cc5ec141323ab88cd532d4e0f46c7b583c21b716fc68bbbed62aaec34a1b54e7

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-28_3f40fe73a4a906713575402197a1f406_bkransomware.exe
Size

71KB
MD5

3f40fe73a4a906713575402197a1f406
SHA1

534351c6b1be94c3985d47d4370eb903540c0d1b
SHA256

cc5ec141323ab88cd532d4e0f46c7b583c21b716fc68bbbed62aaec34a1b54e7
SHA512

13a6f289dcd0156aa6db88818eb46c388261965e3df856a990c98b02aea3c7e7c4bff9ee4d962ec9c267c54e04b1535bec5f65b2b5d8c8f7c687827ca06165c8
SSDEEP

1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazTq:ZRpAyazIliazTq

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

CTS.exe

pid process

1132 CTS.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
1132	CTS.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2024-04-28_3f40fe73a4a906713575402197a1f406_bkransomware.exeCTS.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2024-04-28_3f40fe73a4a906713575402197a1f406_bkransomware.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

Processes:

2024-04-28_3f40fe73a4a906713575402197a1f406_bkransomware.exeCTS.exe

description ioc process

File created C:\Windows\CTS.exe 2024-04-28_3f40fe73a4a906713575402197a1f406_bkransomware.exe
File created C:\Windows\CTS.exe CTS.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2024-04-28_3f40fe73a4a906713575402197a1f406_bkransomware.exeCTS.exe

description pid process

Token: SeDebugPrivilege 1880 2024-04-28_3f40fe73a4a906713575402197a1f406_bkransomware.exe
Token: SeDebugPrivilege 1132 CTS.exe

description	ioc	process
File created	C:\Windows\CTS.exe	2024-04-28_3f40fe73a4a906713575402197a1f406_bkransomware.exe
File created	C:\Windows\CTS.exe	CTS.exe

description	pid	process
Token: SeDebugPrivilege	1880	2024-04-28_3f40fe73a4a906713575402197a1f406_bkransomware.exe
Token: SeDebugPrivilege	1132	CTS.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-04-28_3f40fe73a4a906713575402197a1f406_bkransomware.exe

description	pid	process	target process
PID 1880 wrote to memory of 1132	1880	2024-04-28_3f40fe73a4a906713575402197a1f406_bkransomware.exe	CTS.exe
PID 1880 wrote to memory of 1132	1880	2024-04-28_3f40fe73a4a906713575402197a1f406_bkransomware.exe	CTS.exe
PID 1880 wrote to memory of 1132	1880	2024-04-28_3f40fe73a4a906713575402197a1f406_bkransomware.exe	CTS.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-28_3f40fe73a4a906713575402197a1f406_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-28_3f40fe73a4a906713575402197a1f406_bkransomware.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1880

C:\Windows\CTS.exe
"C:\Windows\CTS.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1132

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Filesize
394KB

MD5
161a74ad6e8a3f1b2d8d5751427b1057

SHA1
575ec86afbc95136cd2719861d2f14e584fe2976

SHA256
f81a263829c9c4ae02d554f1e344b3ad096f8b1fa5d481548cb92c4be617bf73

SHA512
eaa90f94969ba6918efaca907ab1676455064fed3b31c3f1560d8f2d9305a9c6f1e53ad4aadb2fc1e60cb89a51d84362189719b340d5d718b37e51082bbd67cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\UR5DqWEBmt3O2nQ.exe
Filesize
71KB

MD5
5767053014df23e400579318ec8b9a4e

SHA1
1b02aa26986f260b3622797ea1804653105642bf

SHA256
8fcdb0d0007d77293c204a0337d793a3ce4b4edf85c7e722259b375676ad0328

SHA512
00d74015f49c32e7e9dc9ed13146f54fb2c5a5e8597f09e89ac843d3c1ef062af459a1aba7fbb14532bbb9c0a2c36e281faa195367691dd28988c3763cac3d73

Download Submit
C:\Windows\CTS.exe
Filesize
71KB

MD5
f9d4ab0a726adc9b5e4b7d7b724912f1

SHA1
3d42ca2098475924f70ee4a831c4f003b4682328

SHA256
b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc

SHA512
22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432

Download Submit