14791264a3918650fcb150c11e59e308dc1131eb08cbbdfcfcca49ac5657a646

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 17:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-03_46a27c782b09f4a602730e8b1cad3627_bkransomware.exe
Size

7.3MB
MD5

46a27c782b09f4a602730e8b1cad3627
SHA1

10b7660cccc7e4a3fe105fb9b1cad49732834a0b
SHA256

14791264a3918650fcb150c11e59e308dc1131eb08cbbdfcfcca49ac5657a646
SHA512

6502834a98d045c548e43cc30c78e4375e0aeaddd47706f172ddea4e06c6757e204500e7f992863e62036df55cb27f3427e5d66e30d7e19ce275506c7bce931a
SSDEEP

196608:onG45fkN4b7cqKg4LK8VJFgDx8vfFe9WI+eAMrk1h:t4RkN4bAqtGtFYx6fU9WNe1g1h

Score

9^/10

persistence spyware stealer

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 2 IoCs

resource	yara_rule
behavioral2/files/0x000f000000023b8e-3.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4772-17-0x0000000000DB0000-0x00000000014F6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Executes dropped EXE 2 IoCs

pid	Process
4772	22hwOfQQpJqgtkg.exe
536	CTS.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2024-05-03_46a27c782b09f4a602730e8b1cad3627_bkransomware.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	2024-05-03_46a27c782b09f4a602730e8b1cad3627_bkransomware.exe
File created	C:\Windows\CTS.exe	CTS.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2768	2024-05-03_46a27c782b09f4a602730e8b1cad3627_bkransomware.exe
Token: SeDebugPrivilege	536	CTS.exe
Token: SeDebugPrivilege	4772	22hwOfQQpJqgtkg.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 4772	2768	2024-05-03_46a27c782b09f4a602730e8b1cad3627_bkransomware.exe	85
PID 2768 wrote to memory of 4772	2768	2024-05-03_46a27c782b09f4a602730e8b1cad3627_bkransomware.exe	85
PID 2768 wrote to memory of 536	2768	2024-05-03_46a27c782b09f4a602730e8b1cad3627_bkransomware.exe	87
PID 2768 wrote to memory of 536	2768	2024-05-03_46a27c782b09f4a602730e8b1cad3627_bkransomware.exe	87
PID 2768 wrote to memory of 536	2768	2024-05-03_46a27c782b09f4a602730e8b1cad3627_bkransomware.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-05-03_46a27c782b09f4a602730e8b1cad3627_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-03_46a27c782b09f4a602730e8b1cad3627_bkransomware.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Users\Admin\AppData\Local\Temp\22hwOfQQpJqgtkg.exe
  C:\Users\Admin\AppData\Local\Temp\22hwOfQQpJqgtkg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4772
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Filesize
392KB

MD5
69e900d8c41387dfa346ab8527d2a3f9

SHA1
7904cfd14d662147adb4841deea4a43b70e2b140

SHA256
04a51bdf2c9d9287d7c7737fea34f8ff80018e448c89167b1057924e1c3243ea

SHA512
873894e55af8897cba3168be2d4afc53292fed8c0d29d266409a9f74e66ee592f63589ab67bee7e464fd7d3c58f5d0858e3495c52ade6a9609e7aa21822c74c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\22hwOfQQpJqgtkg.exe

Filesize
7.3MB

MD5
dd6b75a77601d62ac66df1b0a51a7de3

SHA1
699fc35deccb0cd6e341420903fc993535c2c98f

SHA256
2f46a1d48e1589e0aa10f215e77cb48fb90c531e19aa3c05d766f59b449f3c15

SHA512
43bd57e5379c22494aade734a45a443722327d48c7f06aa521048c99adba576e29bd70bba7bd28ba94f8f24f88efed7b8e5a1b3249cbfcb4d95fd0bc1f424d86

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\chocolatey.config.4772.update

Filesize
9KB

MD5
14ffcf07375b3952bd3f2fe52bb63c14

SHA1
ab2eadde4c614eb8f1f2cae09d989c5746796166

SHA256
6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

SHA512
14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\chocolatey.config.backup

Filesize
809B

MD5
8b6737800745d3b99886d013b3392ac3

SHA1
bb94da3f294922d9e8d31879f2d145586a182e19

SHA256
86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

SHA512
654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

Download Submit
C:\Users\Admin\AppData\Local\Temp\logs\chocolatey.log

Filesize
805B

MD5
e3d6201ac9da655f64f90b9e52f33289

SHA1
6f4b83e3f6eda4051a3d3c9b08cfaadd3352bb90

SHA256
e99eac83e31323f9b1a6208ead6fcb0ed41b748d378db53321fe5ee5c8697980

SHA512
cd319b45eb1a189709f51c535fed25fa517b01d2fe504e581365bc05dfb8fb52edc3c659d9919438dacbcf0507ea686405c45c5a5444933628e7317b336c7c1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\logs\chocolatey.log

Filesize
2KB

MD5
74adaf1a2b64448b8ecb649d22455db3

SHA1
6da8fe8a469526c47391289d513fea86dfee3d4f

SHA256
06e2a29b6a5c1d8467c3e2df308f4792d639ab3d4abfc6d4242100a0ed9d963a

SHA512
abd9c091fd32ec7f928b82e8bc2caef0972d737134509f9c9cadbfc268fdf6e06925ac01e26f2d39ac77571034ac25fe1e15a4c67c51420147cbe2b147e2c520

Download Submit
C:\Users\Admin\AppData\Local\Temp\logs\chocolatey.log

Filesize
4KB

MD5
a71c264f75e4a470eef28d8d562ebd4b

SHA1
fc71dfaaecfb20afeabb9ae170b4334d07696350

SHA256
9cd497910e7133139ef889fb65e977b1935a65181044e13430277b47d878b613

SHA512
8b21a1dcea9fb3a1571da3cea15aed311670c4f919a0b28c4145b79f742122bc3177b382f1d6c5e78424e209f50a870ed657c098cfd9368d6f01e7790dff7c3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\redirects\cpush.exe.ignore

Filesize
2B

MD5
81051bcc2cf1bedf378224b0a93e2877

SHA1
ba8ab5a0280b953aa97435ff8946cbcbb2755a27

SHA256
7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

SHA512
1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

Download Submit
C:\Windows\CTS.exe

Filesize
71KB

MD5
66df4ffab62e674af2e75b163563fc0b

SHA1
dec8a197312e41eeb3cfef01cb2a443f0205cd6e

SHA256
075a6eecd8da1795532318f9cf880efe42461f9464d63f74deb271d33110f163

SHA512
1588dd78e6e8972013c40cdb6acfb84c8df7b081197233ce621904b645356c805d0424bb93dd46c55834dc47d9ff39ee1323cf8e670841b3fff24ab98ba87f25

Download Submit
memory/4772-27-0x00007FFC09930000-0x00007FFC0A3F1000-memory.dmp

Filesize
10.8MB

Download
memory/4772-34-0x0000000001CD0000-0x0000000001CF0000-memory.dmp

Filesize
128KB

Download
memory/4772-17-0x0000000000DB0000-0x00000000014F6000-memory.dmp

Filesize
7.3MB

Download
memory/4772-61-0x00000000035E0000-0x0000000003630000-memory.dmp

Filesize
320KB

Download
memory/4772-62-0x000000001E350000-0x000000001E3C6000-memory.dmp

Filesize
472KB

Download
memory/4772-63-0x0000000003550000-0x000000000356E000-memory.dmp

Filesize
120KB

Download
memory/4772-13-0x00007FFC09933000-0x00007FFC09935000-memory.dmp

Filesize
8KB

Download
memory/4772-168-0x00007FFC09930000-0x00007FFC0A3F1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads