Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
28-12-2024 22:23
General
-
Target
2024-12-28_6d9e95ccd5039f49bcc88ea5379b4a29_hijackloader_jaff.exe
-
Size
20.5MB
-
MD5
6d9e95ccd5039f49bcc88ea5379b4a29
-
SHA1
0e83f707e4321179b608d5401450e45b3c844532
-
SHA256
b1a450ab3ca2b38605981891257e7d37090c5578e71e046411a45c479c234264
-
SHA512
cc0f73ea9b611763c688fa68e09725af55ffffdf6200f5ce8cef4588156630060517c607b7ee4fe27ad1be155e4af150c9cb97f140ff63009640a3a9fceda22a
-
SSDEEP
196608:RFQWEPnPBnEXPEtFQWEPnPBnEXPETR8N3MKFBIHuM/B:PEPnPBnnEPnPBnHR8N3MKFBIOMJ
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Banload family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Renames multiple (118) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Drops file in Program Files directory 35 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-28_6d9e95ccd5039f49bcc88ea5379b4a29_hijackloader_jaff.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-28_6d9e95ccd5039f49bcc88ea5379b4a29_hijackloader_jaff.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20.6MB
MD56835c19e5c3a4020bf7651e0c9943320
SHA1fcd69c7f3f1ab6425cfd2d2798b7a6e58dba9f4d
SHA256a85ce746850b884c840c58b50b94d662a93034b87febf7a39daa5d81f6a176c7
SHA512a299600f0d158daabd98c589ebff3766e6bfa7d1bba798f2466c651a9c0d02bceb540e63b3cff2133e0a28b7eb46f6d39ee7205a5990282c50281bde67c78180
-
Filesize
20.6MB
MD534cc7ffb0ca3f8b33fdab467ad358ed4
SHA1584d0c1b52e3a14ccaabcf772eacbfb1bbcc8838
SHA256086f03fa5e04b4b026076d306dd9782aa4c10e97be1c92f24816b23418bdc227
SHA512f12b0d71f8d7d121bf93bee8ac07abfc0698c1b5ecd668b24a6c63964b7fa9b6daaf2e2f240d03667c7aa531b6b59713711a8c9bce750dd95e6317f7ef9f7e66
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
2.0MB