Malware Analysis Report

2025-01-22 23:08

Sample ID 241227-yg2j4syncr
Target 7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925
SHA256 7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925
Tags
banload discovery downloader dropper evasion ransomware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925

Threat Level: Known bad

The file 7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925 was found to be: Known bad.

Malicious Activity Summary

banload discovery downloader dropper evasion ransomware trojan

Banload

Banload family

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Renames multiple (225) files with added filename extension

Renames multiple (533) files with added filename extension

Checks BIOS information in registry

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-27 19:46

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-27 19:46

Reported

2024-12-27 19:48

Platform

win7-20240903-en

Max time kernel

150s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A

Renames multiple (225) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresslm.dat.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\System\ado\adovbs.inc.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\System\ado\msado27.tlb.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\7-Zip\Lang\uk.txt.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\7-Zip\Lang\pt.txt.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\7-Zip\Lang\nb.txt.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\7-Zip\Lang\ca.txt.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\7-Zip\Lang\ug.txt.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\7-Zip\Lang\lt.txt.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\7-Zip\Lang\ja.txt.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\7-Zip\History.txt.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\7-Zip\Lang\es.txt.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\7-Zip\Lang\lij.txt.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\7-Zip\Lang\af.txt.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\System\ado\adojavas.inc.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipBand.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "HomeGroup Network" C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32 C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ = "%SystemRoot%\\SysWow64\\provsvc.dll" C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ThreadingModel = "Both" C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe

"C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe"

Network

N/A

Files

memory/1940-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1940-1-0x0000000003220000-0x000000000342C000-memory.dmp

memory/1940-8-0x0000000003220000-0x000000000342C000-memory.dmp

memory/1940-11-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1940-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1940-13-0x0000000003220000-0x000000000342C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

MD5 fdf7a6b6d8ee3ea04be102714c6db88f
SHA1 41256956bbe434e8953ea9d6e0a659643a8d28de
SHA256 70119954f231ddb5616758eeb42b77b11b011a6d795f27f533eb88b717ae0ea6
SHA512 7ef66c48668a1c42bc3f7fcb9b7fd4dee729b68eb5d11f6f9a59d6f7100034d8b30ea782c72e2f30a8ddc4611673b1fd6f4bdd4ce17873fc5b5df0cf2f4de9a5

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 6889524ee907c3e756dbc84ddae343d1
SHA1 83f3cd258d537c645f4e0b8775c62abbfed0adbc
SHA256 4135d322597dcc00567ad1b9d3b28b043e7120346392d81cdd46de54609158ba
SHA512 3637b8af2b9e22c7a66841d67ce748db9b1e07eaf2cbdc5e25fd344121707f09f1b056fa48f49bdf35b67a592dd9d5d4b8a873d0921505ab973d17bad1111f25

memory/1940-26-0x0000000003220000-0x000000000342C000-memory.dmp

memory/1940-25-0x0000000003220000-0x000000000342C000-memory.dmp

memory/1940-43-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1940-51-0x0000000003220000-0x000000000342C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-27 19:46

Reported

2024-12-27 19:48

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A

Renames multiple (533) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Crashpad\settings.dat.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.Core.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\7-Zip\Lang\kab.txt.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\7-Zip\Lang\tr.txt.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\7-Zip\Lang\hu.txt.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrdeush.dat.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\7-Zip\Lang\es.txt.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\7-Zip\Lang\hr.txt.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\imjplm.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\7-Zip\Lang\af.txt.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\7-Zip\Lang\az.txt.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XDocument.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\System\wab32res.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\7-Zip\Lang\si.txt.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\System\ado\msado25.tlb.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\7-Zip\Lang\cy.txt.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "CD Burn Merged Folder" C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32 C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ = "%SystemRoot%\\SysWow64\\shell32.dll" C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ThreadingModel = "Both" C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe

"C:\Users\Admin\AppData\Local\Temp\7ca90f5cbbf80467e139724166c97137e23e8a90b95db8ad217d042cecf0e925.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp

Files

memory/3232-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/3232-2-0x0000000004950000-0x0000000004B5C000-memory.dmp

memory/3232-9-0x0000000004950000-0x0000000004B5C000-memory.dmp

memory/3232-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/3232-13-0x0000000000400000-0x0000000000616000-memory.dmp

memory/3232-14-0x0000000004950000-0x0000000004B5C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini.tmp

MD5 79b27ffa55d76773e744a896562ccc75
SHA1 027a3d669abbf077821230a0fd03a3b5f256968d
SHA256 2b8d7c74a25be7672249c419d34f4bcbcee1c12e241603dbf98d5cc649d2b0a1
SHA512 f12446e8565794f0b06bd78bac4e2947688fd7d747b3cf01bf457cd4d9639e2387b8be9e3223a27c6a8ff9fa0ecaf905692741a08737615334ac4fcb2315155d

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 419f86ad5618388e2ac2d2869188bbe9
SHA1 0a4af567d899cbc7d237dd294825680f5aec8247
SHA256 3b622af46dcb4e066c7736401dc3c8ef523ab9be5bcafe5dde7e8ba8afc4649b
SHA512 51c672accabc528ed72909460bf20c25d2ee47732d355b4563996aabe0c108f385d15f6bebde3a6b1a8e310ceefe6b96b81867be59692a5b8271b375f786bcd6

memory/3232-40-0x0000000004950000-0x0000000004B5C000-memory.dmp

memory/3232-41-0x0000000004950000-0x0000000004B5C000-memory.dmp

memory/3232-108-0x0000000000400000-0x0000000000616000-memory.dmp

memory/3232-122-0x0000000004950000-0x0000000004B5C000-memory.dmp