Analysis
- max time kernel
120s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
04/01/2025, 23:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
120 seconds
General
- Target 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe
- Size 2.9MB
- Sample250104-3c151avkcm
- SHA256 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca
- MD5 75ec6462a567274bbd09a6c1bb9cd870
- SHA1 309ac40f9f4fe6b8dfe6db1288f82ed8ada0b281
- SHA512 6b7ff62f3b1dbfccedd2a81d61ac881a1f969b12e8c863c14f861a488f046900f6cbf633c1c8c4a44a741a4cfd8c256f822a67d6d0b138c8247ada58f56a30ad
- SSDEEP 49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvVCMu7iMm8uE:RF8QUitE4iLqaPWGnEvgM7Mn
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Banload
Banload variants download malicious files, then install and execute the files.
- Banload family
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe - Renames multiple (561) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.NonGeneric.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\CompressResize.pot.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-math-l1-1-0.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tools.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\7-Zip\Lang\ca.txt.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Concurrent.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Numerics.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\7-Zip\Lang\ms.txt.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\CompressDismount.xps.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-profile-l1-1-0.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-1-0.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\System\ado\msado26.tlb.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-timezone-l1-1-0.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\7-Zip\Lang\fi.txt.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Xml.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-private-l1-1-0.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\hostpolicy.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\7-Zip\Lang\gl.txt.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\7-Zip\readme.txt.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\LICENSE.txt.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe File created C:\Program Files\Common Files\microsoft shared\ink\dicjp.dll.tmp 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe - Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Key Change Provider Monitor" 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ = "%SystemRoot%\\SysWow64\\SettingSyncCore.dll" 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ThreadingModel = "Both" 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 3080 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe Token: SeIncBasePriorityPrivilege 3080 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe"C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629caN.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini.tmp
- Size 3.0MB
- SHA256 1302fa34e8eb75646b318498beb655d0572c3dc4979c1aafa8131bb5da6cab20
- MD5 c7f9c10e5752969b33f9e172378a1582
- SHA1 50a4d2c2f0766ca9747c6cca1a281aa69a4a8b50
- SHA512 2f6f6a040545b65b3cb160809abadb77559cb9a83fff2bfa7ae4fc61f42a30656a21040d33293cd0098371190f4aa2462b0c0e19ff9cb37f116deb5ebdb7aae5
- SSDEEP 49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvVCMu7iMm8ut4:RF8QUitE4iLqaPWGnEvgM7MT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 3.1MB
- SHA256 22f5eae7d0cfda7bbcc4372329ad18983056f7f6d5e9912260589a3bb6cefb8d
- MD5 dbcf27a356b11392d260d7915340e3ec
- SHA1 752de0fbc725e5935fd55f229406a76f4d7438bb
- SHA512 5ac754689e4518f81510b316b8ff8eaccd8bfd95ceb146de137379773f4408ca7420757f87c51af0ffff428855ea6e18088c4046d38f9a26481a4f71b974b158
- SSDEEP 49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvVCMu7iMm8utO4:RF8QUitE4iLqaPWGnEvgM7M/4
- MD5 SHA1 SHA512 SSDEEP