Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
03-01-2025 18:22
Static task
static1
Behavioral task
behavioral1
Sample
185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
Resource
win10v2004-20241007-en
General
-
Target
185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
-
Size
2.6MB
-
MD5
f75a6d32a2b1ffdb5c64936e919060e0
-
SHA1
03013bfeffb93f77a873b24fd860fdca7fc030ff
-
SHA256
185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297
-
SHA512
c864ffdc63d713b28cdadb59908b970a100916a39fd2a05dacb8500afe4f14675c4a91535626b4d3fc299d14971261ee7c24ca9f7524c62ebdfcfa8b5a992d99
-
SSDEEP
49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvVzYBJIUu:RF8QUitE4iLqaPWGnEvL
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Banload family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe -
Renames multiple (227) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\az.txt.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\7-Zip\Lang\gu.txt.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\7-Zip\Lang\an.txt.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Services\verisign.bmp.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\7-Zip\Lang\it.txt.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\7-Zip\Lang\es.txt.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\System\ado\msado21.tlb.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\7-Zip\History.txt.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\System\ado\adojavas.inc.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\System\msadc\handler.reg.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\7-Zip\Lang\nb.txt.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\7-Zip\Lang\sw.txt.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\System\ado\msado26.tlb.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\7-Zip\Lang\ext.txt.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipBand.dll.mui.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\7-Zip\readme.txt.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\7-Zip\Lang\de.txt.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg.tmp 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe -
Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Microsoft Common Language Runtime Debugger Publisher" 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "C:\\Windows\\SysWOW64\\mscoree.dll" 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\2.0.50727\ImplementedInThisVersion 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\NotInsertable 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID\ = "ComPlusDebug.CorpubPublish" 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\2.0.50727 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Server 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Server\ = "mscordbi.dll" 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Both" 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID\ = "ComPlusDebug.CorpubPublish.1" 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2100 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe Token: SeIncBasePriorityPrivilege 2100 185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe"C:\Users\Admin\AppData\Local\Temp\185a518f58d1722d00ae38f9114fc6c213b362f2b277a655bd10178a9f66a297N.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2100
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5933347c32012d8759a9a88f13c5ed899
SHA16ce3e8b6fded67a060a441efb27562f0d102aa16
SHA2562b6356f3a604ebf6eb21d82ecd0ca482a06a8f16ebf4a47777d0e91d3344ef48
SHA512bb2b25c0db4881f0e9fde43248cc8c154d0903db9a49a87e48c5087aa798515eb7b7e98c05a16e033a0eff36fd2e1e5d62f8e4554abf0f18533ae5f680e3e900
-
Filesize
2.7MB
MD552032fa579fd024c02ada0a71945a633
SHA13a80b1bbc8ca0e2f6de5a931db53bd2a2e04bd02
SHA25681aea4f4f7f571106e23e75b34b33af6c1aaa23ce2454fc593ceae1f0275a919
SHA512a28f666fbf8e35457ce70b8c544a618a3e62e20583600d8fb4f00c8ee184edfd54b0824254992a18f43c0ca478e4ee09153d84e9a6ff7a2cccd0cc31e6391f5f