Analysis
-
max time kernel
155s -
max time network
211s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2023 04:19
Static task
static1
Behavioral task
behavioral1
Sample
40a90272edbef7cb499c87e98840f6f02d8a1981dedeff467fe8eb68ec23cb5c.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
40a90272edbef7cb499c87e98840f6f02d8a1981dedeff467fe8eb68ec23cb5c.exe
Resource
win10v2004-20230915-en
General
-
Target
40a90272edbef7cb499c87e98840f6f02d8a1981dedeff467fe8eb68ec23cb5c.exe
-
Size
3.1MB
-
MD5
674088308ebc434879c89d9d92dcab5a
-
SHA1
6fa9a71c43a13583b2b0b5b4269b1b64a83c8060
-
SHA256
40a90272edbef7cb499c87e98840f6f02d8a1981dedeff467fe8eb68ec23cb5c
-
SHA512
b9a093dcd5e616d0f17693cc0eb9bf93a771019fcbcad6c4c8251b8f327570a414f4b2b258a2cba5c69c902a70b248e29946b1fb2e36897df737bf008488f71d
-
SSDEEP
98304:g5fvaOytTms9mOh68B+5JC6COpBmPxMtL:g5fsv9mp8T6CiBmPxk
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
40a90272edbef7cb499c87e98840f6f02d8a1981dedeff467fe8eb68ec23cb5c.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 40a90272edbef7cb499c87e98840f6f02d8a1981dedeff467fe8eb68ec23cb5c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 40a90272edbef7cb499c87e98840f6f02d8a1981dedeff467fe8eb68ec23cb5c.exe -
Modifies registry class 5 IoCs
Processes:
40a90272edbef7cb499c87e98840f6f02d8a1981dedeff467fe8eb68ec23cb5c.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B1243ED3-4B27-341D-7712-354446A630B1} 40a90272edbef7cb499c87e98840f6f02d8a1981dedeff467fe8eb68ec23cb5c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B1243ED3-4B27-341D-7712-354446A630B1}\ = "HomeGroup Task" 40a90272edbef7cb499c87e98840f6f02d8a1981dedeff467fe8eb68ec23cb5c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B1243ED3-4B27-341D-7712-354446A630B1}\InProcServer32 40a90272edbef7cb499c87e98840f6f02d8a1981dedeff467fe8eb68ec23cb5c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B1243ED3-4B27-341D-7712-354446A630B1}\InProcServer32\ = "%SystemRoot%\\SysWow64\\xwizards.dll" 40a90272edbef7cb499c87e98840f6f02d8a1981dedeff467fe8eb68ec23cb5c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B1243ED3-4B27-341D-7712-354446A630B1}\InProcServer32\ThreadingModel = "Apartment" 40a90272edbef7cb499c87e98840f6f02d8a1981dedeff467fe8eb68ec23cb5c.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
40a90272edbef7cb499c87e98840f6f02d8a1981dedeff467fe8eb68ec23cb5c.exedescription pid process Token: 33 968 40a90272edbef7cb499c87e98840f6f02d8a1981dedeff467fe8eb68ec23cb5c.exe Token: SeIncBasePriorityPrivilege 968 40a90272edbef7cb499c87e98840f6f02d8a1981dedeff467fe8eb68ec23cb5c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\40a90272edbef7cb499c87e98840f6f02d8a1981dedeff467fe8eb68ec23cb5c.exe"C:\Users\Admin\AppData\Local\Temp\40a90272edbef7cb499c87e98840f6f02d8a1981dedeff467fe8eb68ec23cb5c.exe"1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:968