Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/12/2024, 01:58
Static task
static1
Behavioral task
behavioral1
Sample
60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe
Resource
win10v2004-20241007-en
General
-
Target
60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe
-
Size
3.0MB
-
MD5
20955657049216af45f5c73976e09d96
-
SHA1
1011000130add4bd762294a762b0be35564167b7
-
SHA256
60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad
-
SHA512
a709d572fe4c45763abc2d56b6a31014e624b5f74df458b78bf4abb28047c095c6ae08030445695a715fee44c59c040ffbd7ceff7abc5b17771046baa519da03
-
SSDEEP
49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvVWiKq:RF8QUitE4iLqaPWGnEv3
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Banload family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe -
Renames multiple (200) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\en.ttt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\io.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\ext.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\lt.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\ast.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\kk.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\ko.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\vi.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\ug.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\ms.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\7z.exe.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\hu.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\ky.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\pl.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\tk.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\bn.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\co.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\ne.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\fur.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\ta.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe File created C:\Program Files\7-Zip\Lang\hy.txt.tmp 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ = "%systemroot%\\SysWow64\\winrssrv.dll" 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ThreadingModel = "Both" 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "PSFactoryBuffer" 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2148 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe Token: SeIncBasePriorityPrivilege 2148 60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe"C:\Users\Admin\AppData\Local\Temp\60f5737deb30adc9c7c033e51149494d0546606386a4950d4decea2feed8d5ad.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2148
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD580eec2c199a7413fa1ff5199dd4d1df5
SHA1fc97da60e5ffcdb88bec475fcaa4157f402c2906
SHA256b7414efd78fe604a8dbf06ec71edb4fbf2064692068e751bbe6112bcd1d2ff18
SHA51274d106081c13afc618255667013ab1585b8fc1663446b0f69ab935cc76f7388f15c7d1bd619680290f04c06b03392c3ecab261d23bda5ecd453c7a8d37f632bb
-
Filesize
3.1MB
MD5e604b89103e85f88a66ad7b28a0da5e7
SHA1b8474c72610e3c5959cdb8b004df2c764e5176b9
SHA25623c71c02619fbc99c03f0eb47a31ba9564db0a9e0117fcfbb64f75d8df1175f0
SHA512a919cd6822e90de5f3dd00a7fef735029ebe0f5a0d04310b8b6d163c6c99adcceccae5ba2841da70edbf2fc70eb961e28160af4076824034361ea41210888416