Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    02/05/2024, 07:46

General

  • Target

    2024-05-02_0f7472a971ff9d71d41c52b034542a96_bkransomware.exe

  • Size

    28.0MB

  • MD5

    0f7472a971ff9d71d41c52b034542a96

  • SHA1

    84c39f084c64c6fa70af21d461a576d46cf55d9b

  • SHA256

    6ba8dca5e199bc7a8ff72f007ad578dab1ce7d0f90bac6063854d4df79033cfc

  • SHA512

    56758d06fab7b3b805b4c072d8b700f9662ce7b3092380924cb4c728a925e589b5caab50bc059373558bb66c584e587ccc545bad845254fcf891e8cd09c39de3

  • SSDEEP

    786432:To34n+em4k8rrCKoayYfqAtUGxOh5TNO8dASt:TsImo0XDG6G8d/t

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-02_0f7472a971ff9d71d41c52b034542a96_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-02_0f7472a971ff9d71d41c52b034542a96_bkransomware.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2320
    • C:\Users\Admin\AppData\Local\Temp\LX9vP6WnacCSOkV.exe
      C:\Users\Admin\AppData\Local\Temp\LX9vP6WnacCSOkV.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3056
      • C:\Windows\Temp\{47D325FD-080A-4A56-8A20-28422FD50B93}\.cr\LX9vP6WnacCSOkV.exe
        "C:\Windows\Temp\{47D325FD-080A-4A56-8A20-28422FD50B93}\.cr\LX9vP6WnacCSOkV.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\LX9vP6WnacCSOkV.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2628
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2516

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\CTS.exe

    Filesize

    71KB

    MD5

    66df4ffab62e674af2e75b163563fc0b

    SHA1

    dec8a197312e41eeb3cfef01cb2a443f0205cd6e

    SHA256

    075a6eecd8da1795532318f9cf880efe42461f9464d63f74deb271d33110f163

    SHA512

    1588dd78e6e8972013c40cdb6acfb84c8df7b081197233ce621904b645356c805d0424bb93dd46c55834dc47d9ff39ee1323cf8e670841b3fff24ab98ba87f25

  • C:\Windows\Temp\{51C76E36-B9C7-477C-A090-69024AAC719B}\.ba\SideBar.png

    Filesize

    50KB

    MD5

    888eb713a0095756252058c9727e088a

    SHA1

    c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4

    SHA256

    79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067

    SHA512

    7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0

  • \Users\Admin\AppData\Local\Temp\LX9vP6WnacCSOkV.exe

    Filesize

    27.9MB

    MD5

    e7062b85c3624af82079794729618eca

    SHA1

    958fe3e8415aa00b4c3350ef42716321c2fafdeb

    SHA256

    fb3d0466f3754752ca7fd839a09ffe53375ff2c981279fd4bc23a005458f7f5d

    SHA512

    05101359d2ec99f562ef6ec604f1c342f3e05ab88cf7ff95dfb272a861a4a7872458d6cf279dd8c2d73e247af71e8e8d80123e435ab76a6363cb28411d0f7706

  • \Windows\Temp\{47D325FD-080A-4A56-8A20-28422FD50B93}\.cr\LX9vP6WnacCSOkV.exe

    Filesize

    847KB

    MD5

    29bf0d271cc659ddd598c564e3e9adb5

    SHA1

    7f21ce21bc79ca6df7a27b0090cdb75be75302d3

    SHA256

    550962c4268923bf764797577346b6922493b925b8d17565186bf4b74295193c

    SHA512

    db2a9874aebf6ed6026ee4e8cde71d124706dc269e072d9cbdd715429e4decb84413289eed3f0fbc2ba80a2a25e4f0376dc08f30e1cd566c1974bc84a1535823

  • \Windows\Temp\{51C76E36-B9C7-477C-A090-69024AAC719B}\.ba\PythonBA.dll

    Filesize

    650KB

    MD5

    67c295f6b2a53365885879907f4aca36

    SHA1

    0c8e4f9e5af43f0f4c9f42b23c9c19a33011c29a

    SHA256

    560739d8eb7d23641260ac5950e8693d376b1714b6ae1e202e74e7e2216ff961

    SHA512

    e8eccf168976a86d5a2bd4be4bb05bd8971afa1f2b3fcd460aac7eda431da0b021b96db71be270be433aa4b2347003dc9e69c43a67c0a7422c8b9a21068a8bb9