Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/12/2024, 01:14

General

  • Target

    b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe

  • Size

    2.3MB

  • MD5

    c614d31ed168c52e463ccfa182cc0c52

  • SHA1

    cd9ecc6b4dbb93639ccac6f6437c95d6dbe2804f

  • SHA256

    b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058

  • SHA512

    8f2029b595811e4f965b2fe88e7c5e889a1e61bdec08f739e2b974670237f5a92054b8e5a8b3016f5be4d1b6d4136711d9b2b10727c2218644fc7b573ae9f861

  • SSDEEP

    49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEv3xP:RF8QUitE4iLqaPWGnEvZ

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

  • Banload family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Renames multiple (698) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe
    "C:\Users\Admin\AppData\Local\Temp\b80f9c5be3caf9cd0ea280c000826349ca6b551937137ed8620986d9fd688058.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:2452

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini.tmp

    Filesize

    2.4MB

    MD5

    f847a9fea8d1cfad5a48e0acacd01c5e

    SHA1

    6e3a0ec1710eb96f48e46fc270134d904adab49a

    SHA256

    9781eb9463fc1e3b94ae1f369e71758ae9b3533a867c58bee0f7f8075ba4cec9

    SHA512

    71b51dff854915c44a91d8396f552411e4fb3d5aae7d1ab13f585a9761eef22ea0ef34c149fa61d3b6c1f38d5e938d62955f02849d66644c257e1a350b37dc40

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    2.5MB

    MD5

    3200aed53b6a1df1b86fd95a8ff98e98

    SHA1

    7aee91fb73a69cbe61ab0160ee8fc11ade445aea

    SHA256

    e3f837a1d6261902f49da6b3546dfe81055a217c6dc41c7882eaddbb64772081

    SHA512

    303d337e458c67d04f97d6ef913c92469fe89e4baadec044a5b722c5542ef4fbaa9934ddee2543cef0e6eaa4451c1048960ef28789b9eafa7bb369ea1aebb9be

  • memory/2452-0-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

  • memory/2452-2-0x0000000004920000-0x0000000004B2C000-memory.dmp

    Filesize

    2.0MB

  • memory/2452-9-0x0000000004920000-0x0000000004B2C000-memory.dmp

    Filesize

    2.0MB

  • memory/2452-12-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

  • memory/2452-13-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

  • memory/2452-14-0x0000000004920000-0x0000000004B2C000-memory.dmp

    Filesize

    2.0MB

  • memory/2452-58-0x0000000004920000-0x0000000004B2C000-memory.dmp

    Filesize

    2.0MB

  • memory/2452-59-0x0000000004920000-0x0000000004B2C000-memory.dmp

    Filesize

    2.0MB

  • memory/2452-168-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

  • memory/2452-190-0x0000000004920000-0x0000000004B2C000-memory.dmp

    Filesize

    2.0MB