Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
05/10/2023, 18:36
General
-
Target
bumblexe_JC.exe
-
Size
1.1MB
-
MD5
18bed86ae98c975ae31c170c3a8e1981
-
SHA1
7ea59b934a0b3a0c89832ad11e87a4cfd92a6774
-
SHA256
e0c72b8d08e6fdd5446ddd8102e841a44b1d51af8fd2599533e374c44f2a5946
-
SHA512
b2fb27157cf03a80ecf16c106d6434441fea3f5dbd7ff2ac8341c815b1dc4da605d1e7da16618b0d7db0c893bf08170232acbb94acbf816bb9fea0f7ee866771
-
SSDEEP
24576:fKf0SdDbFUsLbfzo1SI5N3SttKE+GWXfDb0mW:fKfdbFUsLzzmN3gtMX4m
Score
10/10
Malware Config
Extracted
Family
bumblebee
Botnet
is0210
rc4.plain
Signatures
-
BumbleBee
BumbleBee is a webshell malware written in C++.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bumblexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\bumblexe_JC.exe"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
740KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB