Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/04/2024, 03:55
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_d69d82d641b9fb248b9dd467b36810b1_bkransomware.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-04-28_d69d82d641b9fb248b9dd467b36810b1_bkransomware.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-28_d69d82d641b9fb248b9dd467b36810b1_bkransomware.exe
-
Size
71KB
-
MD5
d69d82d641b9fb248b9dd467b36810b1
-
SHA1
120e4fb566137de4b0354f0cef7ad100218506f2
-
SHA256
be6ff88b166ad01b22f39f36a65b40314bc64c8389e01d60cb196f5618398ebb
-
SHA512
74be47b6de5e08ebebcb58751d349e939a66424d3a9ba9057492f45a76d93a693a20953d84fee42b7949c5d61715bcc2f9674889d34d9feef789f6502251f80f
-
SSDEEP
1536:Fc897UsWjcd9w+AyabjDbxE+MwmvlDuazTA:ZhpAyazIlyazTA
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 5084 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 2024-04-28_d69d82d641b9fb248b9dd467b36810b1_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\CTS.exe 2024-04-28_d69d82d641b9fb248b9dd467b36810b1_bkransomware.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2388 2024-04-28_d69d82d641b9fb248b9dd467b36810b1_bkransomware.exe Token: SeDebugPrivilege 5084 CTS.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2388 wrote to memory of 5084 2388 2024-04-28_d69d82d641b9fb248b9dd467b36810b1_bkransomware.exe 89 PID 2388 wrote to memory of 5084 2388 2024-04-28_d69d82d641b9fb248b9dd467b36810b1_bkransomware.exe 89 PID 2388 wrote to memory of 5084 2388 2024-04-28_d69d82d641b9fb248b9dd467b36810b1_bkransomware.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_d69d82d641b9fb248b9dd467b36810b1_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_d69d82d641b9fb248b9dd467b36810b1_bkransomware.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5068 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:81⤵PID:4904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789KB
MD5ffb0cbf2ae82a4ee053fed0adc2e0768
SHA155a8d6e40513e71195b231c63b260e333bc59e9f
SHA25645a2060b0c460a2ed74dbbba2fa5ea668df30639151e1feb057c0ade8ba2fef4
SHA512755e336a8d33ac6f25d409ed4d10d86a6f7a0b8ad16e900f647f54ec7d83c39dc1dd2af01d94b9a81eec9ea9ad507483fa2cdb0272d593c9c6d6e37805451751
-
Filesize
71KB
MD54b313d986752dc65a4b024939192ed85
SHA1498039e04d47e4efeb7510ce818d946407b1d385
SHA25651b8e0f3eecd9c02a0daecd2331aaee196c4dd088514c60c068696dfeef07f9d
SHA512b2a09e98d2afe8c960b5a6e5f0076c93bae65388cf7ffe769d3f3eccba92ea64704c537cabbc6cb46f2a91246c121b3f2cca87fb2f46655d1af6902f71a30dfc
-
Filesize
71KB
MD566df4ffab62e674af2e75b163563fc0b
SHA1dec8a197312e41eeb3cfef01cb2a443f0205cd6e
SHA256075a6eecd8da1795532318f9cf880efe42461f9464d63f74deb271d33110f163
SHA5121588dd78e6e8972013c40cdb6acfb84c8df7b081197233ce621904b645356c805d0424bb93dd46c55834dc47d9ff39ee1323cf8e670841b3fff24ab98ba87f25