Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/05/2024, 03:20
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-01_e486cc9bd900567fc44273f7d716e9a0_bkransomware.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-01_e486cc9bd900567fc44273f7d716e9a0_bkransomware.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-05-01_e486cc9bd900567fc44273f7d716e9a0_bkransomware.exe
-
Size
918KB
-
MD5
e486cc9bd900567fc44273f7d716e9a0
-
SHA1
7019449445b1a4484aef30704b2f846a2f0c4e01
-
SHA256
d801b67f8b5ee1fd9a883756bf2515434880b52a6232f59c377ba88fdc42af90
-
SHA512
ab71c32591950b8dc8ca21a3d73d36bcacd3e56622209da6d4e60d8af53f4eef8b87a7ba078072f7f62f524406e0b87145ce6903ebf106aaa51da93c129741f8
-
SSDEEP
24576:DCinrKrk8l4PUGArGUWGifscVBcwZvXYPiJFWzbQO6XGM:DC2azkUGArqGCD3CeY/QORM
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1708 NmE0jQakl5R9BCn.exe 1740 CTS.exe 2144 NmE0jQakl5R9BCn.exe -
Loads dropped DLL 3 IoCs
pid Process 2012 2024-05-01_e486cc9bd900567fc44273f7d716e9a0_bkransomware.exe 1708 NmE0jQakl5R9BCn.exe 2144 NmE0jQakl5R9BCn.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 2024-05-01_e486cc9bd900567fc44273f7d716e9a0_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\CTS.exe 2024-05-01_e486cc9bd900567fc44273f7d716e9a0_bkransomware.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2012 2024-05-01_e486cc9bd900567fc44273f7d716e9a0_bkransomware.exe Token: SeDebugPrivilege 1740 CTS.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2012 wrote to memory of 1708 2012 2024-05-01_e486cc9bd900567fc44273f7d716e9a0_bkransomware.exe 28 PID 2012 wrote to memory of 1708 2012 2024-05-01_e486cc9bd900567fc44273f7d716e9a0_bkransomware.exe 28 PID 2012 wrote to memory of 1708 2012 2024-05-01_e486cc9bd900567fc44273f7d716e9a0_bkransomware.exe 28 PID 2012 wrote to memory of 1708 2012 2024-05-01_e486cc9bd900567fc44273f7d716e9a0_bkransomware.exe 28 PID 2012 wrote to memory of 1708 2012 2024-05-01_e486cc9bd900567fc44273f7d716e9a0_bkransomware.exe 28 PID 2012 wrote to memory of 1708 2012 2024-05-01_e486cc9bd900567fc44273f7d716e9a0_bkransomware.exe 28 PID 2012 wrote to memory of 1708 2012 2024-05-01_e486cc9bd900567fc44273f7d716e9a0_bkransomware.exe 28 PID 2012 wrote to memory of 1740 2012 2024-05-01_e486cc9bd900567fc44273f7d716e9a0_bkransomware.exe 29 PID 2012 wrote to memory of 1740 2012 2024-05-01_e486cc9bd900567fc44273f7d716e9a0_bkransomware.exe 29 PID 2012 wrote to memory of 1740 2012 2024-05-01_e486cc9bd900567fc44273f7d716e9a0_bkransomware.exe 29 PID 2012 wrote to memory of 1740 2012 2024-05-01_e486cc9bd900567fc44273f7d716e9a0_bkransomware.exe 29 PID 1708 wrote to memory of 2144 1708 NmE0jQakl5R9BCn.exe 30 PID 1708 wrote to memory of 2144 1708 NmE0jQakl5R9BCn.exe 30 PID 1708 wrote to memory of 2144 1708 NmE0jQakl5R9BCn.exe 30 PID 1708 wrote to memory of 2144 1708 NmE0jQakl5R9BCn.exe 30 PID 1708 wrote to memory of 2144 1708 NmE0jQakl5R9BCn.exe 30 PID 1708 wrote to memory of 2144 1708 NmE0jQakl5R9BCn.exe 30 PID 1708 wrote to memory of 2144 1708 NmE0jQakl5R9BCn.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-01_e486cc9bd900567fc44273f7d716e9a0_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-01_e486cc9bd900567fc44273f7d716e9a0_bkransomware.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\NmE0jQakl5R9BCn.exeC:\Users\Admin\AppData\Local\Temp\NmE0jQakl5R9BCn.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\Temp\{95721BE4-7888-41E8-919A-13AA114C9E54}\.cr\NmE0jQakl5R9BCn.exe"C:\Windows\Temp\{95721BE4-7888-41E8-919A-13AA114C9E54}\.cr\NmE0jQakl5R9BCn.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\NmE0jQakl5R9BCn.exe" -burn.filehandle.attached=180 -burn.filehandle.self=1883⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144
-
-
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
847KB
MD529bf0d271cc659ddd598c564e3e9adb5
SHA17f21ce21bc79ca6df7a27b0090cdb75be75302d3
SHA256550962c4268923bf764797577346b6922493b925b8d17565186bf4b74295193c
SHA512db2a9874aebf6ed6026ee4e8cde71d124706dc269e072d9cbdd715429e4decb84413289eed3f0fbc2ba80a2a25e4f0376dc08f30e1cd566c1974bc84a1535823
-
Filesize
71KB
MD5f9d4ab0a726adc9b5e4b7d7b724912f1
SHA13d42ca2098475924f70ee4a831c4f003b4682328
SHA256b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc
SHA51222a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432
-
Filesize
50KB
MD5888eb713a0095756252058c9727e088a
SHA1c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4
SHA25679434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
SHA5127c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0
-
Filesize
650KB
MD567c295f6b2a53365885879907f4aca36
SHA10c8e4f9e5af43f0f4c9f42b23c9c19a33011c29a
SHA256560739d8eb7d23641260ac5950e8693d376b1714b6ae1e202e74e7e2216ff961
SHA512e8eccf168976a86d5a2bd4be4bb05bd8971afa1f2b3fcd460aac7eda431da0b021b96db71be270be433aa4b2347003dc9e69c43a67c0a7422c8b9a21068a8bb9