239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a

General

Target

239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe
Size

942KB
MD5

a92015618b79adee683000eaaaa30c83
SHA1

fd2c04199f3e58c13bd2876bf38702ba3f172f75
SHA256

239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a
SHA512

5a82b48b223b6aa518aca74e2b6342045436e483f3a82c57d1ba236b257ce1c80a826e345a0b600796a0164e55a2d286f5b2e0183ef0662b8e96e89d173faa65

Score

8^/10

upx

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

BKIVNA.exeBKIVNA.exe

pid process

2004 BKIVNA.exe
1500 BKIVNA.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1168-67-0x0000000140000000-0x0000000142EFE000-memory.dmp	upx
behavioral1/memory/1168-69-0x0000000140000000-0x0000000142EFE000-memory.dmp	upx
behavioral1/memory/1168-70-0x0000000140000000-0x0000000142EFE000-memory.dmp	upx
behavioral1/memory/1168-72-0x0000000140000000-0x0000000142EFE000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

2008 cmd.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

BKIVNA.exe

description pid process target process

PID 2004 set thread context of 1168 2004 BKIVNA.exe explorer.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

820 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1984 timeout.exe

pid	process
2008	cmd.exe

description	pid	process	target process
PID 2004 set thread context of 1168	2004	BKIVNA.exe	explorer.exe

pid	process
820	schtasks.exe

pid	process
1984	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

BKIVNA.exe

pid	process
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe
2004	BKIVNA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exeBKIVNA.exe

description	pid	process
Token: SeDebugPrivilege	784	239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe
Token: SeDebugPrivilege	2004	BKIVNA.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.execmd.exeBKIVNA.execmd.exetaskeng.exe

description	pid	process	target process
PID 784 wrote to memory of 2008	784	239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe	cmd.exe
PID 784 wrote to memory of 2008	784	239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe	cmd.exe
PID 784 wrote to memory of 2008	784	239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe	cmd.exe
PID 2008 wrote to memory of 1984	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1984	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 1984	2008	cmd.exe	timeout.exe
PID 2008 wrote to memory of 2004	2008	cmd.exe	BKIVNA.exe
PID 2008 wrote to memory of 2004	2008	cmd.exe	BKIVNA.exe
PID 2008 wrote to memory of 2004	2008	cmd.exe	BKIVNA.exe
PID 2004 wrote to memory of 1712	2004	BKIVNA.exe	cmd.exe
PID 2004 wrote to memory of 1712	2004	BKIVNA.exe	cmd.exe
PID 2004 wrote to memory of 1712	2004	BKIVNA.exe	cmd.exe
PID 1712 wrote to memory of 820	1712	cmd.exe	schtasks.exe
PID 1712 wrote to memory of 820	1712	cmd.exe	schtasks.exe
PID 1712 wrote to memory of 820	1712	cmd.exe	schtasks.exe
PID 2004 wrote to memory of 1168	2004	BKIVNA.exe	explorer.exe
PID 2004 wrote to memory of 1168	2004	BKIVNA.exe	explorer.exe
PID 2004 wrote to memory of 1168	2004	BKIVNA.exe	explorer.exe
PID 2004 wrote to memory of 1168	2004	BKIVNA.exe	explorer.exe
PID 2004 wrote to memory of 1168	2004	BKIVNA.exe	explorer.exe
PID 2004 wrote to memory of 1168	2004	BKIVNA.exe	explorer.exe
PID 2004 wrote to memory of 1168	2004	BKIVNA.exe	explorer.exe
PID 988 wrote to memory of 1500	988	taskeng.exe	BKIVNA.exe
PID 988 wrote to memory of 1500	988	taskeng.exe	BKIVNA.exe
PID 988 wrote to memory of 1500	988	taskeng.exe	BKIVNA.exe

C:\Users\Admin\AppData\Local\Temp\239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe
"C:\Users\Admin\AppData\Local\Temp\239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:784

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp279E.tmp.bat""
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:1984

C:\ProgramData\win32\BKIVNA.exe
"C:\ProgramData\win32\BKIVNA.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "BKIVNA" /tr "C:\ProgramData\win32\BKIVNA.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "BKIVNA" /tr "C:\ProgramData\win32\BKIVNA.exe"
5⤵
- Creates scheduled task(s)
PID:820

C:\Windows\explorer.exe
C:\Windows\explorer.exe --algo ETHASH --pool eth.2miners.com:2020 --user 0xd3e33ee5d3c0be3da5f6a9516fd52bc9a877677b.RIGA_1
4⤵
PID:1168

C:\Windows\system32\taskeng.exe
taskeng.exe {B7150C7C-4965-4B51-BF9C-48DDDE7B7B02} S-1-5-21-790309383-526510583-3802439154-1000:TVHJCWMH\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:988

C:\ProgramData\win32\BKIVNA.exe
C:\ProgramData\win32\BKIVNA.exe
2⤵
- Executes dropped EXE
PID:1500

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\win32\BKIVNA.exe
Filesize
942KB

MD5
a92015618b79adee683000eaaaa30c83

SHA1
fd2c04199f3e58c13bd2876bf38702ba3f172f75

SHA256
239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a

SHA512
5a82b48b223b6aa518aca74e2b6342045436e483f3a82c57d1ba236b257ce1c80a826e345a0b600796a0164e55a2d286f5b2e0183ef0662b8e96e89d173faa65

Download Submit
C:\ProgramData\win32\BKIVNA.exe
Filesize
942KB

MD5
a92015618b79adee683000eaaaa30c83

SHA1
fd2c04199f3e58c13bd2876bf38702ba3f172f75

SHA256
239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a

SHA512
5a82b48b223b6aa518aca74e2b6342045436e483f3a82c57d1ba236b257ce1c80a826e345a0b600796a0164e55a2d286f5b2e0183ef0662b8e96e89d173faa65

Download Submit
C:\ProgramData\win32\BKIVNA.exe
Filesize
942KB

MD5
a92015618b79adee683000eaaaa30c83

SHA1
fd2c04199f3e58c13bd2876bf38702ba3f172f75

SHA256
239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a

SHA512
5a82b48b223b6aa518aca74e2b6342045436e483f3a82c57d1ba236b257ce1c80a826e345a0b600796a0164e55a2d286f5b2e0183ef0662b8e96e89d173faa65

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp279E.tmp.bat
Filesize
140B

MD5
07333faeacbfac234b9b68aa53c2dc42

SHA1
93bc009c0636493ba1f26e34297f8480cdb65cb7

SHA256
2443131038d4e3c75cdd5f1263cfc96e97db217bcb6509a35c03a7e956c451b4

SHA512
253d376da2d5e65ff48843e1fd662a24bc5a55fc8048551466fd866207e981acedfbf7edf133ec2c450b759b2a8abd50cd0831999871a4a587a4cd3155ae1d55

Download Submit
\ProgramData\win32\BKIVNA.exe
Filesize
942KB

MD5
a92015618b79adee683000eaaaa30c83

SHA1
fd2c04199f3e58c13bd2876bf38702ba3f172f75

SHA256
239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a

SHA512
5a82b48b223b6aa518aca74e2b6342045436e483f3a82c57d1ba236b257ce1c80a826e345a0b600796a0164e55a2d286f5b2e0183ef0662b8e96e89d173faa65

Download Submit
memory/784-54-0x00000000012A0000-0x0000000001390000-memory.dmp

Filesize
960KB

Download
memory/820-65-0x0000000000000000-mapping.dmp

Download
memory/1168-70-0x0000000140000000-0x0000000142EFE000-memory.dmp

Filesize
47.0MB

Download
memory/1168-66-0x0000000140000000-0x0000000142EFE000-memory.dmp

Filesize
47.0MB

Download
memory/1168-67-0x0000000140000000-0x0000000142EFE000-memory.dmp

Filesize
47.0MB

Download
memory/1168-69-0x0000000140000000-0x0000000142EFE000-memory.dmp

Filesize
47.0MB

Download
memory/1168-71-0x0000000142EFC000-mapping.dmp

Download
memory/1168-72-0x0000000140000000-0x0000000142EFE000-memory.dmp

Filesize
47.0MB

Download
memory/1500-73-0x0000000000000000-mapping.dmp

Download
memory/1712-64-0x0000000000000000-mapping.dmp

Download
memory/1984-57-0x0000000000000000-mapping.dmp

Download
memory/2004-62-0x0000000000E30000-0x0000000000F20000-memory.dmp

Filesize
960KB

Download
memory/2004-63-0x000007FEFC061000-0x000007FEFC063000-memory.dmp

Filesize
8KB

Download
memory/2004-59-0x0000000000000000-mapping.dmp

Download
memory/2008-55-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads