8494d8b38ccf2a80a6c5079d8d9d8106c2d151f3fcffd34b350f8f3539876359

Analysis

max time kernel
131s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 05:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-07_e9dc99295c56c46149845977c93878be_bkransomware.exe
Size

131KB
MD5

e9dc99295c56c46149845977c93878be
SHA1

58889a3ad3eb442bc9d03ebb77dd82d7ebc55e75
SHA256

8494d8b38ccf2a80a6c5079d8d9d8106c2d151f3fcffd34b350f8f3539876359
SHA512

4ba0fd2229619f9c5c29df76fc0ac0ef34fbc87a0ff4f1be5d37eef9f41672b4175d1df6afe67acbd2fdde2bb27b154014e7c8cd3e14bd3accdbc2df14a7d8d0
SSDEEP

3072:ZhpAyazIlyazTvJh4k+VajyPghRhqaT8D:hZMazLJeNEwcRhqJD

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
692	oGx0OKRXa8xAoev.exe
1436	CTS.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2024-05-07_e9dc99295c56c46149845977c93878be_bkransomware.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	2024-05-07_e9dc99295c56c46149845977c93878be_bkransomware.exe
File created	C:\Windows\CTS.exe	CTS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4516	2024-05-07_e9dc99295c56c46149845977c93878be_bkransomware.exe
Token: SeDebugPrivilege	1436	CTS.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 692	4516	2024-05-07_e9dc99295c56c46149845977c93878be_bkransomware.exe	83
PID 4516 wrote to memory of 692	4516	2024-05-07_e9dc99295c56c46149845977c93878be_bkransomware.exe	83
PID 4516 wrote to memory of 692	4516	2024-05-07_e9dc99295c56c46149845977c93878be_bkransomware.exe	83
PID 4516 wrote to memory of 1436	4516	2024-05-07_e9dc99295c56c46149845977c93878be_bkransomware.exe	84
PID 4516 wrote to memory of 1436	4516	2024-05-07_e9dc99295c56c46149845977c93878be_bkransomware.exe	84
PID 4516 wrote to memory of 1436	4516	2024-05-07_e9dc99295c56c46149845977c93878be_bkransomware.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-05-07_e9dc99295c56c46149845977c93878be_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-07_e9dc99295c56c46149845977c93878be_bkransomware.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Users\Admin\AppData\Local\Temp\oGx0OKRXa8xAoev.exe
  C:\Users\Admin\AppData\Local\Temp\oGx0OKRXa8xAoev.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Filesize
394KB

MD5
96977184731e458703579a90392ffce7

SHA1
2dadfdf55df7f11cf31b07cb0e20aec9e7575e12

SHA256
3d11a09c5234d0b15b7b287f06af614df637c5213da6410e5e29de20fec10c3b

SHA512
cf1abd332889605af8f2cd513eebfc06a0b458c0a057aae343a2eeb9107de4fa7d210c82c7abb5ccd9f5f6899b2e6aeaab8e755f4944143269a88e23d6807981

Download Submit
C:\Users\Admin\AppData\Local\Temp\oGx0OKRXa8xAoev.exe

Filesize
60KB

MD5
7b112b1fb864c90ec5b65eab21cb40b8

SHA1
e7b73361f722fc7cbb93ef98a8d26e34f4d49767

SHA256
751941b4e09898c31791efeb5f90fc7367c89831d4a98637ed505e40763e287b

SHA512
bf9cdeff39cc4fa48457c55ad02e3856b5b27998535aed801a469252f01e7676462332fa3f93877753e963d037472f615c1fc5fc2e996316621b4e0a180cb5f5

Download Submit
C:\Windows\CTS.exe

Filesize
71KB

MD5
66df4ffab62e674af2e75b163563fc0b

SHA1
dec8a197312e41eeb3cfef01cb2a443f0205cd6e

SHA256
075a6eecd8da1795532318f9cf880efe42461f9464d63f74deb271d33110f163

SHA512
1588dd78e6e8972013c40cdb6acfb84c8df7b081197233ce621904b645356c805d0424bb93dd46c55834dc47d9ff39ee1323cf8e670841b3fff24ab98ba87f25

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads