Overview

overview

10

Static

static

1

Midjourney.msi

windows7-x64

10

Midjourney.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-10-2024 09:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Midjourney.msi

  • Size

    2.6MB

  • MD5

    c962d866683ba35349a00a70e9c759b4

  • SHA1

    8527e1ab0068df818d5bc991bca0e12c442912c1

  • SHA256

    c26344bfd07b871dd9f6bd7c71275216e18be265e91e5d0800348e8aa06543f9

  • SHA512

    e05e172dc1c0b5feca7ca894d75790e1ceb1cf0f006d90ea6950041fadb14cec9503b628a09584a3bca21459618cc7ed7dd0b603572cdf5442391c74af5a68fb

  • SSDEEP

    49152:qrE0kuqES58NtvUBJrM6WZrws4neyy/MikYHBoHOUGx:MkufFh6W5wvneyyUPgBi

Score
10/10
bumblebeemsidiscoveryloaderpersistenceprivilege_escalation

Malware Config

Extracted

Family

bumblebee

Botnet

msi

Attributes
  • dga

    tvx1ovdepj8.life

    acgr6r8zdot.life

    ilofx941igp.life

    8x2apo5m7ri.life

    x9yrzer0ndt.life

    93j4v4jopzd.life

    ameagxzo2f7.life

    nyy41uibsv5.life

    ru4jvijdytq.life

    l9t6r0y6cvi.life

    f4vb9n3tdvh.life

    9do3mcejztt.life

    pxu1ajsdhqr.life

    7exy2b231n2.life

    vu5b47m18jn.life

    6mnudp7zj73.life

    p5047yjrb8q.life

    d0xtxp89bb9.life

    ygo9u1fkwux.life

    fig3gj0v6qe.life

    38f5wvwwn7o.life

    txgogs9p8a1.life

    uyn0icgx1kv.life

    2z1ls31az7s.life

    0cc2z8zrnhf.life

    fsr2hskx44p.life

    du19ek78tjw.life

    234ct3lkozp.life

    he8fq4k8d3w.life

    7ewh8ltr7il.life

  • dga_seed

    1.0163655285949564e+18

  • domain_length

    11

  • num_dga_domains

    100

  • port

    443

rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee
  • Blocklisted process makes network request 8 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 10 IoCs
  • Loads dropped DLL 11 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Midjourney.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2376
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4572
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding E9F88FC77FBBC558E5688AF453B0EC11 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2880
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2644
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 5983E330614E954BA9E91A9CFB33E3B8
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2868
      • C:\Windows\System32\MsiExec.exe
        "C:\Windows\System32\MsiExec.exe" /Y "C:\ProgramData\BDncqpUxZl.dll"
        2⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        PID:1008
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4172,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
      1⤵
        PID:4568
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:4332

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\BDncqpUxZl.dll
        Filesize

        2.1MB

        MD5

        40ee908eff9418d1cbcb36ea516ca34e

        SHA1

        e13e947f3ce59a2a58ce09c2d8888053d685fa44

        SHA256

        7df703625ee06db2786650b48ffefb13fa1f0dae41e521b861a16772e800c115

        SHA512

        eedae343bf53411aa9a64e0f6ae9ee1ac15b6cdc02d94894604974e5d0ffcafc56f9df9afa368cab38a017785e559d75bb9dea95bffc78088048cf3b1ec7d639

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\MSI2A66.tmp
        Filesize

        816KB

        MD5

        aa88d8f40a286b6d40de0f3abc836cfa

        SHA1

        c24eab9e4b10b159b589f4c3b64ef3db111ea1c8

        SHA256

        8d633efeda1249356b11bf8f46583242356e4f903056b53bd25a99511d1790a1

        SHA512

        6c2f2f6a2d66015f30158962d653e381136f0f30023380a0ce95bd0944d856113fbde65db52dbb3b5de1c0e2edf2cd53184e721c64b916834be4198c61224519

        Download Submit

      • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
        Filesize

        23.7MB

        MD5

        134fbe8918009357870797d2f1d78f9d

        SHA1

        0bb56be71ed6c8a7d2608f57f6bb74277bb40359

        SHA256

        35f85419f543f773de13fdcb7d1815e60b0ef1de10557e1cbb51eacbaa1846fc

        SHA512

        deb6f79f81c855ef140964465e2a7bfe484646de4060f3237519a047f5a4b3a1d29fcc34f3c9c0c8f1e85934884caa2c6d44fe5e70eea4d7e73556f75b608d6f

        Download Submit

      • \??\Volume{ff3ab8f7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1e08ea81-f6db-4951-93bb-12effc98d796}_OnDiskSnapshotProp
        Filesize

        6KB

        MD5

        b6bbe3226cadbae70eea266b2d251bc4

        SHA1

        911ae37669f868ba03d506ad06516b49dcd56f0b

        SHA256

        d68cd234d08cacea1d7ce0429b2aee4f8be87f7ce7ad5c4ca1349cab120f45e2

        SHA512

        9ec4cbcfdbb780f61b22ff59c5dd1e4714c05f0a038d8b6e9f89352bbc44eee5e5b23bc52a41f1aec6f4bebef701a6aa2d3e3b8fa3ae391375266f98da0670ce

        Download Submit

      • memory/1008-55-0x0000019631880000-0x0000019631A99000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/1008-57-0x0000019631880000-0x0000019631A99000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/1008-58-0x0000019631880000-0x0000019631A99000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/1008-56-0x0000019631880000-0x0000019631A99000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/1008-59-0x0000019631880000-0x0000019631A99000-memory.dmp

        Filesize

        2.1MB

        Download