Overview

overview

7

Static

static

3

2024-04-28...re.exe

windows7-x64

7

2024-04-28...re.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    94s
  • max time network
    91s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2024 18:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-28_1b919658db32ffba06cd13ba0f230923_bkransomware.exe

  • Size

    79.3MB

  • MD5

    1b919658db32ffba06cd13ba0f230923

  • SHA1

    591a32944a659b8013db49bfed0e04ac597f394f

  • SHA256

    55fbe70e6b731dcbb6668beb12bbdf1026b3f61501d308bd5c6f5f47758ff993

  • SHA512

    c10df8f3d9307e723a98bd8f2fdcc7ea1ef042c05412ab089e17b4a20c70309732f1f270cbf0ff1144436b0224eb25c4cd5cfd34022dae5db7baa01626791c61

  • SSDEEP

    1572864:fj0sKNVvxxwV1quLKjKPQV4XA14OjY4fEeIKGvJupB8:/wVvnw6W0KPQ2utk4l+wB8

Score
7/10
persistencespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-28_1b919658db32ffba06cd13ba0f230923_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-28_1b919658db32ffba06cd13ba0f230923_bkransomware.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3092
    • C:\Users\Admin\AppData\Local\Temp\ZZZfFBcuCWuWI2k.exe
      C:\Users\Admin\AppData\Local\Temp\ZZZfFBcuCWuWI2k.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:532
      • C:\Users\Admin\AppData\Local\Temp\jds240601250.tmp\ZZZfFBcuCWuWI2k.exe
        "C:\Users\Admin\AppData\Local\Temp\jds240601250.tmp\ZZZfFBcuCWuWI2k.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4376
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2892

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
    Filesize

    392KB

    MD5

    4be871a50064f9cfbdac3155f8929855

    SHA1

    0e32ee699e01227ec9299f34964f5c1ceb9ffc03

    SHA256

    d4a5781ec470bf7a676c863f4ec6db7325512c52921a7f82c031a540dffbcde2

    SHA512

    a9c76e3a7a5dd4f656ec90024d03d75b40f593fc1b0c283dc5613c61e675eb7c8ece144901aa1ef3971cdc6530c4b568479cade6f5657d147a5b52f47c37b2bd

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\ZZZfFBcuCWuWI2k.exe
    Filesize

    79.2MB

    MD5

    608914d57c9476b6af49a545d042f4fc

    SHA1

    a7b9709bfae02ca7ef90c08d38152c12f83e864f

    SHA256

    3f3b8ecbb0808b15a811ca437767d09e73c04d465729fd1532e296903634461c

    SHA512

    5e6e9132e3d768f07e3a829743c7e793a60874875458c213a8cfd535d6861927192ffe48b26f127ee4c54ec28dfaf6183ddc36421e585711dd29d9a0b8e740f4

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\jds240601250.tmp\ZZZfFBcuCWuWI2k.exe
    Filesize

    78.8MB

    MD5

    2e984fc82add25bab8bd9b4e2bb83d0c

    SHA1

    8319d63c6b593b667f194f2ed2c9216cccaa3ee0

    SHA256

    25b6669a3cd944c3e80e2fe32267ade7347a44a371d964586bb18d94d2227b37

    SHA512

    a7526f328e3ea4fb901bf1f811463283be46327332fcafa69e36236451e2b568fcf383aaf313772143a5487faed3f2e9774fdd486d312f647a4a98e16e829fc9

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\jusched.log
    Filesize

    306KB

    MD5

    18e4e2dfe5832c928997a5e741bb1f9c

    SHA1

    7f256624514d0e15e01764bb38c8ac65afad6419

    SHA256

    7a7d3e15e31f043c0f8a74e3dfb3c2f93a696153e964e1797be1a5e908bbe974

    SHA512

    050a3879a1b702050618701a7c0bedf5a38c04227a7565cc2d1772d36ca7978e27f027266dcaa37982253b54ceba12f98e12187ad9fdff5ef8b4cec562af8567

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\jusched.log
    Filesize

    307KB

    MD5

    b7e7065e7cbb0e15af9e95afa661a5c9

    SHA1

    73c7410566ff4f580aa3111755e64a654dc225c7

    SHA256

    60cdd1b0caa37ab636317f5d5502d4cb880b488d179e6c5e05a79f977a313d2b

    SHA512

    967bf4a347186f1fe6f52a44b9add4d88e85f89f45811212d2220c86656d3caca916eae2a2781ce4c0410bc4dba5580183fa7b4969a16f6d84cac5bfe87898bf

    Download Submit
  • C:\Windows\CTS.exe
    Filesize

    71KB

    MD5

    66df4ffab62e674af2e75b163563fc0b

    SHA1

    dec8a197312e41eeb3cfef01cb2a443f0205cd6e

    SHA256

    075a6eecd8da1795532318f9cf880efe42461f9464d63f74deb271d33110f163

    SHA512

    1588dd78e6e8972013c40cdb6acfb84c8df7b081197233ce621904b645356c805d0424bb93dd46c55834dc47d9ff39ee1323cf8e670841b3fff24ab98ba87f25

    Download Submit