Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

1ebabb7de8...dN.exe

windows7-x64

10

1ebabb7de8...dN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    04/01/2025, 06:07 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1ebabb7de83b022004f8db77718d207646afe5f8aa0d969afb9beffac152d3fdN.exe

  • Size

    3.4MB

  • MD5

    4917f091e084dd76d27ffd7aebaeb0e0

  • SHA1

    b97e9fb54bb60fea6e6b56d594fbaf0db7f02b55

  • SHA256

    1ebabb7de83b022004f8db77718d207646afe5f8aa0d969afb9beffac152d3fd

  • SHA512

    831168a9ba713051130caa779a9682443ed090be0f5cd8150be8b1e9ad6595e45b91060cb4a41e2cc5055362b04ab75b2b3c368b067951d5b13cb09946e0fbb9

  • SSDEEP

    49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvV8u/kUHHkLZGqdIya:RF8QUitE4iLqaPWGnEvS9E6Iya

Score
10/10
banloaddiscoverydownloaderdropperevasionransomwaretrojan

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Banload family
    banload
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Renames multiple (141) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 58 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ebabb7de83b022004f8db77718d207646afe5f8aa0d969afb9beffac152d3fdN.exe
    "C:\Users\Admin\AppData\Local\Temp\1ebabb7de83b022004f8db77718d207646afe5f8aa0d969afb9beffac152d3fdN.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:2280

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini.tmp
    Filesize

    3.5MB

    MD5

    d4a3b5a7f091085767a52a00fce28e58

    SHA1

    dcbd79a5c9eae5a7634a93902017b03ee9fc25f6

    SHA256

    e774d9f51513d7308d3fd104d08a82e268b429ed0e4bb40d88e8b243ab6dc690

    SHA512

    f81950b0e4ab93b37cd64ac1ad51abef86b9bf56e512044cbc4f073f2f42979efd2b705a87731d741306d83e2827aa202c696f16dc9e11c51868042f30452921

    Download Submit

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
    Filesize

    3.6MB

    MD5

    55b7628279d171661665e743d70d2d9d

    SHA1

    405b6f1549671978f83fa802afece259a12a1629

    SHA256

    52c8bee396f8c0317375fc1d9e7ab7af22aefabad6157bf47195d61bc8274f86

    SHA512

    1fed6564675c16377b35edfc86dd10ece8cd467f35945b6bea05cc9fc78eb9c1f311769d50b71495731e7e513e277199fe76ac5d7c020a5342b149b307264225

    Download Submit

  • memory/2280-0-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2280-8-0x0000000002FA0000-0x00000000031AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2280-1-0x0000000002FA0000-0x00000000031AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2280-11-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2280-12-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2280-13-0x0000000002FA0000-0x00000000031AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2280-21-0x0000000002FA0000-0x00000000031AC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2280-27-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2280-29-0x0000000002FA0000-0x00000000031AC000-memory.dmp

    Filesize

    2.0MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.