Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 01:14
Static task
static1
Behavioral task
behavioral1
Sample
b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe
Resource
win10v2004-20241007-en
General
-
Target
b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe
-
Size
2.3MB
-
MD5
c614d31ed168c52e463ccfa182cc0c52
-
SHA1
cd9ecc6b4dbb93639ccac6f6437c95d6dbe2804f
-
SHA256
b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058
-
SHA512
8f2029b595811e4f965b2fe88e7c5e889a1e61bdec08f739e2b974670237f5a92054b8e5a8b3016f5be4d1b6d4136711d9b2b10727c2218644fc7b573ae9f861
-
SSDEEP
49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEv3xP:RF8QUitE4iLqaPWGnEvZ
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Banload family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe -
Renames multiple (229) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\BackupDisable.jfif.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\7-Zip\Lang\uk.txt.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\7-Zip\Lang\cs.txt.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\System\msadc\msadco.dll.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\7-Zip\Lang\ug.txt.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\7-Zip\Lang\va.txt.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\BackupUnblock.m3u.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\7-Zip\Lang\fur.txt.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\7-Zip\Lang\bg.txt.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcfr.dll.mui.tmp b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Free" b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID\ = "SppComApi.ModemActivation.1" b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID\ = "SppComApi.ModemActivation" b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "ModemActivation Class" b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\AppID = "{6D9A7A40-DDCA-414E-B48E-DFB032C03C1B}" b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "%SystemRoot%\\SysWow64\\sppcomapi.dll" b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\TypeLib b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\TypeLib\ = "{B0C2A63F-AFF8-40E3-B42D-8A542DC909EC}" b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2464 b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe Token: SeIncBasePriorityPrivilege 2464 b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe"C:\Users\Admin\AppData\Local\Temp\b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD50a02469d154c41b0ef5263667c6b9f37
SHA189836acb61b0eae1fc5b586f36b0d4d827c1e726
SHA25670b8f1ca3c858ec299d1dd1950e1f7482eefb35a1a400d72a5f82b71f4cca793
SHA51234e2834d9894701d4658841c107d6b20cab8495783d52d2a25b5bf3418986bc93e991419e8534c6539b12cb743b6595765f1e00bf2cc9f73beece1a361b8c3fc
-
Filesize
2.4MB
MD561beed968c39cebbc8593d091f077cec
SHA15b6694bd578f74d3e0013a4bc138fd127f1ca95a
SHA2564241221bbfcdeb82d24d24b10ea0ac826add2145af2b06d993d5c2df94c85619
SHA5125a08936c6f3c4445420ab653fc52e1bcebd0e33b817a79fdd01a112c15c083ebfabb1c47f221be400d3d81a72f2a17363887cd7f694c6b1078d2a366d10ba82c