Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 01:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_00d0cd13da85e9eed0b8c1d906834c68_bkransomware.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-04-28_00d0cd13da85e9eed0b8c1d906834c68_bkransomware.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-04-28_00d0cd13da85e9eed0b8c1d906834c68_bkransomware.exe
-
Size
71KB
-
MD5
00d0cd13da85e9eed0b8c1d906834c68
-
SHA1
f4cdcaf5105be045c76792b7998d33a9a602cecf
-
SHA256
be929682c214f9f18338b6ac9f0bfcb26568be9868ff8d178b253339966ea089
-
SHA512
317ea49cd869a5a10715b90aabbddc535fda4a9b98d329776b337a4cd137d7cb75a153f72052bf745d9da1b662f74c8590c8ccc4a2e234cf3220f99722ec9717
-
SSDEEP
1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazTD:ZRpAyazIliazTD
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
CTS.exepid process 5352 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2024-04-28_00d0cd13da85e9eed0b8c1d906834c68_bkransomware.exeCTS.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 2024-04-28_00d0cd13da85e9eed0b8c1d906834c68_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
Processes:
2024-04-28_00d0cd13da85e9eed0b8c1d906834c68_bkransomware.exeCTS.exedescription ioc process File created C:\Windows\CTS.exe 2024-04-28_00d0cd13da85e9eed0b8c1d906834c68_bkransomware.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2024-04-28_00d0cd13da85e9eed0b8c1d906834c68_bkransomware.exeCTS.exedescription pid process Token: SeDebugPrivilege 4444 2024-04-28_00d0cd13da85e9eed0b8c1d906834c68_bkransomware.exe Token: SeDebugPrivilege 5352 CTS.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-04-28_00d0cd13da85e9eed0b8c1d906834c68_bkransomware.exedescription pid process target process PID 4444 wrote to memory of 5352 4444 2024-04-28_00d0cd13da85e9eed0b8c1d906834c68_bkransomware.exe CTS.exe PID 4444 wrote to memory of 5352 4444 2024-04-28_00d0cd13da85e9eed0b8c1d906834c68_bkransomware.exe CTS.exe PID 4444 wrote to memory of 5352 4444 2024-04-28_00d0cd13da85e9eed0b8c1d906834c68_bkransomware.exe CTS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_00d0cd13da85e9eed0b8c1d906834c68_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_00d0cd13da85e9eed0b8c1d906834c68_bkransomware.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xmlFilesize
392KB
MD55cffd23621bad308d522b6bcdbb25143
SHA13352ea27fb0e0437e2c59d62359340f2d0d042bc
SHA2567c68a1846c3eb9b458eea06b4169e2ed0c78c14cf83e43be944764a2b91fc06e
SHA51276650c7a79430148a77c764b65d858eb055d456997b7aee7561a2e2b7865860a56ecf585679801d8c806ca0c784696c7f44daa70cd1fad9e9bd352999ca346f0
-
C:\Users\Admin\AppData\Local\Temp\RxJJsqPm0pyO91v.exeFilesize
71KB
MD510a5729018dd13edcdf213e8a5d286c6
SHA1e38709f7ba29e0e3691d0c859d8986158b9e5300
SHA256e7351cba220f3e4fb671649569bcf777a48e600f0f98929fc180113f0d1a4172
SHA51297db48269b6c4ab9878b5639f6f42d715adab3130c1e98d0c241416268dde0d36c9b3d85f67c397168493f2f468c33805d14b3713685fb70dae662f11da15310
-
C:\Windows\CTS.exeFilesize
71KB
MD5f9d4ab0a726adc9b5e4b7d7b724912f1
SHA13d42ca2098475924f70ee4a831c4f003b4682328
SHA256b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc
SHA51222a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432