Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

f49e78721c...1N.exe

windows7-x64

10

f49e78721c...1N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/01/2025, 17:39 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f49e78721c3e8f31e0e8ca174c13545d55cc79e1e2e5dd34b11d9678caf06e11N.exe

  • Size

    3.5MB

  • MD5

    30a4f6d4a0e6c5187e1b03d37ff5fd70

  • SHA1

    381ecea8734578b0109653daa726703b2908e4dd

  • SHA256

    f49e78721c3e8f31e0e8ca174c13545d55cc79e1e2e5dd34b11d9678caf06e11

  • SHA512

    25d027627be355eb9863531ad7ba57bcee98b081262e13ac69c955f76aa9e45ba983a83d569946b6499fa48f68a37f10a8dc44c28d0f0a66ad237ee0f7367a82

  • SSDEEP

    49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvVPYOKQrgCGMxu3fFne4j4ZMljX:RF8QUitE4iLqaPWGnEv+OKQr8MAvFrX

Score
10/10
banloaddiscoverydownloaderdropperevasionransomwaretrojan

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Banload family
    banload
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Renames multiple (211) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f49e78721c3e8f31e0e8ca174c13545d55cc79e1e2e5dd34b11d9678caf06e11N.exe
    "C:\Users\Admin\AppData\Local\Temp\f49e78721c3e8f31e0e8ca174c13545d55cc79e1e2e5dd34b11d9678caf06e11N.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:2536

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp
    Filesize

    3.6MB

    MD5

    14144d0938ad4fcd70c88b5806aee7af

    SHA1

    c469e8c74f28b244f6e35996df62a74cb66330df

    SHA256

    3be59711e32280fa7ee4b280bd41a86134d05b8c6d4a639cb0c8336c3a539fa0

    SHA512

    7e6491eb1b176a9b9af0b48f7c6e4e1ad09116c65b0daca8b8281e1e5f27dda8b7c9bee22fdafa1508c686e83e015da7a993884d2bd00674122c6a95e97fd8d0

    Download Submit

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
    Filesize

    3.6MB

    MD5

    c1c0dba955796d57763099ce47f604c5

    SHA1

    8ce06a3942e54246564e0609891ae89bcb4f18d1

    SHA256

    b7d216b6c61b902acef33635898469132c6d42be8f907b952aac390323f4c3cc

    SHA512

    a1c4e6ff8f75ec0895e055daf2a24ad12f872ab1b660f809eaa7007513e678d13c3bd2cfecd29c4421c0c77b292ce85720eb1dab0f499059ec605084f57dd22a

    Download Submit

  • memory/2536-13-0x0000000003070000-0x000000000327C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2536-11-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2536-12-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2536-8-0x0000000003070000-0x000000000327C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2536-1-0x0000000003070000-0x000000000327C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2536-0-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2536-26-0x0000000003070000-0x000000000327C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2536-25-0x0000000003070000-0x000000000327C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2536-43-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2536-49-0x0000000003070000-0x000000000327C000-memory.dmp

    Filesize

    2.0MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.