Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
-
submitted
02-12-2023 07:37
General
-
Target
28a1789195be417e744d4f3cb81dc3b1e23330be91def9c1b5f1619bde2e223b.exe
-
Size
3.0MB
-
MD5
fafe5e511d3f03ff20d604be5fe6c295
-
SHA1
159bc4986b21677430c6fcdc9fb89f4473099fb8
-
SHA256
28a1789195be417e744d4f3cb81dc3b1e23330be91def9c1b5f1619bde2e223b
-
SHA512
a2c09a957c2464e2f41efee9f45f3937b6f882a805ff4df77a0b9a131a8d95c4e1aba6480cc2b16c88b1c635b95266fbe928e9bafc3b3cf50f59b54aa1026073
-
SSDEEP
49152:oVU9z/GWnXTQs1z1ng1HtMyMpy7Q+nnR2SI7CZVzv0Ozc7DHi/w6AN:oVUxGGrngvPWGQsnDI7CZVrgnHi/fs
Score
10/10
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
-
Modifies registry class 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\28a1789195be417e744d4f3cb81dc3b1e23330be91def9c1b5f1619bde2e223b.exe"C:\Users\Admin\AppData\Local\Temp\28a1789195be417e744d4f3cb81dc3b1e23330be91def9c1b5f1619bde2e223b.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
-
Filesize
4.6MB
-
Filesize
2.0MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4.6MB