Malware Analysis Report

2025-01-22 23:09

Sample ID 241207-j7nnlszlcl
Target df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe
SHA256 df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c
Tags
banload discovery downloader dropper evasion ransomware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c

Threat Level: Known bad

The file df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe was found to be: Known bad.

Malicious Activity Summary

banload discovery downloader dropper evasion ransomware trojan

Banload

Banload family

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Renames multiple (198) files with added filename extension

Renames multiple (220) files with added filename extension

Checks BIOS information in registry

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-07 08:18

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-07 08:18

Reported

2024-12-07 08:20

Platform

win7-20240903-en

Max time kernel

120s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A

Renames multiple (198) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\ast.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\hr.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\id.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresslm.dat.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\7-zip32.dll.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\sk.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\ro.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\ko.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\nb.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\yo.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\readme.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\br.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\is.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\tk.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\CheckpointEdit.crw.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\bn.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\gl.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\bg.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\he.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\ja.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\sq.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\7-zip.dll.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\mk.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\7z.exe.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\af.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\ky.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\en.ttt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "%systemroot%\\SysWow64\\PortableDeviceTypes.dll" C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\TypeLib C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Version\ = "1.0" C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID\ = "WpdSerializer.WpdSerializer" C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "WpdSerializer Class" C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Both" C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID\ = "WpdSerializer.WpdSerializer.1" C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\TypeLib\ = "{2B00BA2F-E750-4beb-9235-97142EDE1D3E}" C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Version C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe

"C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe"

Network

N/A

Files

memory/2280-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2280-1-0x0000000002F80000-0x000000000318C000-memory.dmp

memory/2280-8-0x0000000002F80000-0x000000000318C000-memory.dmp

memory/2280-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2280-11-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2280-13-0x0000000002F80000-0x000000000318C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

MD5 20cae2ed4cd1121a26a77c67977ace0b
SHA1 4444b316ad0cd3cfe96b38c8227b04f18e4f68b1
SHA256 291767ad1931d054bcf1babceddc46632d2ed0caee7239664edd1c568959ee26
SHA512 cacd5f104a43e0f6e1a087eb3a17f5bd107afc2f36a04f3cd95461afaef95dbcd9ed56363a9eac4069a257557c1f5cb917af7e4d3ebed7aadd810ec05fdca744

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 7ceec98b7c39a3f4684e5ef7ebe08759
SHA1 300b7f5aed518cb570b28dad4269137a465e9c46
SHA256 8a50a1f208dabda632b36984bf5d5499a512cb09c86e9d3f7ea5f57b15436018
SHA512 5e0b616d611a6f40d87c1bfd50425cff460c17b7297cbf31070f45c5e5845662eb9bfb4b82b6d7ad856ff67031d6a6d795980c58ef311272a3f520ed0bfbb2f4

memory/2280-26-0x0000000002F80000-0x000000000318C000-memory.dmp

memory/2280-25-0x0000000002F80000-0x000000000318C000-memory.dmp

memory/2280-39-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2280-43-0x0000000002F80000-0x000000000318C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-07 08:18

Reported

2024-12-07 08:20

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

100s

Command Line

"C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A

Renames multiple (220) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\an.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\ne.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\kk.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\fi.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\ro.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\7z.sfx.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\readme.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\id.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\ja.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\tg.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\imjplm.dll.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwritalm.dat.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwresplm.dat.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\ar.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\br.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\fur.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\hi.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\is.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\co.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\hy.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\7-zip.dll.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\sa.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\ug.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\7-Zip\Lang\uk.txt.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\AppID = "{03837503-098b-11d8-9414-505054503030}" C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Version C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\LocalServer32\ = "%SystemRoot%\\SysWow64\\plasrv.exe" C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\TypeLib C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "BootTraceSession" C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "%SystemRoot%\\SysWow64\\pla.dll" C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID\ = "PLA.BootTraceSession.1" C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Version\ = "1.0" C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "both" C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\LocalServer32 C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\TypeLib\ = "{03837500-098B-11D8-9414-505054503030}" C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID\ = "PLA.BootTraceSession" C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe

"C:\Users\Admin\AppData\Local\Temp\df71f6a029880bf5eaa547813e2d0a1af40e5d411cdcc7b7202f430d117e969c.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 20.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 86.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

memory/2440-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2440-2-0x00000000049E0000-0x0000000004BEC000-memory.dmp

memory/2440-9-0x00000000049E0000-0x0000000004BEC000-memory.dmp

memory/2440-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2440-13-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2440-14-0x00000000049E0000-0x0000000004BEC000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini.tmp

MD5 2fd0bacd809e40e8ca24b0380eb1493c
SHA1 848b3e8178c0059cd715baeca36606f26af43125
SHA256 82201f22322a957ba7dab014c5f835586f1902aa51097b7e51cd93973f30a35b
SHA512 ea268f646246c08b2263cda45dde2c42377f4359f35de48812dc14b0ac32306845295e822fd9eabe224a326c5f56360f7a0e2a7e225851c8348ed26a70977e4a

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 95fdc4d38ab1bfb3d5baab97fbb4081f
SHA1 c8c4853f121f35e323777205b749db2c1acb7b1c
SHA256 914e571e045c022415f30daa59cd751dbef3c744bea88dc9d4927dde79bf95d1
SHA512 23124b2e2382e55f82a8c834da863e873e97add7cd28a455a33f6b5a1db8b8f288e00ff64cf59f699b1543935420fbfbc90fa2660044315f0c8aa66a1d6e9530

memory/2440-33-0x00000000049E0000-0x0000000004BEC000-memory.dmp

memory/2440-32-0x00000000049E0000-0x0000000004BEC000-memory.dmp

memory/2440-72-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2440-80-0x00000000049E0000-0x0000000004BEC000-memory.dmp