Overview

overview

10

Static

static

3

2024-12-03...ff.exe

windows7-x64

10

2024-12-03...ff.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-12-2024 17:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe

  • Size

    13.3MB

  • MD5

    be4a5b81976ca86d9073acf739533bd7

  • SHA1

    e5c839b3238d27aa702633e72a8ad99925d1d24c

  • SHA256

    fd4321374a63a1c7e3b38de206126fe029312da2c22e758a688c5dc1f6f6cf8d

  • SHA512

    8bad167122923082a09d950d9a8214df355d6a208bf051f2bd90cf9727901df54ca142b592a6508065d4b42f4217a7e1f1028d949804c0f59dde31929340d0b6

  • SSDEEP

    98304:RF8QUitE4iLqaPWGnEvK7RkOEEo+A7mOk3oaCVA7m2St29Ejzh9oEcx/R2qVIK4u:RFQWEPnPBnEXPELR8N3MKFBIHuM/Z

Score
10/10
banloaddiscoverydownloaderdropperevasionransomwaretrojan

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Banload family
    banload
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Renames multiple (219) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-12-03_be4a5b81976ca86d9073acf739533bd7_hawkeye_hijackloader_jaff.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:4852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini.tmp
    Filesize

    13.5MB

    MD5

    6560e3407e40fe1e4f4b1e07beae583d

    SHA1

    ed67a4e410b8ee0473f6b10c2e101c15b2002b74

    SHA256

    d97a9e4271265e653097ac7a6dbe1c97e35136a073b404f895858b33ececc752

    SHA512

    b5732c820754c9fc3b05a47a616bfd2336d741e1e7ff34fb313ab8b6649028ea1e9a9fa14b69a52bf9384175f48939b3b650a6b90e9989ea13a817dc1b1f5dbf

    Download Submit

  • C:\Program Files\7-Zip\7-zip.dll.tmp
    Filesize

    13.6MB

    MD5

    5a638e7a934b03558de3e6dee0cb74ed

    SHA1

    3c9b4c8aa276a3155c566a61df6cca4202bd8f16

    SHA256

    02cc9fd724bd7c6cbd0f7a3920ec2414aa16a06a161bf1f176c1b5747e532ae8

    SHA512

    b042443e100172843dfbc2b4b8b366b2b1d808c82304bda2b4c4d1a19b8a4ed12f660318c236841652aaaf9f98429f9b05dfba896861b8cee078ef43c07f74d0

    Download Submit

  • memory/4852-0-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/4852-2-0x0000000004970000-0x0000000004B7C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4852-9-0x0000000004970000-0x0000000004B7C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4852-12-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/4852-13-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/4852-14-0x0000000004970000-0x0000000004B7C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4852-23-0x0000000004970000-0x0000000004B7C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4852-22-0x0000000004970000-0x0000000004B7C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4852-42-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/4852-48-0x0000000004970000-0x0000000004B7C000-memory.dmp

    Filesize

    2.0MB

    Download