Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-12-2024 22:33
Static task
static1
Behavioral task
behavioral1
Sample
b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe
Resource
win10v2004-20241007-en
General
-
Target
b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe
-
Size
2.8MB
-
MD5
2e62f8f6fc5d5305441cfe2222c57186
-
SHA1
3291193940a4b14acbc24a7d243b3ab802fd5120
-
SHA256
b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4
-
SHA512
a9bf9fa3315f4fc2407726b674b89f8e08a2111ec1d39851ffbb7260fde4064dccba5c64870ad0fc51cec0cdadab878d4266a2feaa4dfd6ba90698073f14f15f
-
SSDEEP
49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvVWiKjUOlk0u:RF8QUitE4iLqaPWGnEvSu
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Banload family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe -
Renames multiple (225) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\ka.txt.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\7-Zip\Lang\ps.txt.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\7-Zip\Lang\ext.txt.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\7-Zip\Lang\ms.txt.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\7-Zip\Lang\it.txt.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\7-Zip\Lang\vi.txt.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\7-Zip\7z.dll.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\7-Zip\Lang\fur.txt.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\7-Zip\Lang\af.txt.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\7-Zip\Lang\sl.txt.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\7-Zip\Uninstall.exe.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InputPersonalization.exe.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\7-Zip\Lang\hy.txt.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\7-Zip\7zCon.sfx.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\7-Zip\Lang\sk.txt.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe -
Modifies registry class 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\LocalServer32\ = "%SystemRoot%\\SysWow64\\plasrv.exe" b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\TypeLib b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "DataCollectorSet" b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\TypeLib\ = "{03837500-098B-11D8-9414-505054503030}" b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID\ = "PLA.DataCollectorSet" b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "%SystemRoot%\\SysWow64\\pla.dll" b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "both" b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID\ = "PLA.DataCollectorSet.1" b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Version\ = "1.0" b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\AppID = "{03837503-098b-11d8-9414-505054503030}" b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\LocalServer32 b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Version b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2464 b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe Token: SeIncBasePriorityPrivilege 2464 b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe"C:\Users\Admin\AppData\Local\Temp\b710286449c217ebd23fc7b0c0ba0030bf7184054dee48f3bf15b58bf41512a4.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5a6b740f22a2bf2dfd722035d082a8a80
SHA1e3232158bf4690648178d49e4a544af3a8020011
SHA2566b6aa9c4602b4ad43bc810292b048c06cbe1a426b8b6eb8b59ac6fca4ca62c1e
SHA512b2d26a380dadcaa1a2c2616775db1b2081effccbd1c0ba40947bbf3916bd4c6d06f329b5999389cd2dd3170c8f7fea077fa21ca57cf2e0a6a18f137f70c55741
-
Filesize
3.0MB
MD54aa57d4441beecd7c1819d7a182880f9
SHA1d365abeb289b48922bb59408709cf747b24068b2
SHA25684b95cdbf8cc1e05fd7322239cc8032fc151261c0f0903decacc019c181e7f5e
SHA512ffa0e581bc34c0334cce54693366fb5385f1147e5f14198a634b17e16f64790ebb7db300c6d0b167aadeb1e12684b78e2d6a267f3c39ad90e7513f41467693a0