Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
04/12/2024, 02:57
Static task
static1
Behavioral task
behavioral1
Sample
1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe
Resource
win10v2004-20241007-en
General
-
Target
1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe
-
Size
5.5MB
-
MD5
2000b158c5d4cb29080c614e1703b4b0
-
SHA1
6e53a872e56744ea729dce26735f808acf805f11
-
SHA256
1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76
-
SHA512
c578c42f14b31bcf17a76eea2ff5b06bb997171c7090d225a5eda3edf8a0d778411068bc02498a67f16c3e4a5813953eae591a23075689a512b2a2f61dbf2b2b
-
SSDEEP
98304:RF8QUitE4iLqaPWGnEvK7RkOEEo+A7mOk3oaCVA7m2StA:RFQWEPnPBnEXPS
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Banload family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe -
Renames multiple (198) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\ka.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Lang\da.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Lang\eo.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Lang\lv.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Lang\ug.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Lang\co.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Lang\tg.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Lang\tt.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Lang\is.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Lang\ms.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\7z.exe.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\ClearCheckpoint.vsd.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Lang\he.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Lang\bn.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Lang\hy.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Lang\ro.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Uninstall.exe.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Lang\sw.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Lang\gl.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Lang\it.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\7-Zip\descript.ion.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\RuntimeVersion = "v2.0.50727" 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\14.0.0.0 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\14.0.0.0\Assembly = "Microsoft.Office.Interop.Excel, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\14.0.0.0\Class = "Microsoft.Office.Interop.Excel.WorkbookClass" 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\Assembly = "Microsoft.Office.Interop.Excel, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\Class = "Microsoft.Office.Interop.Excel.WorkbookClass" 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\14.0.0.0\RuntimeVersion = "v2.0.50727" 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 3064 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe Token: SeIncBasePriorityPrivilege 3064 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe"C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3064
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD588834e4aab48f004d3733a6a121eb9ac
SHA1e753228f6f6da487dadfe6e55773f23c2863b5dd
SHA2567b35d9c98bef3d150bc19ecb325151f3ece96973e8ad6c6649e4273ffeae7364
SHA512545fd906aa67c04789f33ec9daee1c0477e35a5480755331c75ffc2d3d7249dc2ed27b72f99e52bbeced77253de1afa557679cae0c6c86a1564b0d5d8c00fd66
-
Filesize
5.6MB
MD5c4cdcec50c6802f07d1cc48ea72c4fa4
SHA1948e56cb841e0969c410cccd30a0afc7458e6055
SHA256239cf7e07cf77ca48e6b3939cbe44c18ddbd4d6defbc5fe0883972bc05b508ff
SHA5126999e76c79600fe7d788c68b51a5b92759e47320764a3cd59bd9ab78b963ecbfadd9fe5f22fd90498710b24b1a6139d75545b18c79890d22a89437a1f22de8af