Malware Analysis Report

2025-01-22 23:11

Sample ID 241204-dflgaatmhq
Target 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe
SHA256 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76
Tags
banload discovery downloader dropper evasion ransomware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76

Threat Level: Known bad

The file 1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe was found to be: Known bad.

Malicious Activity Summary

banload discovery downloader dropper evasion ransomware trojan

Banload

Banload family

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Renames multiple (218) files with added filename extension

Renames multiple (198) files with added filename extension

Checks BIOS information in registry

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-04 02:57

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-04 02:57

Reported

2024-12-04 02:59

Platform

win7-20241010-en

Max time kernel

120s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A

Renames multiple (198) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\ka.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\hr.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\ru.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\da.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\eo.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\lv.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\ug.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\co.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\tg.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\tt.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\id.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\is.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\ms.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\7z.exe.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\ClearCheckpoint.vsd.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\he.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\bn.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\hy.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\ro.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Uninstall.exe.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\sw.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\gl.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\it.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\descript.ion.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\RuntimeVersion = "v2.0.50727" C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\14.0.0.0 C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\14.0.0.0\Assembly = "Microsoft.Office.Interop.Excel, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\14.0.0.0\Class = "Microsoft.Office.Interop.Excel.WorkbookClass" C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\Assembly = "Microsoft.Office.Interop.Excel, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\Class = "Microsoft.Office.Interop.Excel.WorkbookClass" C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\14.0.0.0\RuntimeVersion = "v2.0.50727" C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe

"C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe"

Network

N/A

Files

memory/3064-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/3064-8-0x0000000002F40000-0x000000000314C000-memory.dmp

memory/3064-1-0x0000000002F40000-0x000000000314C000-memory.dmp

memory/3064-11-0x0000000000400000-0x0000000000616000-memory.dmp

memory/3064-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/3064-13-0x0000000002F40000-0x000000000314C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2039016743-699959520-214465309-1000\desktop.ini.tmp

MD5 88834e4aab48f004d3733a6a121eb9ac
SHA1 e753228f6f6da487dadfe6e55773f23c2863b5dd
SHA256 7b35d9c98bef3d150bc19ecb325151f3ece96973e8ad6c6649e4273ffeae7364
SHA512 545fd906aa67c04789f33ec9daee1c0477e35a5480755331c75ffc2d3d7249dc2ed27b72f99e52bbeced77253de1afa557679cae0c6c86a1564b0d5d8c00fd66

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 c4cdcec50c6802f07d1cc48ea72c4fa4
SHA1 948e56cb841e0969c410cccd30a0afc7458e6055
SHA256 239cf7e07cf77ca48e6b3939cbe44c18ddbd4d6defbc5fe0883972bc05b508ff
SHA512 6999e76c79600fe7d788c68b51a5b92759e47320764a3cd59bd9ab78b963ecbfadd9fe5f22fd90498710b24b1a6139d75545b18c79890d22a89437a1f22de8af

memory/3064-26-0x0000000002F40000-0x000000000314C000-memory.dmp

memory/3064-25-0x0000000002F40000-0x000000000314C000-memory.dmp

memory/3064-37-0x0000000000400000-0x0000000000616000-memory.dmp

memory/3064-43-0x0000000002F40000-0x000000000314C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-04 02:57

Reported

2024-12-04 02:59

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

101s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A

Renames multiple (218) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\gu.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\ro.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\sa.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\nb.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\ms.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\va.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\vi.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\is.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\ta.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\tt.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Uninstall.exe.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\imjplm.dll.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\History.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\bn.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\ko.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\7-zip.dll.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\7-Zip\Lang\ps.txt.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrespsh.dat.tmp C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID\ = "MSIME.Japan.FEDict" C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "C:\\Windows\\SysWOW64\\IME\\IMEJP\\imjpapi.dll" C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID\ = "MSIME.Japan.FEDict.15" C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Microsoft IME (Japanese) IFEDict" C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe

"C:\Users\Admin\AppData\Local\Temp\1e4cafefe33f6cd6e70a4eeaa12e674457b586d995257b2d17f05addf1564b76N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

memory/832-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/832-2-0x0000000004360000-0x000000000456C000-memory.dmp

memory/832-9-0x0000000004360000-0x000000000456C000-memory.dmp

memory/832-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/832-13-0x0000000000400000-0x0000000000616000-memory.dmp

memory/832-14-0x0000000004360000-0x000000000456C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini.tmp

MD5 ac03290f0a03dfd2c03646ae2c3d273b
SHA1 f8745ff70c9921e2ac955437dabb9671074ed007
SHA256 787123bcadefe47da0106ff5ab406e89c2766f90b5a0207cddc8f00fc54b64c4
SHA512 8743c2b6055033e4ec85a52bcd696b7d3890ca7144aec767c45f192a3f74173fa207130d69c220fc863e165225756b86af2accb514150ab6544afa085cebfc7d

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 7005d159a5e832c8833b5ef9b228a802
SHA1 f5848814820144568d2e7cb806f9a1823715d49f
SHA256 7200a7a4ff313e1af0507f1212ce44d8afca90df115649ac0a4df18d4ea394c9
SHA512 a08579dc5ace6a29e39f76bd9ae0ac28149bad90c459f647135a64c2ddf6425ad849b546979d6118c280426809b299049580b2ef550d4987e54e0a2010f8449d

memory/832-29-0x0000000004360000-0x000000000456C000-memory.dmp

memory/832-28-0x0000000004360000-0x000000000456C000-memory.dmp

memory/832-64-0x0000000000400000-0x0000000000616000-memory.dmp

memory/832-72-0x0000000004360000-0x000000000456C000-memory.dmp