Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/12/2024, 19:33
Static task
static1
Behavioral task
behavioral1
Sample
872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe
Resource
win10v2004-20241007-en
General
-
Target
872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe
-
Size
3.1MB
-
MD5
49c1a0464aff4cbf082a8d73bd7db0d2
-
SHA1
46f5b216fbd21e7c802d5a3c4cf9a19682f55593
-
SHA256
872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e
-
SHA512
48caf07868efe35ce01ad61f14a5ff1a22e28553e3919a5640a98a5a4d84b1a70fa20123f1cb28110bc9bfe76e483fa91852baec759cb7d079f23532ccb244b7
-
SSDEEP
49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvVWiK7lji2Ayd:RF8QUitE4iLqaPWGnEvc
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Banload family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe -
Renames multiple (196) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\an.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\ky.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\lij.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\vi.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\ClearSave.MOD.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\ca.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\kk.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\ext.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\io.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\is.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\nl.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\th.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\7z.exe.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\cs.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\fa.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\ja.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\mk.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\va.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\7z.sfx.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\descript.ion.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\mr.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\7-zip32.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\en.ttt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\ta.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\tg.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\ba.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\kab.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\hu.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\uz.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\fur.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\yo.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\lt.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\lv.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\sk.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\ko.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\af.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\cy.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\de.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\fy.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\gl.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "mscoree.dll" 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\8.0.0.0\RuntimeVersion = "v2.0.50727" 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\8.0.0.0\Assembly = "Microsoft.JScript, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgId 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\Class = "Microsoft.JScript.JSAuthor" 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\RuntimeVersion = "v1.1.4322" 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\8.0.0.0 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\8.0.0.0\Class = "Microsoft.JScript.JSAuthor" 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Both" 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\7.0.5000.0 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\7.0.5000.0\Class = "Microsoft.JScript.JSAuthor" 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\7.0.5000.0\RuntimeVersion = "v1.1.4322" 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgId\ = "Microsoft.JScript.JSAuthor" 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Microsoft.JScript.JSAuthor" 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Implemented Categories 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Implemented Categories\{62C8FE65-4EBB-45E7-B440-6E39B2CDBF29} 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\Assembly = "Microsoft.JScript, Version=7.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\7.0.5000.0\Assembly = "Microsoft.JScript, Version=7.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1288 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Token: SeIncBasePriorityPrivilege 1288 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe"C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1288
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD527c052f0f1f49a18c0025babbdf336c0
SHA1b8748496e8b559b89d01301a1e2c00feb19b8799
SHA256d75a6e4ba2ba3e3a05758c333b75738331fcf41b39731354ea702e843054017a
SHA512b8a0f69e0677529940bff410c23b9ac5ba30389a2f22f715b892595fb9f753c1fcac1a72941f8f40731257cb2153c81b9586d52a66ae1f5412e5a250ede4c9ac
-
Filesize
3.3MB
MD53478c6dac1b8f2e898ebaa194eccf9cb
SHA16ecde4a79f139a43fbba7f09c8c3bafff1e94b7c
SHA2561afce688307d20c95c6d62a9e67b7623a8cbedda960ba3bb238cc4996c54a51e
SHA51229750205942735d8b91a29f8cbf0a14b0f510e36282511811d855186535cdf17a1ea24ed04faabd0aabe189034e24b1087864642c125bf46b9a0dc907a78864b