Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
48s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/12/2024, 19:33
Static task
static1
Behavioral task
behavioral1
Sample
872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe
Resource
win10v2004-20241007-en
General
-
Target
872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe
-
Size
3.1MB
-
MD5
49c1a0464aff4cbf082a8d73bd7db0d2
-
SHA1
46f5b216fbd21e7c802d5a3c4cf9a19682f55593
-
SHA256
872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e
-
SHA512
48caf07868efe35ce01ad61f14a5ff1a22e28553e3919a5640a98a5a4d84b1a70fa20123f1cb28110bc9bfe76e483fa91852baec759cb7d079f23532ccb244b7
-
SSDEEP
49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvVWiK7lji2Ayd:RF8QUitE4iLqaPWGnEvc
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Banload family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe -
Renames multiple (218) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\License.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\7zFM.exe.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\descript.ion.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\eo.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\gl.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\ba.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\ext.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\tg.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\ku.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\da.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\7-Zip\Lang\th.txt.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ThreadingModel = "Apartment" 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "LocalCopyHelper" 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ = "%SystemRoot%\\SysWow64\\shell32.dll" 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1040 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe Token: SeIncBasePriorityPrivilege 1040 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe"C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1040
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD58daaa973b0d8f42bb6cea26bba049c5e
SHA174869250dce65880eef1ec2124b28140488dc7e2
SHA2562700013fb5831aeb333d4084ac06a7ae533f7ae223d9ca9c33b95004eb9eb9fd
SHA5126ec329499973f004874ad57ac6d9859ac7766f55481b455a0907e25a0c280d665c6e7bf9c8f403c39f702073232419f70660ac43a970c28406897b19f9bb2897
-
Filesize
3.4MB
MD5433347446b092063034a1eff53519d3e
SHA1dc4ce88ced9d1d3f55dd9403034df91e0bbb195c
SHA2564a52c675dae9a7fd6f926f5c0323baf0847cac391a1b421e215f1bdd410277ce
SHA512c53d467cbd43f8b36651117d2f9407e9e8827cdb55c5f54efb87d319bd0322ec1231d369e9c1bfaa3bb6b8695075a4e5891cf5b3950c211e46d87053d3d06f87