Analysis
-
max time kernel
62s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 14:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_a267cb5adeee59a6dd547cf2ad5a0a49_bkransomware.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-04-28_a267cb5adeee59a6dd547cf2ad5a0a49_bkransomware.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-28_a267cb5adeee59a6dd547cf2ad5a0a49_bkransomware.exe
-
Size
24.4MB
-
MD5
a267cb5adeee59a6dd547cf2ad5a0a49
-
SHA1
19508c3e91a778b0b7e558ce0c4140aa0835a054
-
SHA256
58493af8a68799d3702ffdaec7118b5593b31dd9d413788e779f5118c5550764
-
SHA512
5577f35bb46771608ec5c928a8337fcca2766983f580e28d3c43f2a1346e6da7ab3635b43f69d4ff90e50ffef23641ad179d1b3c9ea5a7ebb55820f549ad0127
-
SSDEEP
393216:fs/ZiWWmvBOK+FslYTTygwZ+Hi8wGqT3YQHwMlvfnjcIXX2Gl3f2Z4qlCuA9Ser:fs/8WJ/lgwZ+HLwC0tnnnnvfkwAer
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
esHjFetyEqhwVOh.exeCTS.exeesHjFetyEqhwVOh.exepid process 3264 esHjFetyEqhwVOh.exe 2400 CTS.exe 5044 esHjFetyEqhwVOh.exe -
Loads dropped DLL 1 IoCs
Processes:
esHjFetyEqhwVOh.exepid process 5044 esHjFetyEqhwVOh.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2024-04-28_a267cb5adeee59a6dd547cf2ad5a0a49_bkransomware.exeCTS.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 2024-04-28_a267cb5adeee59a6dd547cf2ad5a0a49_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 2 IoCs
Processes:
2024-04-28_a267cb5adeee59a6dd547cf2ad5a0a49_bkransomware.exeCTS.exedescription ioc process File created C:\Windows\CTS.exe 2024-04-28_a267cb5adeee59a6dd547cf2ad5a0a49_bkransomware.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2024-04-28_a267cb5adeee59a6dd547cf2ad5a0a49_bkransomware.exeCTS.exedescription pid process Token: SeDebugPrivilege 2780 2024-04-28_a267cb5adeee59a6dd547cf2ad5a0a49_bkransomware.exe Token: SeDebugPrivilege 2400 CTS.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2024-04-28_a267cb5adeee59a6dd547cf2ad5a0a49_bkransomware.exeesHjFetyEqhwVOh.exedescription pid process target process PID 2780 wrote to memory of 3264 2780 2024-04-28_a267cb5adeee59a6dd547cf2ad5a0a49_bkransomware.exe esHjFetyEqhwVOh.exe PID 2780 wrote to memory of 3264 2780 2024-04-28_a267cb5adeee59a6dd547cf2ad5a0a49_bkransomware.exe esHjFetyEqhwVOh.exe PID 2780 wrote to memory of 3264 2780 2024-04-28_a267cb5adeee59a6dd547cf2ad5a0a49_bkransomware.exe esHjFetyEqhwVOh.exe PID 2780 wrote to memory of 2400 2780 2024-04-28_a267cb5adeee59a6dd547cf2ad5a0a49_bkransomware.exe CTS.exe PID 2780 wrote to memory of 2400 2780 2024-04-28_a267cb5adeee59a6dd547cf2ad5a0a49_bkransomware.exe CTS.exe PID 2780 wrote to memory of 2400 2780 2024-04-28_a267cb5adeee59a6dd547cf2ad5a0a49_bkransomware.exe CTS.exe PID 3264 wrote to memory of 5044 3264 esHjFetyEqhwVOh.exe esHjFetyEqhwVOh.exe PID 3264 wrote to memory of 5044 3264 esHjFetyEqhwVOh.exe esHjFetyEqhwVOh.exe PID 3264 wrote to memory of 5044 3264 esHjFetyEqhwVOh.exe esHjFetyEqhwVOh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_a267cb5adeee59a6dd547cf2ad5a0a49_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_a267cb5adeee59a6dd547cf2ad5a0a49_bkransomware.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\esHjFetyEqhwVOh.exeC:\Users\Admin\AppData\Local\Temp\esHjFetyEqhwVOh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{E0213C2F-22EB-4B2E-BB00-9797D999791D}\.cr\esHjFetyEqhwVOh.exe"C:\Windows\Temp\{E0213C2F-22EB-4B2E-BB00-9797D999791D}\.cr\esHjFetyEqhwVOh.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\esHjFetyEqhwVOh.exe" -burn.filehandle.attached=540 -burn.filehandle.self=5483⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xmlFilesize
392KB
MD561f8fc44900e1c1e6e3347d6528f00c6
SHA193882118d211237602ebe07da62bc75e1719fcfc
SHA256ae0c5c6a40b254373440b92eabdcc2b6c8876ef39cdddeaca6199fdf59c2694c
SHA5124a1704a5b2cf1c4512b1bcec016842edf68d223d513238f1078123ff090b1fac8c925f77151eed16d03d6b8771854e6064ddfd0e273926c21b6d09637d87b1b6
-
C:\Users\Admin\AppData\Local\Temp\esHjFetyEqhwVOh.exeFilesize
24.3MB
MD5119dde89a20674349a51893114eae5ed
SHA14de9f6681f0f213b132def3af88a3c68483f5f32
SHA25626c2c72fba6438f5e29af8ebc4826a1e424581b3c446f8c735361f1db7beff72
SHA5129be541f26b5d43cee1766239d8880ab7d30d18fea2f17e28d63a498b30b7dd0918f389805398cb56b0df0df17c8633cb73f9e46672c93b21be04b85bda7a2648
-
C:\Windows\CTS.exeFilesize
71KB
MD5f9d4ab0a726adc9b5e4b7d7b724912f1
SHA13d42ca2098475924f70ee4a831c4f003b4682328
SHA256b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc
SHA51222a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432
-
C:\Windows\Temp\{BA82C7E4-AF38-4E33-B6F5-E2093BF39899}\.ba\logo.pngFilesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
C:\Windows\Temp\{BA82C7E4-AF38-4E33-B6F5-E2093BF39899}\.ba\wixstdba.dllFilesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
C:\Windows\Temp\{E0213C2F-22EB-4B2E-BB00-9797D999791D}\.cr\esHjFetyEqhwVOh.exeFilesize
635KB
MD57cf46d8dfb686998aaaf81e27b995e8c
SHA1c5638a049787ce441c9720c92d3cd02aa3b02429
SHA256120019a0ac9f54224fc9787afba241bd9faaecef489be5a660bb16e85df052e4
SHA51266cf76324e373d3be6cbef39535b419eda486a8f43c305c38a8c01cfc05f9e4073aeade808db8dea306fd3251955e177e45ab578a57114bac1d2df54b4e95efe