Overview

overview

7

Static

static

3

2024-04-28...re.exe

windows7-x64

7

2024-04-28...re.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    28-04-2024 10:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-28_f826928418350daed0959b6fe5837208_bkransomware.exe

  • Size

    11.8MB

  • MD5

    f826928418350daed0959b6fe5837208

  • SHA1

    5a56cdc748dfb2ba91859f47e7e105ac36fe4654

  • SHA256

    4793380fe37d83f037465b6af4f0d3505679aab76ebe919e49e7eb2a43ec4f2c

  • SHA512

    b7df8ceb0a66bcace5c5d912c19528c25a9742d956b7744fd733adeccb1d48fa22d7d5f60030356384e435cdb8cdd75e1523afd54707792107a728a1ac0b8f88

  • SSDEEP

    196608:h+cpkunept7RjSs9B3XpknY7RU1v5mifvMx3hhF3h8TtHeEGCnhGMwL/drW:h+cpzneprzjZr8pfwdaBevMwL/JW

Score
7/10
persistencespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 2 IoCs
    installer
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-28_f826928418350daed0959b6fe5837208_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-28_f826928418350daed0959b6fe5837208_bkransomware.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2748
    • C:\Users\Admin\AppData\Local\Temp\0gZ4LxOTZhtAJjH.exe
      C:\Users\Admin\AppData\Local\Temp\0gZ4LxOTZhtAJjH.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      PID:3016
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2112

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsi1F74.tmp\ioSpecial.ini
    Filesize

    700B

    MD5

    57845668eba5efa0e0262c3d536bc3fb

    SHA1

    fedcde628e45ef501cb14643c57f6112f2aaf4a9

    SHA256

    22f107c7ab88fdd5cdb363379ae10dfd91255080fb7c9feb23cf9bbbe506adea

    SHA512

    5e4474b63b5b21b6c838f8c61845497172dbe9ccdb65b2a29abf60be12f30015c1b5d816e918a689bc79d951cda1c80fafbc61c55a34791f1394d5b283bfafc7

    Download Submit
  • C:\Windows\CTS.exe
    Filesize

    71KB

    MD5

    f9d4ab0a726adc9b5e4b7d7b724912f1

    SHA1

    3d42ca2098475924f70ee4a831c4f003b4682328

    SHA256

    b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc

    SHA512

    22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432

    Download Submit
  • \Users\Admin\AppData\Local\Temp\0gZ4LxOTZhtAJjH.exe
    Filesize

    11.7MB

    MD5

    d50d5712566f1df16b5aea21b9e0ee24

    SHA1

    f442aa68ec8d838625f382bcf273f5d0f66427ea

    SHA256

    e102238100a8b97d22559065e3b19379757aeda932c36916d2c84a4178921854

    SHA512

    f9b8d6762a8b00392519b949083d5f0a3670ed24583ed4aaa7570cbc24914e0c19933486004d8949fbee930b8f0e66b50a05e3c478c193ba269677dcd619d7d0

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsi1F74.tmp\InstallOptions.dll
    Filesize

    14KB

    MD5

    d753362649aecd60ff434adf171a4e7f

    SHA1

    3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

    SHA256

    8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

    SHA512

    41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsi1F74.tmp\System.dll
    Filesize

    10KB

    MD5

    56a321bd011112ec5d8a32b2f6fd3231

    SHA1

    df20e3a35a1636de64df5290ae5e4e7572447f78

    SHA256

    bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

    SHA512

    5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsi1F74.tmp\UserInfo.dll
    Filesize

    4KB

    MD5

    e840e7f30c85e22b09a41098ff3f3343

    SHA1

    ad1eb7b2ba66ae87641947025736c67efbc4b9d8

    SHA256

    6707e9e88dec460c2cf421bd2bc6a314f15717527cb60dcad2fbb7352ae711a3

    SHA512

    ea1362c9e7ac9666d6cbfc02939a6e9c411f6aef113dc8ec898c383fc4ecf9d957c6ad8f75c33847d5da0b4427c861f0ccaf240cb1def189313de2948881dc1b

    Download Submit