bc46daa8b7988e83576d794142d4ddc0f389b07cbe50223a476545b1bcb4c372

Analysis

max time kernel
55s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-28_c29bbf756d65162dcb8c9793229c576c_bkransomware.exe
Size

71KB
MD5

c29bbf756d65162dcb8c9793229c576c
SHA1

f10d9b9b8887a0f7b3f1e74cf2a2e8b798023ebd
SHA256

bc46daa8b7988e83576d794142d4ddc0f389b07cbe50223a476545b1bcb4c372
SHA512

5557945c9f04f069d7274480ab95adf46ee1e79798da594da7208e499a194c25c9679464220e282b7d582cf6e188b61984c974ad7b580314771619117f451d4f
SSDEEP

1536:Fc897UsWjcd9w+AyabjDbxE+MwmvlDuazTL:ZhpAyazIlyazTL

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

CTS.exe

pid process

2728 CTS.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2728	CTS.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2024-04-28_c29bbf756d65162dcb8c9793229c576c_bkransomware.exeCTS.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2024-04-28_c29bbf756d65162dcb8c9793229c576c_bkransomware.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

Processes:

2024-04-28_c29bbf756d65162dcb8c9793229c576c_bkransomware.exeCTS.exe

description ioc process

File created C:\Windows\CTS.exe 2024-04-28_c29bbf756d65162dcb8c9793229c576c_bkransomware.exe
File created C:\Windows\CTS.exe CTS.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2024-04-28_c29bbf756d65162dcb8c9793229c576c_bkransomware.exeCTS.exe

description pid process

Token: SeDebugPrivilege 4720 2024-04-28_c29bbf756d65162dcb8c9793229c576c_bkransomware.exe
Token: SeDebugPrivilege 2728 CTS.exe

description	ioc	process
File created	C:\Windows\CTS.exe	2024-04-28_c29bbf756d65162dcb8c9793229c576c_bkransomware.exe
File created	C:\Windows\CTS.exe	CTS.exe

description	pid	process
Token: SeDebugPrivilege	4720	2024-04-28_c29bbf756d65162dcb8c9793229c576c_bkransomware.exe
Token: SeDebugPrivilege	2728	CTS.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-04-28_c29bbf756d65162dcb8c9793229c576c_bkransomware.exe

description	pid	process	target process
PID 4720 wrote to memory of 2728	4720	2024-04-28_c29bbf756d65162dcb8c9793229c576c_bkransomware.exe	CTS.exe
PID 4720 wrote to memory of 2728	4720	2024-04-28_c29bbf756d65162dcb8c9793229c576c_bkransomware.exe	CTS.exe
PID 4720 wrote to memory of 2728	4720	2024-04-28_c29bbf756d65162dcb8c9793229c576c_bkransomware.exe	CTS.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-28_c29bbf756d65162dcb8c9793229c576c_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-28_c29bbf756d65162dcb8c9793229c576c_bkransomware.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720

C:\Windows\CTS.exe
"C:\Windows\CTS.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2728

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Filesize
392KB

MD5
9c2319adc49deeae23c8ed06e7569a1b

SHA1
9462d7801be82361d08bafa7b7f164fc86d27acf

SHA256
c3aa3cd39396c9c107076c93d2b568c5f12c3614bb909983dad30219e21814b8

SHA512
1977d9fcf4946a8da715e18be5c7bddb8dd2ed576493d1d41b3b702f4e3dc3e512bc7060f25ff5860209ac231265d5da85842fc467fa63aa2cae2f17967a269f

Download Submit
C:\Users\Admin\AppData\Local\Temp\L04xSahFzhcFEyx.exe
Filesize
71KB

MD5
4e0d54317c35004b722affa74886bd32

SHA1
19691dbb8b7b2b1ab3dd2bf8c897be4de1d5d245

SHA256
803ffad95e4425466c578b0bfde4c9a4011b759552aec15658d54f1bd498f80c

SHA512
6185262bc61daf063ace1549bd57fb0026db8823eea5b522ea103a3d5ba12cba63de8edc2e5662d5c1b8d028460bb1070a53799861eb8d845f39409706442dda

Download Submit
C:\Windows\CTS.exe
Filesize
71KB

MD5
66df4ffab62e674af2e75b163563fc0b

SHA1
dec8a197312e41eeb3cfef01cb2a443f0205cd6e

SHA256
075a6eecd8da1795532318f9cf880efe42461f9464d63f74deb271d33110f163

SHA512
1588dd78e6e8972013c40cdb6acfb84c8df7b081197233ce621904b645356c805d0424bb93dd46c55834dc47d9ff39ee1323cf8e670841b3fff24ab98ba87f25

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads