Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 04:41
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe
-
Size
170KB
-
MD5
7f102dcc7063016547c72dc7da74eacb
-
SHA1
212fbaa08c19ad7e33afeaac266e2e12adc744c8
-
SHA256
dfbfab57a37980f721f3096a5ce5801ed8e428724c132aafd0d5f286c353d01e
-
SHA512
62371e8629dc0d2f073836820413000918f9cfe1d0e999e13791aeb0f89dad1157b1687d81708b6ac97218b03f2a66ae9a4c598fbf1f3806defdc9b7f1ff490f
-
SSDEEP
3072:ZRpAyazIliazTAVZqf6Ddvi+ImQj237MxsqHvhmCeWPaZuD4sPgjuzSDROQBp:xZ8azWY6Zqo7MxsY5eqD4qeQQv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
hKV3vaSqQkZLF2l.exeCTS.exepid process 2236 hKV3vaSqQkZLF2l.exe 2572 CTS.exe -
Loads dropped DLL 1 IoCs
Processes:
2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exepid process 1740 2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
CTS.exe2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe -
Drops file in Windows directory 2 IoCs
Processes:
2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exeCTS.exedescription ioc process File created C:\Windows\CTS.exe 2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exeCTS.exedescription pid process Token: SeDebugPrivilege 1740 2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe Token: SeDebugPrivilege 2572 CTS.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exedescription pid process target process PID 1740 wrote to memory of 2236 1740 2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe hKV3vaSqQkZLF2l.exe PID 1740 wrote to memory of 2236 1740 2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe hKV3vaSqQkZLF2l.exe PID 1740 wrote to memory of 2236 1740 2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe hKV3vaSqQkZLF2l.exe PID 1740 wrote to memory of 2236 1740 2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe hKV3vaSqQkZLF2l.exe PID 1740 wrote to memory of 2572 1740 2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe CTS.exe PID 1740 wrote to memory of 2572 1740 2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe CTS.exe PID 1740 wrote to memory of 2572 1740 2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe CTS.exe PID 1740 wrote to memory of 2572 1740 2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe CTS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_7f102dcc7063016547c72dc7da74eacb_bkransomware.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hKV3vaSqQkZLF2l.exeC:\Users\Admin\AppData\Local\Temp\hKV3vaSqQkZLF2l.exe2⤵
- Executes dropped EXE
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\hKV3vaSqQkZLF2l.exeFilesize
170KB
MD52aa6692a08b6d5b5e1dcd26b29d666d9
SHA1e2872453df047432aaafce82e93724d6b144cbfd
SHA2562560d01a6e5f4f96d85be0e89d22195dc72cec82fa619b8b1fb9675ee160cb15
SHA512bc4ee0f66376c9533ec6cd04a39f1b042d317d049da041803a7c25526008ef46ad0bacf4b73b73c288a6c250b64dd9b68c870a2905660f5ae3aa0c660f3b17f7
-
C:\Windows\CTS.exeFilesize
71KB
MD5f9d4ab0a726adc9b5e4b7d7b724912f1
SHA13d42ca2098475924f70ee4a831c4f003b4682328
SHA256b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc
SHA51222a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432
-
\Users\Admin\AppData\Local\Temp\hKV3vaSqQkZLF2l.exeFilesize
99KB
MD598eea111050b063ba63c6086ed7d4723
SHA125cd896907cc56e03af7e2704679fc4cee2b0ff9
SHA256a8c0b8b5a892198aef71fa68d0a0eb88d3e8d5c541ad6a1ecf5baa0bc95fc403
SHA51241fc40864664c15bd8d6b1414bee1b79933c8f5a71e67e872c47b185e60ecf7d003613bf44de6d68c70a86e7a59620be6afa90850228dc251c5f61c91d017cd0