Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 04:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exe
-
Size
28.0MB
-
MD5
1aba131066ff905973503e4fd6333347
-
SHA1
058f54fac6d04473ed6fc4ed783027ccbe10c85b
-
SHA256
e061049e240aef4c25a5ad4039f0661448513118735e2d0a72df8744b4bd5a60
-
SHA512
da972d53f490308c9ad1b62fdbad7dcb442e5f6af2f7a54a9acfb9bf70cf962e1850ea3b32b82b50ea7f69f183a217d60082ce3d2039b81849a63f04089d84a2
-
SSDEEP
786432:2xmnyuUkOytmMZu6QfTCViw+Z1oh0DAmoXcg:smyu2oVzY1/DAmu
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
tDs4kOnUFtNTR7W.exeCTS.exetDs4kOnUFtNTR7W.exepid process 2212 tDs4kOnUFtNTR7W.exe 3036 CTS.exe 1580 tDs4kOnUFtNTR7W.exe -
Loads dropped DLL 3 IoCs
Processes:
2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exetDs4kOnUFtNTR7W.exetDs4kOnUFtNTR7W.exepid process 2084 2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exe 2212 tDs4kOnUFtNTR7W.exe 1580 tDs4kOnUFtNTR7W.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exeCTS.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
Processes:
2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exeCTS.exedescription ioc process File created C:\Windows\CTS.exe 2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exeCTS.exedescription pid process Token: SeDebugPrivilege 2084 2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exe Token: SeDebugPrivilege 3036 CTS.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exetDs4kOnUFtNTR7W.exedescription pid process target process PID 2084 wrote to memory of 2212 2084 2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exe tDs4kOnUFtNTR7W.exe PID 2084 wrote to memory of 2212 2084 2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exe tDs4kOnUFtNTR7W.exe PID 2084 wrote to memory of 2212 2084 2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exe tDs4kOnUFtNTR7W.exe PID 2084 wrote to memory of 2212 2084 2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exe tDs4kOnUFtNTR7W.exe PID 2084 wrote to memory of 2212 2084 2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exe tDs4kOnUFtNTR7W.exe PID 2084 wrote to memory of 2212 2084 2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exe tDs4kOnUFtNTR7W.exe PID 2084 wrote to memory of 2212 2084 2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exe tDs4kOnUFtNTR7W.exe PID 2084 wrote to memory of 3036 2084 2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exe CTS.exe PID 2084 wrote to memory of 3036 2084 2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exe CTS.exe PID 2084 wrote to memory of 3036 2084 2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exe CTS.exe PID 2084 wrote to memory of 3036 2084 2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exe CTS.exe PID 2212 wrote to memory of 1580 2212 tDs4kOnUFtNTR7W.exe tDs4kOnUFtNTR7W.exe PID 2212 wrote to memory of 1580 2212 tDs4kOnUFtNTR7W.exe tDs4kOnUFtNTR7W.exe PID 2212 wrote to memory of 1580 2212 tDs4kOnUFtNTR7W.exe tDs4kOnUFtNTR7W.exe PID 2212 wrote to memory of 1580 2212 tDs4kOnUFtNTR7W.exe tDs4kOnUFtNTR7W.exe PID 2212 wrote to memory of 1580 2212 tDs4kOnUFtNTR7W.exe tDs4kOnUFtNTR7W.exe PID 2212 wrote to memory of 1580 2212 tDs4kOnUFtNTR7W.exe tDs4kOnUFtNTR7W.exe PID 2212 wrote to memory of 1580 2212 tDs4kOnUFtNTR7W.exe tDs4kOnUFtNTR7W.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_1aba131066ff905973503e4fd6333347_bkransomware.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tDs4kOnUFtNTR7W.exeC:\Users\Admin\AppData\Local\Temp\tDs4kOnUFtNTR7W.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{CDDB3E3B-FC34-4732-8CCE-DD8476160885}\.cr\tDs4kOnUFtNTR7W.exe"C:\Windows\Temp\{CDDB3E3B-FC34-4732-8CCE-DD8476160885}\.cr\tDs4kOnUFtNTR7W.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\tDs4kOnUFtNTR7W.exe" -burn.filehandle.attached=180 -burn.filehandle.self=1883⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\CTS.exeFilesize
71KB
MD5f9d4ab0a726adc9b5e4b7d7b724912f1
SHA13d42ca2098475924f70ee4a831c4f003b4682328
SHA256b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc
SHA51222a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432
-
C:\Windows\Temp\{D353FA6F-3B51-4047-8BC3-08C9181639D6}\.ba\SideBar.pngFilesize
50KB
MD5888eb713a0095756252058c9727e088a
SHA1c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4
SHA25679434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
SHA5127c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0
-
\Users\Admin\AppData\Local\Temp\tDs4kOnUFtNTR7W.exeFilesize
27.9MB
MD5e7062b85c3624af82079794729618eca
SHA1958fe3e8415aa00b4c3350ef42716321c2fafdeb
SHA256fb3d0466f3754752ca7fd839a09ffe53375ff2c981279fd4bc23a005458f7f5d
SHA51205101359d2ec99f562ef6ec604f1c342f3e05ab88cf7ff95dfb272a861a4a7872458d6cf279dd8c2d73e247af71e8e8d80123e435ab76a6363cb28411d0f7706
-
\Windows\Temp\{CDDB3E3B-FC34-4732-8CCE-DD8476160885}\.cr\tDs4kOnUFtNTR7W.exeFilesize
847KB
MD529bf0d271cc659ddd598c564e3e9adb5
SHA17f21ce21bc79ca6df7a27b0090cdb75be75302d3
SHA256550962c4268923bf764797577346b6922493b925b8d17565186bf4b74295193c
SHA512db2a9874aebf6ed6026ee4e8cde71d124706dc269e072d9cbdd715429e4decb84413289eed3f0fbc2ba80a2a25e4f0376dc08f30e1cd566c1974bc84a1535823
-
\Windows\Temp\{D353FA6F-3B51-4047-8BC3-08C9181639D6}\.ba\PythonBA.dllFilesize
650KB
MD567c295f6b2a53365885879907f4aca36
SHA10c8e4f9e5af43f0f4c9f42b23c9c19a33011c29a
SHA256560739d8eb7d23641260ac5950e8693d376b1714b6ae1e202e74e7e2216ff961
SHA512e8eccf168976a86d5a2bd4be4bb05bd8971afa1f2b3fcd460aac7eda431da0b021b96db71be270be433aa4b2347003dc9e69c43a67c0a7422c8b9a21068a8bb9