1feed87cd2ee6c394f319e863c249059a69e7eff1696588b012a6bd00547cca7d54c

        • C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\pass.ps1

          Filesize

          2.2MB

          MD5

          4d16bd7cc13c4ac89c59d2825fc9a3c3

          SHA1

          7cc9b7bdf9a7577d2a2d592be2f2db61a118cc2b

          SHA256

          9b6125e1aa889f2027111106ee406d08a21c894a83975b785a2b82aab3e2ac52

          SHA512

          71e3c7c85866a39ecda4278762633a8dfd313779c3f3d8494453f9dd4bf92e96fa94b7880fd45444673cb84f74dc0ecd0006b7a693a2cb7f5fc776a6157cf922

        • C:\Users\Admin\AppData\Local\Temp\RES4D55.tmp

          Filesize

          1KB

          MD5

          1e37d249994118d887ec599a9109ef2a

          SHA1

          8bbf0291825a399eebf576f5210f1df3189950bb

          SHA256

          499de6fbf5126e4afbfd98dea39ac043b5061ddfe7bb5fd830069b0128be2d08

          SHA512

          d4ad2673a25223a0f358509bb86acab490bdd5d2436164cdaa97df269c16475de42216fb963a8b4b8db855b763637006c22bcac831c90618a06f146c050fae38

        • C:\Users\Admin\AppData\Local\Temp\RES6215.tmp

          Filesize

          1KB

          MD5

          d0a55bcaad9a5052ae55a94fd0d84b07

          SHA1

          7f4e685a7a854a81f64fbf812d977dca3f60cc88

          SHA256

          65d490ff445df9f16bcc712e0fa2c628a606a5471028541f7ef72cd66289a525

          SHA512

          2cbd4a9a29ea21dc513de17ef3cf64b103e3670503d65060bfcb11f9c9602c1dba04c0f9dbb1044d770308e128e026a7b17939f9861f8e7e6bd92edbe420c1d5

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qux3r5c0.o5a.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\icopf1cl\icopf1cl.dll

          Filesize

          3KB

          MD5

          4aaf904695a256b16c99b379ef8e0f77

          SHA1

          49f012b2abf6fa136bed55357efbf1f8f357dff2

          SHA256

          a0179b5413d0e6a8d96c2349d4b553fc58baa4d04369e83ebe427aa6f616fae2

          SHA512

          2935363f553cb5eee4209fe811085465f41711c9c1e97ccdeb76db70d23404a28cefd11df46d1f170dd7aec9538b1bd607376c28c1cab4da7c79a1041e1aa8c9

        • C:\Users\Admin\AppData\Local\Temp\iplsnohz\iplsnohz.dll

          Filesize

          3KB

          MD5

          7a05867ac1ec85df27b556f8885ca4d4

          SHA1

          774979006078134829cce5db76c84c53ae76d0d1

          SHA256

          b8aef71018a7f8c9dea32ef1994d2f691fd6ae63156dcf97b13966e01140308d

          SHA512

          3dd531ddde58438fbe9fa7d7a19e33917a375df29e5f83f1abc7420950e272c10eb29c4e62664b774ad042e3827e3b99ee52c0c3d8bb2ddd140ee9a9cbc582f1

        • C:\Users\Admin\AppData\Local\Temp\is-BF6UC.tmp\KeePass-Setup.tmp

          Filesize

          3.0MB

          MD5

          d1ef2c4a186f83eac96f90a68c706498

          SHA1

          e1ee6eb95a042f7094d628e1e8e26b7484cecea8

          SHA256

          8746ed5498199546babaa5d65a24f777227f3045a15ded568bbfd450f69a6861

          SHA512

          fabe2a2a3ead7f83e22dc5a12b5ea9853ef4af6b24417fe901b185eb003c2e52da22d9da9a6a295a08d16dafe82b2f3e6b716ae9438e6fcfbbca7af40e1d30fc

        • C:\Windows\Installer\e574323.msi

          Filesize

          3.5MB

          MD5

          e1abe0b693e8ee3df8367caf14f8565c

          SHA1

          14867c8c4bbcc57efe63a71bfcde4cf832be9b2a

          SHA256

          6fed6902e05e825c5c600df452de46736263d58920d32a9346b50c6248384211

          SHA512

          f51b5d36761d9e8443809056c508e43ff668a858c02c81bb95d10cf333af1eac587cbb14e6a3b98b23845aee6d6afa35999cb2540a13846ba0864bc90f2e9be6

        • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

          Filesize

          11.8MB

          MD5

          4fd04b4d60b078ff6993107d81e5e797

          SHA1

          72e3e25743637c6f072283f0d2f768cf129c4517

          SHA256

          34977246f19254d7417d5aa90af59e0e39cec9a5586261c084d89e598527fabb

          SHA512

          ed621231801fbfeacd0e72e3fdc1fd6523889886c6f2022a1d5b901d1d2fb3dd5fa28d8af1be27ed5e8e6ff9d31e84952bb1cce8138e3478378dfbb2cf7a3659

        • \??\Volume{6aa5dca8-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{4401faa5-d0e4-4b6c-8853-bdc999ea0d8a}_OnDiskSnapshotProp

          Filesize

          5KB

          MD5

          1670c7cf78b25d95b0ad66d7fd3d3455

          SHA1

          cca1ab69a0b759f0a751154601b77246622f9fb3

          SHA256

          c371af3f392fadd333f656ff0c037246d1cef52c4987084aa7ab9070cb2b4584

          SHA512

          2fcfc9315f7340d4663763ed2d35365e8ee049abc7ca27a7d4bb41932cb596cea7be2e275180a561fd1d0f83cd7be4027d30bb4b488f216ed694fcdee813133c

        • \??\c:\Users\Admin\AppData\Local\Temp\icopf1cl\CSCEE5311946428468B8B77CB67E535880.TMP

          Filesize

          652B

          MD5

          bad4be75a37ab983eee733ad9dbbdee5

          SHA1

          a578ff816ba033999544e3e6398de42f1d3b1d7d

          SHA256

          499f5b2a139fb5f65465d235c1fc5177bf9005aefe4bc3d39683024206052365

          SHA512

          d75a926f145b2d21f4c6e570c47d1f4912385110997c40cd136ca43374e90e1f9c423ac0fe6868cd2a43c3d35a49c5a54c60d5ca960ae1c18650b989e2f11202

        • \??\c:\Users\Admin\AppData\Local\Temp\icopf1cl\icopf1cl.0.cs

          Filesize

          582B

          MD5

          2bb8d0ee93aeae61a09adf4db6f29c1c

          SHA1

          8da3034bb8f84ea2522e276b492b2797b5db30ca

          SHA256

          68d44e3c373d2aec9dacf51326cbfebcba76c1c1a56545e5e1cbf58b44a9f817

          SHA512

          b3ec6841a9541e96a671a7d81378293567972541d9cdfc3137b478d9b4d3cccd4b5f536d0f059ee9c12fe9ba86bca62b795139a5215843465cb751e0ade95677

        • \??\c:\Users\Admin\AppData\Local\Temp\icopf1cl\icopf1cl.cmdline

          Filesize

          369B

          MD5

          e9db4327b48795065b71480fd052e771

          SHA1

          5223147faa71e555c57b098dd80c04ce3508f3af

          SHA256

          64365fba206d56b82b7b52e9c8b515625f75c4a94d5ced2328f2c6ce2e02934e

          SHA512

          e4b6d311b915acd3850ad965dd89d80a577a32b5f2f197b6fd902aa193fbb3dbcca366451fea9a45e39d9673a7c9ddc500b01e16e4f0e06ea48e69789429e217

        • \??\c:\Users\Admin\AppData\Local\Temp\iplsnohz\CSC6FC86F2D9E11417281789B9913387FE3.TMP

          Filesize

          652B

          MD5

          80f3018e5308999194d3b0d2b479d122

          SHA1

          6b1fc58a5975f2027de46c08b00e210ad1e44020

          SHA256

          91c78dc4cfc9c4ce957c526a9f9cd0466194057652ad1a2c968aa1468c7baa5a

          SHA512

          c6e71b2d14c7f0d99007a02c898fdff61a49b1dfbe3146472d6ef0f472f737ef562a3e0682319b0933c743540090de83e44c6d5b68ff63d7a34785d0560b96cd

        • \??\c:\Users\Admin\AppData\Local\Temp\iplsnohz\iplsnohz.0.cs

          Filesize

          203B

          MD5

          b611be9282deb44eed731f72bcbb2b82

          SHA1

          cc1d606d853bbabd5fef87255356a0d54381c289

          SHA256

          ee09fdd61a05266e4e09f418fc6a452f1205d9f29afba6b8a1579333dc3ff3b6

          SHA512

          63b5ad7b65fd4866fb8841e4eee567e4f1e7888bb9fda8dd5c8dca3461d084d3f80ce920ae321609e4ff32ba13a55b7320282ce7201bb74a793d4700240360a4

        • \??\c:\Users\Admin\AppData\Local\Temp\iplsnohz\iplsnohz.cmdline

          Filesize

          369B

          MD5

          74bfe19fb949ea9bc877d5328dfb1001

          SHA1

          2a856006d840c80c2f00436363fb9ede753baf72

          SHA256

          4ef60b43d454d3ebcb1d2898621e717104a70bb3227b5bdbd096c63e4dadf3ce

          SHA512

          c1b1782ef1f2f7cdac916a8478b6af065feac061bfb29a500a7aee3c8a6a77f77397924ada0149a43a3d8c31f64ce32cf7962d784c007d1529fb8407a3c5e90d

        • memory/2104-173-0x000002397C050000-0x000002397C072000-memory.dmp

          Filesize

          136KB

        • memory/2104-220-0x000002397B690000-0x000002397B6A0000-memory.dmp

          Filesize

          64KB

        • memory/2104-177-0x000002397B690000-0x000002397B6A0000-memory.dmp

          Filesize

          64KB

        • memory/2104-174-0x000002397B690000-0x000002397B6A0000-memory.dmp

          Filesize

          64KB

        • memory/2104-209-0x000002397C280000-0x000002397C3EA000-memory.dmp

          Filesize

          1.4MB

        • memory/2104-215-0x000002397C600000-0x000002397C76A000-memory.dmp

          Filesize

          1.4MB

        • memory/2104-217-0x000002397C600000-0x000002397C6BE000-memory.dmp

          Filesize

          760KB

        • memory/2104-235-0x000002397B690000-0x000002397B6A0000-memory.dmp

          Filesize

          64KB

        • memory/2104-221-0x00007FFEFB770000-0x00007FFEFB771000-memory.dmp

          Filesize

          4KB

        • memory/2104-175-0x000002397B690000-0x000002397B6A0000-memory.dmp

          Filesize

          64KB

        • memory/2104-222-0x000002397C600000-0x000002397C76A000-memory.dmp

          Filesize

          1.4MB

        • memory/2104-223-0x000002397C600000-0x000002397C76A000-memory.dmp

          Filesize

          1.4MB

        • memory/2104-227-0x000002397B690000-0x000002397B6A0000-memory.dmp

          Filesize

          64KB

        • memory/2104-228-0x000002397B690000-0x000002397B6A0000-memory.dmp

          Filesize

          64KB

        • memory/2104-229-0x000002397B690000-0x000002397B6A0000-memory.dmp

          Filesize

          64KB

        • memory/3124-226-0x0000000000400000-0x0000000000707000-memory.dmp

          Filesize

          3.0MB

        • memory/3124-192-0x0000000000A00000-0x0000000000A01000-memory.dmp

          Filesize

          4KB

        • memory/3124-230-0x0000000000A00000-0x0000000000A01000-memory.dmp

          Filesize

          4KB

        • memory/4244-159-0x0000000000400000-0x00000000004CC000-memory.dmp

          Filesize

          816KB

        • memory/4244-219-0x0000000000400000-0x00000000004CC000-memory.dmp

          Filesize

          816KB