Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    124s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2024, 02:00

General

  • Target

    c26344bfd07b871dd9f6bd7c71275216e18be265e91e5d0800348e8aa06543f9.msi

  • Size

    2.6MB

  • MD5

    c962d866683ba35349a00a70e9c759b4

  • SHA1

    8527e1ab0068df818d5bc991bca0e12c442912c1

  • SHA256

    c26344bfd07b871dd9f6bd7c71275216e18be265e91e5d0800348e8aa06543f9

  • SHA512

    e05e172dc1c0b5feca7ca894d75790e1ceb1cf0f006d90ea6950041fadb14cec9503b628a09584a3bca21459618cc7ed7dd0b603572cdf5442391c74af5a68fb

  • SSDEEP

    49152:qrE0kuqES58NtvUBJrM6WZrws4neyy/MikYHBoHOUGx:MkufFh6W5wvneyyUPgBi

Malware Config

Extracted

Family

bumblebee

Botnet

msi

Attributes
  • dga

    tvx1ovdepj8.life

    acgr6r8zdot.life

    ilofx941igp.life

    8x2apo5m7ri.life

    x9yrzer0ndt.life

    93j4v4jopzd.life

    ameagxzo2f7.life

    nyy41uibsv5.life

    ru4jvijdytq.life

    l9t6r0y6cvi.life

    f4vb9n3tdvh.life

    9do3mcejztt.life

    pxu1ajsdhqr.life

    7exy2b231n2.life

    vu5b47m18jn.life

    6mnudp7zj73.life

    p5047yjrb8q.life

    d0xtxp89bb9.life

    ygo9u1fkwux.life

    fig3gj0v6qe.life

    38f5wvwwn7o.life

    txgogs9p8a1.life

    uyn0icgx1kv.life

    2z1ls31az7s.life

    0cc2z8zrnhf.life

    fsr2hskx44p.life

    du19ek78tjw.life

    234ct3lkozp.life

    he8fq4k8d3w.life

    7ewh8ltr7il.life

  • dga_seed

    1.0163655285949564e+18

  • domain_length

    11

  • num_dga_domains

    100

  • port

    443

rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a loader malware written in C++.

  • Blocklisted process makes network request 7 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 10 IoCs
  • Loads dropped DLL 11 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\c26344bfd07b871dd9f6bd7c71275216e18be265e91e5d0800348e8aa06543f9.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:368
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 0446D4DAEC9D26DD567E37C977DA1C18 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3952
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:1736
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 5E8C696B803B02B12615D7C557901060
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3248
      • C:\Windows\System32\MsiExec.exe
        "C:\Windows\System32\MsiExec.exe" /Y "C:\ProgramData\BDncqpUxZl.dll"
        2⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        PID:620
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:4976

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\BDncqpUxZl.dll

      Filesize

      2.1MB

      MD5

      40ee908eff9418d1cbcb36ea516ca34e

      SHA1

      e13e947f3ce59a2a58ce09c2d8888053d685fa44

      SHA256

      7df703625ee06db2786650b48ffefb13fa1f0dae41e521b861a16772e800c115

      SHA512

      eedae343bf53411aa9a64e0f6ae9ee1ac15b6cdc02d94894604974e5d0ffcafc56f9df9afa368cab38a017785e559d75bb9dea95bffc78088048cf3b1ec7d639

    • C:\Users\Admin\AppData\Local\Temp\MSI94CE.tmp

      Filesize

      816KB

      MD5

      aa88d8f40a286b6d40de0f3abc836cfa

      SHA1

      c24eab9e4b10b159b589f4c3b64ef3db111ea1c8

      SHA256

      8d633efeda1249356b11bf8f46583242356e4f903056b53bd25a99511d1790a1

      SHA512

      6c2f2f6a2d66015f30158962d653e381136f0f30023380a0ce95bd0944d856113fbde65db52dbb3b5de1c0e2edf2cd53184e721c64b916834be4198c61224519

    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

      Filesize

      23.7MB

      MD5

      35cca46d1f7bd7cb389efacc9b922cc1

      SHA1

      55f085467c7d507fecc15782c1af02a86b9cbb66

      SHA256

      393b8b3b92cdf60bc6ff1762f3ce3cd946df72023c7627fe2a6aeba419ab559e

      SHA512

      87ac1470f512d13a52e2a0a34aa420d6b63f309fd9b6c45c5f766cdf7ae1a30a392b7e1357edd0da6e2c8ea52be3c37b2dbe798c46fa1e9dec51397634e79a26

    • \??\Volume{8484aac9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{525eba44-1cdd-408f-a01f-acf9c0b07263}_OnDiskSnapshotProp

      Filesize

      6KB

      MD5

      dd98032630757d514517d5783409b5d4

      SHA1

      16d72f845cd56b6a1c9d0cc1ba49dc05ba4b25c4

      SHA256

      683602a991aa805aba8280dd92ea7ea3565adf094efa5cfd8899a4d6052685c0

      SHA512

      f40ea6239aec9d72b3a47618391c2c486170d9a57cbb9d521aeb36314b64746acc62fed591e850081667a126e7fb42caf72e12fab2cc3808bba8a2799a7295b3

    • memory/620-55-0x000002A21E400000-0x000002A21E619000-memory.dmp

      Filesize

      2.1MB

    • memory/620-57-0x000002A21E400000-0x000002A21E619000-memory.dmp

      Filesize

      2.1MB

    • memory/620-58-0x000002A21E400000-0x000002A21E619000-memory.dmp

      Filesize

      2.1MB

    • memory/620-56-0x000002A21E400000-0x000002A21E619000-memory.dmp

      Filesize

      2.1MB

    • memory/620-59-0x000002A21E400000-0x000002A21E619000-memory.dmp

      Filesize

      2.1MB