05a5ac259816589cfe9d587fedf385a4c97ff261acaa6e13f0ed046c7d74e469

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 04:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-28_32b485de524be537089031e977488707_bkransomware.exe
Size

302KB
MD5

32b485de524be537089031e977488707
SHA1

1e117bde87726f398e12630180e857c989482972
SHA256

05a5ac259816589cfe9d587fedf385a4c97ff261acaa6e13f0ed046c7d74e469
SHA512

b72cf9b43097307b5a63a7150b4a41c871e267f4ad246e136966fd7b1e1300425be290e84bcdb353222e02678d18d1e0e4de8d3b1d2d9a6fcd4a6eafc2be08d3
SSDEEP

6144:xZ8az7P2BcZeTG2MTLl6c/vp7q6Gvl2MieQCVKYCF:xC0726pLFbG0MlEYu

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

DVpZrhhLHwf0I7F.exeCTS.exe

pid process

4468 DVpZrhhLHwf0I7F.exe
4972 CTS.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4468	DVpZrhhLHwf0I7F.exe
4972	CTS.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2024-04-28_32b485de524be537089031e977488707_bkransomware.exeCTS.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2024-04-28_32b485de524be537089031e977488707_bkransomware.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

Processes:

CTS.exe2024-04-28_32b485de524be537089031e977488707_bkransomware.exe

description ioc process

File created C:\Windows\CTS.exe CTS.exe
File created C:\Windows\CTS.exe 2024-04-28_32b485de524be537089031e977488707_bkransomware.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2024-04-28_32b485de524be537089031e977488707_bkransomware.exeCTS.exe

description pid process

Token: SeDebugPrivilege 4568 2024-04-28_32b485de524be537089031e977488707_bkransomware.exe
Token: SeDebugPrivilege 4972 CTS.exe

description	ioc	process
File created	C:\Windows\CTS.exe	CTS.exe
File created	C:\Windows\CTS.exe	2024-04-28_32b485de524be537089031e977488707_bkransomware.exe

description	pid	process
Token: SeDebugPrivilege	4568	2024-04-28_32b485de524be537089031e977488707_bkransomware.exe
Token: SeDebugPrivilege	4972	CTS.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2024-04-28_32b485de524be537089031e977488707_bkransomware.exe

description	pid	process	target process
PID 4568 wrote to memory of 4468	4568	2024-04-28_32b485de524be537089031e977488707_bkransomware.exe	DVpZrhhLHwf0I7F.exe
PID 4568 wrote to memory of 4468	4568	2024-04-28_32b485de524be537089031e977488707_bkransomware.exe	DVpZrhhLHwf0I7F.exe
PID 4568 wrote to memory of 4468	4568	2024-04-28_32b485de524be537089031e977488707_bkransomware.exe	DVpZrhhLHwf0I7F.exe
PID 4568 wrote to memory of 4972	4568	2024-04-28_32b485de524be537089031e977488707_bkransomware.exe	CTS.exe
PID 4568 wrote to memory of 4972	4568	2024-04-28_32b485de524be537089031e977488707_bkransomware.exe	CTS.exe
PID 4568 wrote to memory of 4972	4568	2024-04-28_32b485de524be537089031e977488707_bkransomware.exe	CTS.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-28_32b485de524be537089031e977488707_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-28_32b485de524be537089031e977488707_bkransomware.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568

C:\Users\Admin\AppData\Local\Temp\DVpZrhhLHwf0I7F.exe
C:\Users\Admin\AppData\Local\Temp\DVpZrhhLHwf0I7F.exe
2⤵
- Executes dropped EXE
PID:4468

C:\Windows\CTS.exe
"C:\Windows\CTS.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Filesize
394KB

MD5
28a801207694e9408ed473d6669ff143

SHA1
f3177da43cd94d208e51953f24b75c7b9e97fc4c

SHA256
d74319583dd7a402c668533d7e099692a3477389414f3cd786f172e1b78e94d0

SHA512
cd019a9705f98b731b95e1ec3ada76086859d29293993440a6d29ad726a8ef211b726a285df44b7e26806a180944e7db544b73d6bde65f70ca862cce53ba73ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\DVpZrhhLHwf0I7F.exe
Filesize
302KB

MD5
0ec273d896bfdfc6b67e9805fafe82fb

SHA1
77945b5435b07e4bd9708e499071fa850a649665

SHA256
819e6b4b9955c2a701e2a1a8820f3fa3171f694150fd132d3d5b6ee1fd6edbf6

SHA512
99aaa3d79690ae511978e47089fabb72d94ff48d9a57e2f8aff4f1097095ab62a8dd57872bc11cf6b7a0afc0f74d881a151cffe692e6e7d4a474105bb22c2d0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\DVpZrhhLHwf0I7F.exe
Filesize
231KB

MD5
022538483dc9f54cdbdc48a16899526c

SHA1
9b372370c29d2cdc72328bc680633212c6aa47fb

SHA256
b9d7fe7dcde0e386122ae04b0ffd3bf9dc7216b031826cfc32f7c6609e3da72d

SHA512
a0979c8779da3cb76d4d490fd9675ceeb516bdc697d2c1138f7ed36197d0e71aa0b036c3460a306f386e7140d09ce5aaec82f1fbcfe3839fcda7413e3badceb5

Download Submit
C:\Windows\CTS.exe
Filesize
71KB

MD5
f9d4ab0a726adc9b5e4b7d7b724912f1

SHA1
3d42ca2098475924f70ee4a831c4f003b4682328

SHA256
b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc

SHA512
22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432

Download Submit