banload | 2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2024 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
Size

3.9MB
MD5

85eed7d73c6d1234229d9d7266b08060
SHA1

9e194d96d27c4adfe67ec7eb83e1d7e60df07b26
SHA256

2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8
SHA512

1b59198128bf362b26b9c09bbb3ac0dfb9346005da48c6cb29d5a8189c2caaa4a106e859236e8d0455be1bae85608f77ff408e258ee7f0dec0868a7a780fa50d
SSDEEP

49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvV8u/kUHHklZ77Szh9ownI:RF8QUitE4iLqaPWGnEvS9Ejzh9oEI

Score

10^/10

banload discovery downloader dropper evasion ransomware trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

Renames multiple (431) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

Drops file in Program Files directory 64 IoCs

Processes:

2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrdeulm.dat.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Crashpad\metadata.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\ConfirmHide.MTS.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrdeslm.dat.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

Modifies registry class 12 IoCs

Processes:

2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Implemented Categories	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\TypeLib	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "XDS Feature Segment"	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "C:\\Windows\\SysWOW64\\msvidctl.dll"	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Apartment"	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Programmable	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\TypeLib\ = "{B0EDF154-910A-11D2-B632-00C04F79498E}"	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Version	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Version\ = "1.0"	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

description	pid	Process
Token: 33	2268	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
Token: SeIncBasePriorityPrivilege	2268	2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe

C:\Users\Admin\AppData\Local\Temp\2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe
"C:\Users\Admin\AppData\Local\Temp\2e4ca2fa6ef7688d88dd12f476b60ab70cb4f3fbd7722b4862800b45cbd2b1e8N.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini.tmp

Filesize
4.0MB

MD5
87dfa021de296e6349eb0bb89df571e2

SHA1
e1c281f0c18ac40c28427b445b769a59860fac8e

SHA256
c50ea93e46f1ab7056f152f2d830efc998f1992ea65f443262101c7d65859e8c

SHA512
e4a8dd88ba56c3062c127697d21c64d77669b2149e7336980770eceed0dbd99950260839f275dc91f3641db1d49da126f51769f1f74db6d7a8753b39ce3bae7f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
4.1MB

MD5
513e5903480d82ae4cb5e86f5cd6161e

SHA1
c62c2cb6815853df44c37994243e9ea397d7deea

SHA256
ab0fd17f43471b0d001003e497bc57c73e8bad39226d6126a8472b3941db42df

SHA512
72cb6bea6fd14600d3000e14bb0aae60719166db3930255ec27dad2bb01aa22cc3aecd6a1943bbb7d4b15ee73d8ef33e0b59c82c119313855da9841b5e89a740

Download Submit
memory/2268-0-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2268-2-0x0000000004480000-0x000000000468C000-memory.dmp

Filesize
2.0MB

Download
memory/2268-9-0x0000000004480000-0x000000000468C000-memory.dmp

Filesize
2.0MB

Download
memory/2268-12-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2268-13-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2268-14-0x0000000004480000-0x000000000468C000-memory.dmp

Filesize
2.0MB

Download
memory/2268-42-0x0000000004480000-0x000000000468C000-memory.dmp

Filesize
2.0MB

Download
memory/2268-43-0x0000000004480000-0x000000000468C000-memory.dmp

Filesize
2.0MB

Download
memory/2268-110-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2268-124-0x0000000004480000-0x000000000468C000-memory.dmp

Filesize
2.0MB

Download