Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    57s
  • max time network
    40s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/04/2024, 17:30

General

  • Target

    2024-04-27_8da2bf47e54a8858b398bf3a1dad5699_bkransomware.exe

  • Size

    71KB

  • MD5

    8da2bf47e54a8858b398bf3a1dad5699

  • SHA1

    089462b0f8137ee4759bc7dd6f046abe8f100dee

  • SHA256

    29fe12e4067f1c318ce95b5203736bcf4f5cb97c31b8079d89ded2afaa6cd216

  • SHA512

    edc11620530131037a02d66fe9092f70b4ed6e698ad048b765990c1f13634732a3106a570896a568e4aef3d5b0c15efb7318ac825271423f09bd418b20e69bd6

  • SSDEEP

    1536:Fc897UsWjcd9w+AyabjDbxE+MwmvlDuazTEwV:ZhpAyazIlyazT7V

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-27_8da2bf47e54a8858b398bf3a1dad5699_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-27_8da2bf47e54a8858b398bf3a1dad5699_bkransomware.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4408
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:936

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

    Filesize

    392KB

    MD5

    f39fdcdf055d78a9cdf6fc70daaf61c1

    SHA1

    000693fa547aa7a5acc351ffd6a0333d307baada

    SHA256

    641c09e183d33d0146ee0fadc3e76faece4e9f384d4a06137f3cccef48349621

    SHA512

    4e18d763941250830f9f6d4798d683990ca24eba73b7bf1fcad5685cbc4513166fac888ec04c8e92bbcc49f2046eb1bb9c810340ac657821955351943842aef0

  • C:\Users\Admin\AppData\Local\Temp\TDSLd9fLPn0O5ww.exe

    Filesize

    71KB

    MD5

    5a4041409bb46f29b496e7ecdfbc657d

    SHA1

    caf5a45744287677499d643c950eae6298b96cf5

    SHA256

    087a78af73efe0e8c7c5e607b572d63de461adc79a6eae7b3c3ea703dc9ef9bd

    SHA512

    7271aa0296e2a6734a015811496c2e7086f6e4a69bea2ed699e31fad167ef753d1dc1e38eff9f46872ebd54ae05215030688d8a5ee23df05e9179905898a6404

  • C:\Windows\CTS.exe

    Filesize

    71KB

    MD5

    66df4ffab62e674af2e75b163563fc0b

    SHA1

    dec8a197312e41eeb3cfef01cb2a443f0205cd6e

    SHA256

    075a6eecd8da1795532318f9cf880efe42461f9464d63f74deb271d33110f163

    SHA512

    1588dd78e6e8972013c40cdb6acfb84c8df7b081197233ce621904b645356c805d0424bb93dd46c55834dc47d9ff39ee1323cf8e670841b3fff24ab98ba87f25