Analysis
- max time kernel
120s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
27/11/2024, 19:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
120 seconds
General
- Target 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe
- Size 4.6MB
- Sample241127-ylbt9atpcn
- SHA256 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa
- MD5 c0a5f0a0ea95ae5d6b1a3dc36151dfc2
- SHA1 b57e795d9f3fe1e61d5f171cda6b411b6d67f21e
- SHA512 adc02b226ad781b27bff2bc04c4c6e1121b6bd322673eba22bbf7de76d47af6a0d2c8f2d485cee70337ee84d03a7be0678b0bdabc64f5c7204d0dcc6466a6ead
- SSDEEP 98304:RF8QUitE4iLqaPWGnEvSdsc0B18YhT8qX/WqDb:RFQWEPnPBnEKd50P8YhT825b
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Banload
Banload variants download malicious files, then install and execute the files.
- Banload family
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe - Renames multiple (299) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\yo.txt.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\7-Zip\Lang\kab.txt.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\System\ado\msador15.dll.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Crashpad\settings.dat.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\7-Zip\Lang\eo.txt.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\7-Zip\Lang\fa.txt.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\System\ado\msado28.tlb.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ink\dicjp.bin.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\7-Zip\Lang\es.txt.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\7-Zip\Lang\ps.txt.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\7-Zip\7-zip32.dll.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\7-Zip\7z.sfx.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe File created C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Help Collection Wrapper Class" 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "%SystemRoot%\\SysWow64\\mmcshext.dll" 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Apartment" 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2816 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe Token: SeIncBasePriorityPrivilege 2816 4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe"C:\Users\Admin\AppData\Local\Temp\4c69fe8b2029203c70aac3215209f73a96e059fb567df7dd70e298c974c152aa.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2816
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1045960512-3948844814-3059691613-1000\desktop.ini.tmp
- Size 4.7MB
- SHA256 0a96dbffc91214688255e2661bdd9e185ffbf559604f6e45af85150f5d1b3f80
- MD5 2ff3e182d1fce3ceab9bab630505cef2
- SHA1 971c9a4b72c7fd3ae3532c42054359a57789ad1f
- SHA512 3490eaf61a101d1ff5a5ec730b42b5b73f09ff3c372347aac7c14277485dfd11562dcb1e641da3fa6c771352c3330583b771f0e91bc7f86d933c5364840ea1d3
- SSDEEP 98304:RF8QUitE4iLqaPWGnEvSdsc0B18YhT8qX/WqD6:RFQWEPnPBnEKd50P8YhT8256
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 4.8MB
- SHA256 89733c65619d931d7400710999842efbfa0bc28858404ed3fbff5f44c3009648
- MD5 c789387fce9f7bb43e5a50aa3fd71a28
- SHA1 cabac65d0455f214a2bf6d918482690f8a4eb58b
- SHA512 8f98f0212f9d3a337b073ae618deb90c547baacd76319055baa86e53540aede1b10272a8e03b829c879edbd576f9d9cdeb445ee3784549af9af7c3d4d0929a64
- SSDEEP 98304:RF8QUitE4iLqaPWGnEvSdsc0B18YhT8qX/WqD9:RFQWEPnPBnEKd50P8YhT8259
- MD5 SHA1 SHA512 SSDEEP