Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    28-04-2024 14:44

General

  • Target

    2024-04-28_a267cb5adeee59a6dd547cf2ad5a0a49_bkransomware.exe

  • Size

    24.4MB

  • MD5

    a267cb5adeee59a6dd547cf2ad5a0a49

  • SHA1

    19508c3e91a778b0b7e558ce0c4140aa0835a054

  • SHA256

    58493af8a68799d3702ffdaec7118b5593b31dd9d413788e779f5118c5550764

  • SHA512

    5577f35bb46771608ec5c928a8337fcca2766983f580e28d3c43f2a1346e6da7ab3635b43f69d4ff90e50ffef23641ad179d1b3c9ea5a7ebb55820f549ad0127

  • SSDEEP

    393216:fs/ZiWWmvBOK+FslYTTygwZ+Hi8wGqT3YQHwMlvfnjcIXX2Gl3f2Z4qlCuA9Ser:fs/8WJ/lgwZ+HLwC0tnnnnvfkwAer

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-28_a267cb5adeee59a6dd547cf2ad5a0a49_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-28_a267cb5adeee59a6dd547cf2ad5a0a49_bkransomware.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Users\Admin\AppData\Local\Temp\fUq45BFz3XmZEuY.exe
      C:\Users\Admin\AppData\Local\Temp\fUq45BFz3XmZEuY.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2776
      • C:\Windows\Temp\{6655D9B2-B3CB-4280-A703-50BC9D8FAC5F}\.cr\fUq45BFz3XmZEuY.exe
        "C:\Windows\Temp\{6655D9B2-B3CB-4280-A703-50BC9D8FAC5F}\.cr\fUq45BFz3XmZEuY.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\fUq45BFz3XmZEuY.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2228
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2948

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\CTS.exe
    Filesize

    71KB

    MD5

    f9d4ab0a726adc9b5e4b7d7b724912f1

    SHA1

    3d42ca2098475924f70ee4a831c4f003b4682328

    SHA256

    b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc

    SHA512

    22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432

  • C:\Windows\Temp\{3C6621A4-0E6E-4A95-BEE6-C0116131703C}\.ba\logo.png
    Filesize

    1KB

    MD5

    d6bd210f227442b3362493d046cea233

    SHA1

    ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

    SHA256

    335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

    SHA512

    464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

  • C:\Windows\Temp\{6655D9B2-B3CB-4280-A703-50BC9D8FAC5F}\.cr\fUq45BFz3XmZEuY.exe
    Filesize

    635KB

    MD5

    7cf46d8dfb686998aaaf81e27b995e8c

    SHA1

    c5638a049787ce441c9720c92d3cd02aa3b02429

    SHA256

    120019a0ac9f54224fc9787afba241bd9faaecef489be5a660bb16e85df052e4

    SHA512

    66cf76324e373d3be6cbef39535b419eda486a8f43c305c38a8c01cfc05f9e4073aeade808db8dea306fd3251955e177e45ab578a57114bac1d2df54b4e95efe

  • \Users\Admin\AppData\Local\Temp\fUq45BFz3XmZEuY.exe
    Filesize

    24.3MB

    MD5

    119dde89a20674349a51893114eae5ed

    SHA1

    4de9f6681f0f213b132def3af88a3c68483f5f32

    SHA256

    26c2c72fba6438f5e29af8ebc4826a1e424581b3c446f8c735361f1db7beff72

    SHA512

    9be541f26b5d43cee1766239d8880ab7d30d18fea2f17e28d63a498b30b7dd0918f389805398cb56b0df0df17c8633cb73f9e46672c93b21be04b85bda7a2648

  • \Windows\Temp\{3C6621A4-0E6E-4A95-BEE6-C0116131703C}\.ba\wixstdba.dll
    Filesize

    191KB

    MD5

    eab9caf4277829abdf6223ec1efa0edd

    SHA1

    74862ecf349a9bedd32699f2a7a4e00b4727543d

    SHA256

    a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

    SHA512

    45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2