Overview

overview

10

Static

static

3

2024-11-29...ff.exe

windows7-x64

10

2024-11-29...ff.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-11-2024 18:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe

  • Size

    13.1MB

  • MD5

    947c1c8939c8f393224328d2e1d25947

  • SHA1

    338ecfda564a8fc588f5bd1d71d66390500d25d0

  • SHA256

    2427944ef51d4c628073b5db91d897ef4e42595603784a600e95041afb11582a

  • SHA512

    b2b004de725fd60825d2ce995fed9499e4b118830f8daca8cf1bc266fd4517b3d5cbf44b884e2c8647f56a687d62f1c981262d088b1075b591ac6b530825b267

  • SSDEEP

    98304:RF8QUitE4iLqaPWGnEvK7RkOEEo+A7mOk3oaCVA7m2St29Ejzh9oEcx/R2qVIK4t:RFQWEPnPBnEXPELR8N3MKFBIHuM/s

Score
10/10
banloaddiscoverydownloaderdropperevasionransomwaretrojan

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Banload family
    banload
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Renames multiple (219) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-29_947c1c8939c8f393224328d2e1d25947_hawkeye_hijackloader_jaff.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:1032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini.tmp
    Filesize

    13.2MB

    MD5

    cfeb1bceef8a25efdfe675fd526cda0d

    SHA1

    88bc1f8d4c82f7a40036c67e3357f49d88255e4a

    SHA256

    8c61d081bc24642dc914cfd8bf702313637c50c44e05db928892a85eedbb4d33

    SHA512

    a75eebff6592a3fef96c3bcbbf3072ae12dc3db8630fea15243df1b3119ce2c00c424b0d5e349d8db130fc3a2a66cad3cfb2b1eb1614e6a7c58266fd17265954

    Download Submit

  • C:\Program Files\7-Zip\7-zip.dll.tmp
    Filesize

    13.3MB

    MD5

    7385afa35af034cf42a51dd65c606c02

    SHA1

    0f3b8bbb67096ac0785a897ab3624ec0e8fa80f5

    SHA256

    d6c5b2e9fa4d87a385477d618c72cfbeb47e265d8a8e131f18f80416485325ac

    SHA512

    1d5e250d1d40e998994d95b2ea5ea8424f06def8854e2b05b4e24743b786f6fb59a25ad95a0740e65b1ea259b068d77e6b37d9e09448dc1ef75514ce4683403e

    Download Submit

  • memory/1032-0-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/1032-2-0x0000000004950000-0x0000000004B5C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1032-9-0x0000000004950000-0x0000000004B5C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1032-12-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/1032-13-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/1032-14-0x0000000004950000-0x0000000004B5C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1032-24-0x0000000004950000-0x0000000004B5C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1032-25-0x0000000004950000-0x0000000004B5C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1032-44-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/1032-50-0x0000000004950000-0x0000000004B5C000-memory.dmp

    Filesize

    2.0MB

    Download