Malware Analysis Report

2025-01-22 23:08

Sample ID 241227-x9wznayket
Target 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e
SHA256 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e
Tags
banload discovery downloader dropper evasion ransomware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e

Threat Level: Known bad

The file 872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e was found to be: Known bad.

Malicious Activity Summary

banload discovery downloader dropper evasion ransomware trojan

Banload family

Banload

Renames multiple (218) files with added filename extension

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Renames multiple (196) files with added filename extension

Checks BIOS information in registry

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-27 19:33

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-27 19:33

Reported

2024-12-27 19:34

Platform

win7-20240903-en

Max time kernel

60s

Max time network

18s

Command Line

"C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A

Renames multiple (196) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\an.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\ky.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\lij.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\vi.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\ClearSave.MOD.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\ca.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\kk.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\ext.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\io.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\is.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\nl.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\th.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\7z.exe.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\cs.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\fa.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\ja.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\mk.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\va.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\7z.sfx.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\descript.ion.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\mr.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\7-zip32.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\en.ttt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\mng.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\ta.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\tg.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\ba.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\kab.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\pt.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\az.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\hu.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\id.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\uz.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\fur.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\yo.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\et.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\ka.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\lt.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\lv.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\sk.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\hr.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\ko.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\el.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\ru.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\af.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\cy.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\de.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\fy.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\gl.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "mscoree.dll" C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\8.0.0.0\RuntimeVersion = "v2.0.50727" C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\8.0.0.0\Assembly = "Microsoft.JScript, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgId C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\Class = "Microsoft.JScript.JSAuthor" C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\RuntimeVersion = "v1.1.4322" C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\8.0.0.0 C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\8.0.0.0\Class = "Microsoft.JScript.JSAuthor" C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Both" C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\7.0.5000.0 C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\7.0.5000.0\Class = "Microsoft.JScript.JSAuthor" C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\7.0.5000.0\RuntimeVersion = "v1.1.4322" C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgId\ = "Microsoft.JScript.JSAuthor" C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Microsoft.JScript.JSAuthor" C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Implemented Categories C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Implemented Categories\{62C8FE65-4EBB-45E7-B440-6E39B2CDBF29} C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\Assembly = "Microsoft.JScript, Version=7.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\7.0.5000.0\Assembly = "Microsoft.JScript, Version=7.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe

"C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe"

Network

N/A

Files

memory/1288-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1288-1-0x00000000030F0000-0x00000000032FC000-memory.dmp

memory/1288-8-0x00000000030F0000-0x00000000032FC000-memory.dmp

memory/1288-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1288-13-0x00000000030F0000-0x00000000032FC000-memory.dmp

memory/1288-11-0x0000000000400000-0x0000000000616000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

MD5 27c052f0f1f49a18c0025babbdf336c0
SHA1 b8748496e8b559b89d01301a1e2c00feb19b8799
SHA256 d75a6e4ba2ba3e3a05758c333b75738331fcf41b39731354ea702e843054017a
SHA512 b8a0f69e0677529940bff410c23b9ac5ba30389a2f22f715b892595fb9f753c1fcac1a72941f8f40731257cb2153c81b9586d52a66ae1f5412e5a250ede4c9ac

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 3478c6dac1b8f2e898ebaa194eccf9cb
SHA1 6ecde4a79f139a43fbba7f09c8c3bafff1e94b7c
SHA256 1afce688307d20c95c6d62a9e67b7623a8cbedda960ba3bb238cc4996c54a51e
SHA512 29750205942735d8b91a29f8cbf0a14b0f510e36282511811d855186535cdf17a1ea24ed04faabd0aabe189034e24b1087864642c125bf46b9a0dc907a78864b

memory/1288-25-0x00000000030F0000-0x00000000032FC000-memory.dmp

memory/1288-43-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1288-51-0x00000000030F0000-0x00000000032FC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-27 19:33

Reported

2024-12-27 19:34

Platform

win10v2004-20241007-en

Max time kernel

60s

Max time network

48s

Command Line

"C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A

Renames multiple (218) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\License.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\7zFM.exe.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\eu.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\descript.ion.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\br.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\eo.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\gl.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\ba.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\ext.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\tg.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\ku.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\da.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\7-Zip\Lang\th.txt.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "LocalCopyHelper" C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32 C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ = "%SystemRoot%\\SysWow64\\shell32.dll" C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe

"C:\Users\Admin\AppData\Local\Temp\872efda22a1a464d90ed06cbdfc178e6ba06536805ce79f04c54991f6c8cad5e.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp

Files

memory/1040-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1040-3-0x0000000004950000-0x0000000004B5C000-memory.dmp

memory/1040-9-0x0000000004950000-0x0000000004B5C000-memory.dmp

memory/1040-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1040-13-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1040-14-0x0000000004950000-0x0000000004B5C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini.tmp

MD5 8daaa973b0d8f42bb6cea26bba049c5e
SHA1 74869250dce65880eef1ec2124b28140488dc7e2
SHA256 2700013fb5831aeb333d4084ac06a7ae533f7ae223d9ca9c33b95004eb9eb9fd
SHA512 6ec329499973f004874ad57ac6d9859ac7766f55481b455a0907e25a0c280d665c6e7bf9c8f403c39f702073232419f70660ac43a970c28406897b19f9bb2897

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 433347446b092063034a1eff53519d3e
SHA1 dc4ce88ced9d1d3f55dd9403034df91e0bbb195c
SHA256 4a52c675dae9a7fd6f926f5c0323baf0847cac391a1b421e215f1bdd410277ce
SHA512 c53d467cbd43f8b36651117d2f9407e9e8827cdb55c5f54efb87d319bd0322ec1231d369e9c1bfaa3bb6b8695075a4e5891cf5b3950c211e46d87053d3d06f87

memory/1040-47-0x0000000004950000-0x0000000004B5C000-memory.dmp

memory/1040-46-0x0000000004950000-0x0000000004B5C000-memory.dmp

memory/1040-128-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1040-146-0x0000000004950000-0x0000000004B5C000-memory.dmp