Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2024, 17:38
Static task
static1
Behavioral task
behavioral1
Sample
fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe
Resource
win10v2004-20241007-en
General
-
Target
fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe
-
Size
2.8MB
-
MD5
a58f1c1a4a6f0e58a0193e2f4ace7370
-
SHA1
c5696172a9ddbc820ddad28ff28337b42de3efc8
-
SHA256
fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10df
-
SHA512
7a0d6fb3d862537ad3fc44db93d4f87715f3ae593c96b89a4adb02eef5423cef1630e9ca36f6c7a8f47c0cdebcd75f8093769acd9518d7799c641a642e870663
-
SSDEEP
49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvVWiKjUOlk0O:RF8QUitE4iLqaPWGnEvSO
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Banload family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe -
Renames multiple (507) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\desktop.ini.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.VisualC.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwjpnr.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ink\dicjp.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\7-Zip\Lang\fr.txt.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrespsh.dat.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrdeulm.dat.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwresplm.dat.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\7-Zip\Lang\sl.txt.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\7-Zip\Lang\yo.txt.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\dbgshim.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\System\msadc\msadco.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\7-Zip\Lang\ku.txt.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "ImeDicAPIProxy" fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32 fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ = "C:\\Windows\\SysWOW64\\IME\\SHARED\\imedicapiccps.dll" fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ThreadingModel = "Both" fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1200 fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe Token: SeIncBasePriorityPrivilege 1200 fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe"C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1200
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD55240c2f5355e1fc7340c5f35a620f170
SHA175fda74c9fec5f88adb4a7ed4f56c7bab8e2ebf0
SHA2560d6aac75e4dccc42c5b91cbf82ba5b992b8b6d0e0ccc1b68ca3179071d7e2f36
SHA512610909ce961e9b8b50901b5ba8efc6a43a6b1050ead797884d395c95ef7dadac7e285b38123a887826a89721538a773055c41ff9723e83c7f6a06d6dd80281eb
-
Filesize
3.1MB
MD53f39a7d74fdedec1bbe280b3d5ff7267
SHA1a7a9c8ff346009a15807911afee7712e0f85613a
SHA25670afb9be75ba190ae54e8abfa53ceae434b67cfbb2edfd746397325866011e82
SHA512c309973e79995a51de4f79e207db264aa0c0de73308cff20fe8011498b978f504c9440ab8f4c2905c6243c8ec4bb677ac672076ef08c7001b0ec4c8a1e3ae1c2