Analysis Overview
SHA256
91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca
Threat Level: Known bad
The file 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca was found to be: Known bad.
Malicious Activity Summary
Banload
Banload family
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Renames multiple (816) files with added filename extension
Renames multiple (225) files with added filename extension
Checks BIOS information in registry
Drops file in Program Files directory
System Location Discovery: System Language Discovery
Unsigned PE
Suspicious use of AdjustPrivilegeToken
Modifies registry class
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-12-27 19:02
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-12-27 19:02
Reported
2024-12-27 19:05
Platform
win7-20240903-en
Max time kernel
150s
Max time network
120s
Command Line
Signatures
Banload
Banload family
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
Renames multiple (225) files with added filename extension
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
Drops file in Program Files directory
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\LocalServer32 | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID\ = "InternetExplorer.Application" | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\TypeLib | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\TypeLib\ = "{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}" | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Internet Explorer(Ver 1.0)" | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\LocalServer32\ = "\"%ProgramFiles(x86)%\\Internet Explorer\\ielowutil.exe\" -CLSID:{0002DF01-0000-0000-C000-000000000046}" | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID\ = "InternetExplorer.Application.1" | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Programmable | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: 33 | N/A | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe
"C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe"
Network
Files
memory/2692-0-0x0000000000400000-0x0000000000616000-memory.dmp
memory/2692-1-0x0000000003110000-0x000000000331C000-memory.dmp
memory/2692-8-0x0000000003110000-0x000000000331C000-memory.dmp
memory/2692-11-0x0000000000400000-0x0000000000616000-memory.dmp
memory/2692-12-0x0000000000400000-0x0000000000616000-memory.dmp
memory/2692-13-0x0000000003110000-0x000000000331C000-memory.dmp
C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp
| MD5 | 3249cb235bb4e059417bd8a26238fbe2 |
| SHA1 | 8585e019a5f0ce120ae3d829871f5107726fe07a |
| SHA256 | 5ec95fb62c38dc92a4f5412b20e182c9bedaf96824aa553edf33a22f2557cd88 |
| SHA512 | 1689766f54772e6d05ee5928307ee626f7c4557321fe6c7eb50531217dd6b8cdf208f48439caecb6d73d0ae69566b978e804ae153e943a80852a49cbf50e1c41 |
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
| MD5 | 27555c3a92e4f6582593fd77527764aa |
| SHA1 | f00312fe6504a36a9c81b451a1983f5593fff11e |
| SHA256 | db2d9bf4d03c3336c7baea512dc8f46196bc7016778f11b034a1acdedc6a9019 |
| SHA512 | 70fc60fdef2963b66a6bcd351880b1cb56a2613e3be253ba7c1e84e64f887e41c31786422df6c9c47c11694ea9b29c3cee1bebd964f48ec4b407c6a7afba3bf4 |
memory/2692-25-0x0000000003110000-0x000000000331C000-memory.dmp
memory/2692-45-0x0000000000400000-0x0000000000616000-memory.dmp
memory/2692-57-0x0000000003110000-0x000000000331C000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-12-27 19:02
Reported
2024-12-27 19:05
Platform
win10v2004-20241007-en
Max time kernel
149s
Max time network
150s
Command Line
Signatures
Banload
Banload family
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
Renames multiple (816) files with added filename extension
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
Drops file in Program Files directory
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ = "%SystemRoot%\\SysWow64\\els.dll" | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ThreadingModel = "Both" | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "PSFactoryBuffer" | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32 | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: 33 | N/A | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe
"C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 215.143.182.52.in-addr.arpa | udp |
Files
memory/3108-0-0x0000000000400000-0x0000000000616000-memory.dmp
memory/3108-2-0x0000000004450000-0x000000000465C000-memory.dmp
memory/3108-9-0x0000000004450000-0x000000000465C000-memory.dmp
memory/3108-12-0x0000000000400000-0x0000000000616000-memory.dmp
memory/3108-13-0x0000000000400000-0x0000000000616000-memory.dmp
memory/3108-14-0x0000000004450000-0x000000000465C000-memory.dmp
C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini.tmp
| MD5 | 601d18587f091c43dde86655fa1f7aa0 |
| SHA1 | 445ae0b0ec19e5652df77f664cc3a0bec8bd225c |
| SHA256 | 96ad24c09671149ae2267dd92d386b1b9df31fa34daeef1fd30029c877022cf4 |
| SHA512 | 2cde66f89b43734fb0f0acdd706387697289f7df97650741a0546d896a07d00611bb25b382e19391ae3c1ff2b9188384d503faa5f7bff7926e9c9e8c8dc3d049 |
C:\Program Files\7-Zip\7-zip.dll.tmp
| MD5 | 51a776984994ed591a0ca6b49abd93b5 |
| SHA1 | 2e8ab82f35be742c6e0827b14ba8fcfd9478d5f5 |
| SHA256 | b6bce0f177c9f36a5c7844f17d456af7281d1aa3223b79dcd708f373cde9a432 |
| SHA512 | afe9de18ebc42df4e4832baa7fe3e261b0d6a7b15c431a9a64d92800a57dea5b6a1692a589f5c105656d135c01b713d6c6c5446168b3e09e4aee027e89c1e211 |
memory/3108-48-0x0000000004450000-0x000000000465C000-memory.dmp
memory/3108-49-0x0000000004450000-0x000000000465C000-memory.dmp
memory/3108-136-0x0000000000400000-0x0000000000616000-memory.dmp
memory/3108-156-0x0000000004450000-0x000000000465C000-memory.dmp