Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/12/2024, 19:21
Static task
static1
Behavioral task
behavioral1
Sample
8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe
Resource
win10v2004-20241007-en
General
-
Target
8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe
-
Size
4.0MB
-
MD5
b8f4d3e558f7069b5020f7024e6480b3
-
SHA1
49da493a24e179fac1c0217577966c9af42954b7
-
SHA256
8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d
-
SHA512
21e88209d4059a3135e81d7b403806f26266548522b06123192f4df15cb72d1896d3801cd35581d2b9e92d76df61e606fca2f46a0a4fd30afc8f869f0b63223d
-
SSDEEP
98304:RF8QUitE4iLqaPWGnEv+OKQr8MAvFrpHv/kAZIlnHyA:RFQWEPnPBnEmOKIbGpPMAZcyA
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Banload family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe -
Renames multiple (218) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\7-Zip\Lang\hi.txt.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\7-Zip\7z.exe.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\7-Zip\Lang\ba.txt.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\7-Zip\Lang\gu.txt.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\7-Zip\Lang\ko.txt.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\7-Zip\Lang\sl.txt.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\7-Zip\Lang\ta.txt.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\7-Zip\Lang\da.txt.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\7-Zip\Uninstall.exe.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrdeslm.dat.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\7-Zip\Lang\hu.txt.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\7-Zip\7z.sfx.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\7-Zip\Lang\mr.txt.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe -
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\Class = "Microsoft.Vbe.Interop.CommandBarEventsClass" 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\RuntimeVersion = "v2.0.50727" 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\15.0.0.0\Assembly = "Microsoft.Vbe.Interop, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\15.0.0.0\RuntimeVersion = "v2.0.50727" 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\15.0.0.0\Class = "Microsoft.Vbe.Interop.CommandBarEventsClass" 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\Assembly = "Microsoft.Vbe.Interop, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\15.0.0.0 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 3084 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe Token: SeIncBasePriorityPrivilege 3084 8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe"C:\Users\Admin\AppData\Local\Temp\8d8fceab6594860d035438ce97bfc7a0401bbece8604e9a84c0fa7beea16828d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3084
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.1MB
MD584803270ca56e99182f8fea579d6cccd
SHA19055ba3565ba149561bed7d1b2c8b657aaf2d7b1
SHA256cdeb4926689417cfffec8bb53368ee148aef1b153b8d0e106b1e25a50eb31099
SHA5129eb48842c84e701b0bf8c9593ba173586f5d3fc69636f8d2776255c1967657cd47de8242945d5a5693dd7a4823bc26ebb203bd06d85c3f99b2288fb178a30f52
-
Filesize
4.2MB
MD579aea3bab1f364eb73cd5820da7dd5ce
SHA192373ec933d840cdac66262cf32c9a34f5d769d8
SHA2568d270edf7a2da39c818909a86c1ab5ecaddadbca498bc533dea9aa057bdf53b7
SHA512a4799afea2085b2441301f950dd89ade8b90b18cdf35dbccb13be45260970b012459f62122a92452f93b1b38b27315ecec5f0c177723c1d07bd030e0d688a76b