Malware Analysis Report

2025-01-22 23:10

Sample ID 241203-19r79axldv
Target feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe
SHA256 feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07
Tags
banload discovery downloader dropper evasion ransomware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07

Threat Level: Known bad

The file feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe was found to be: Known bad.

Malicious Activity Summary

banload discovery downloader dropper evasion ransomware trojan

Banload

Banload family

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Renames multiple (485) files with added filename extension

Renames multiple (211) files with added filename extension

Checks BIOS information in registry

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-03 22:21

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-03 22:21

Reported

2024-12-03 22:23

Platform

win7-20240903-en

Max time kernel

120s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A

Renames multiple (211) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\7-Zip\Lang\ku.txt.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\7-Zip\Lang\co.txt.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\7-Zip\Lang\lv.txt.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\7-Zip\Lang\lij.txt.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\7-Zip\Lang\ro.txt.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\7-Zip\Lang\vi.txt.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\7-Zip\7z.sfx.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\7-Zip\Lang\fr.txt.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\7-Zip\Lang\sv.txt.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\7-Zip\Lang\lt.txt.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\7-Zip\Lang\th.txt.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\7-Zip\Lang\sw.txt.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\7-Zip\Lang\si.txt.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\7-Zip\Lang\et.txt.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Microsoft Multiple AutoComplete List Container" C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32 C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ = "%SystemRoot%\\SysWow64\\shell32.dll" C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe

"C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe"

Network

N/A

Files

memory/2092-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2092-1-0x0000000003040000-0x000000000324C000-memory.dmp

memory/2092-8-0x0000000003040000-0x000000000324C000-memory.dmp

memory/2092-11-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2092-13-0x0000000003040000-0x000000000324C000-memory.dmp

memory/2092-12-0x0000000000400000-0x0000000000616000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

MD5 c5b5aad25c8751ce694e26cc32989665
SHA1 daaf3999992bc9a0f7f04eda661365a1e4674d7d
SHA256 6888e471b1f0ace15bfc5c982fa83c8c71085c3c965a67960c3358b4554973fc
SHA512 4ba0750ed3079922f1d25f732a323f150cf7acdaf58d195a5a298fc580ee90120e9d4a19ae869c04b027b0c16ba8c2fd57f46d6d96fa5b92750335e59c5fe859

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 8e84d40c786fea9b3e0200333f2798cd
SHA1 7a64915c3c6f72d8be0bd2b0528edd4052b2aa01
SHA256 4b31cf28551ae5756e302611253dfb433cb6279ebbfb3fed638c0bf3b35b2c87
SHA512 28d9c989cb126c0a7ac009d24ed0b62108fd998886e5aade153cf031486916353ddf5f79020b90c6d41948c18c1f22686cb12951729d3f78f29d8b68531bb264

memory/2092-26-0x0000000003040000-0x000000000324C000-memory.dmp

memory/2092-25-0x0000000003040000-0x000000000324C000-memory.dmp

memory/2092-43-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2092-53-0x0000000003040000-0x000000000324C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-03 22:21

Reported

2024-12-03 22:23

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

94s

Command Line

"C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A

Renames multiple (485) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\7-Zip\Lang\br.txt.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\7-Zip\7zFM.exe.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\7-Zip\7zG.exe.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\System\ado\msado20.tlb.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-sysinfo-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.Core.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Annotations.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\System\ado\msador28.tlb.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.DispatchProxy.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\7-Zip\Lang\ga.txt.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-environment-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\7-Zip\Lang\hi.txt.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\7-Zip\Lang\sk.txt.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "both" C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\LocalServer32\ = "%SystemRoot%\\SysWow64\\plasrv.exe" C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\TypeLib C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Version\ = "1.0" C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "%SystemRoot%\\SysWow64\\pla.dll" C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID\ = "PLA.LegacyTraceSessionCollection.1" C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\LocalServer32 C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\TypeLib\ = "{03837500-098B-11D8-9414-505054503030}" C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Version C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID\ = "PLA.LegacyTraceSessionCollection" C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "LegacyTraceSessionCollection" C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\AppID = "{03837503-098b-11d8-9414-505054503030}" C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe

"C:\Users\Admin\AppData\Local\Temp\feaa194b569ca1d8743967e3be49d4e5aff92c8029cb6399753d2367cc28dd07N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 69.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

memory/728-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/728-2-0x0000000004560000-0x000000000476C000-memory.dmp

memory/728-9-0x0000000004560000-0x000000000476C000-memory.dmp

memory/728-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/728-13-0x0000000000400000-0x0000000000616000-memory.dmp

memory/728-14-0x0000000004560000-0x000000000476C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-493223053-2004649691-1575712786-1000\desktop.ini.tmp

MD5 cd4b90e1de8690aae7cd8c2c9f44d9bc
SHA1 2b7ff0cebfbf2ce5e536f724e0fc0d4a1196e092
SHA256 3d81f06de41c33e8741b4a9c2df6b00aab264d2fea7561d9ee6e5b6dbf733d26
SHA512 1457479d2c97369040d96b2aeff0823894539af2a8d53f769e8894f1c2e700a3c3a51d3fca4069944fdd17d67dd30fd8c51f77d5292f8204381af51673855e90

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 3b75351b497062af07bcc9297e0d769a
SHA1 ff2dfccf2398435059b91f83222731bf16a8e89d
SHA256 7bc606158b86073d32e54d817eafa0b08816453f6f6d76f5927bc050c4522f58
SHA512 e7b6741804ffd3683c728b55e99c1381c40fe362779dda063074f5a141c9f83448524244f1d199e6ddfe69930d49d62212f6704b03a6a92a4511f75cd3611431

memory/728-42-0x0000000004560000-0x000000000476C000-memory.dmp

memory/728-43-0x0000000004560000-0x000000000476C000-memory.dmp

memory/728-112-0x0000000000400000-0x0000000000616000-memory.dmp

memory/728-126-0x0000000004560000-0x000000000476C000-memory.dmp