Analysis
-
max time kernel
125s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 21:10
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe
Resource
win7-20240508-en
General
-
Target
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe
-
Size
524KB
-
MD5
82ba4743722a3621169dd7a3a67a3413
-
SHA1
3d5ccc769f9e2a9204fe9e5e349ad67f28613ec4
-
SHA256
f5d566a3c303e7c21c4c3ce40591befc2695c32dd4b26e99dd4116ba66840677
-
SHA512
d9ba7c82129ac5f448bbb154f323e4d34ea6fe4ac56352d08aa1b627cf1aaf552fd44eaded9a31d17e487a26002d29a84ad2a8db182cc54fc63f612af556c5c5
-
SSDEEP
6144:IoyZmTAsfJFakxaLjcMkc0Cax1PXGp6bYA0w601+dNT9/0626ASkVOAFl6IZBBRR:IoyIJsMPrPWp6bYboEdNK6IZB1LT
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 31 IoCs
Processes:
resource yara_rule behavioral1/memory/3008-2-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-4-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-5-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-7-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-6-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-29-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-11-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-8-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-15-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-16-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-33-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-34-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-35-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-36-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-37-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-39-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-40-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-41-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-44-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-45-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-52-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-54-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-56-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-60-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-64-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-66-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-67-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-69-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-71-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-74-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3008-75-0x0000000001F00000-0x0000000002FBA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 31 IoCs
Processes:
resource yara_rule behavioral1/memory/3008-2-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-4-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-5-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-7-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-6-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-29-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-11-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-8-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-15-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-16-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-33-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-34-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-35-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-36-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-37-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-39-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-40-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-41-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-44-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-45-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-52-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-54-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-56-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-60-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-64-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-66-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-67-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-69-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-71-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-74-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX behavioral1/memory/3008-75-0x0000000001F00000-0x0000000002FBA000-memory.dmp UPX -
Processes:
resource yara_rule behavioral1/memory/3008-2-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-4-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-5-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-7-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-6-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-29-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-11-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-8-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-15-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-16-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-33-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-34-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-35-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-36-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-37-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-39-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-40-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-41-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-44-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-45-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-52-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-54-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-56-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-60-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-64-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-66-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-67-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-69-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-71-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-74-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx behavioral1/memory/3008-75-0x0000000001F00000-0x0000000002FBA000-memory.dmp upx -
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription ioc process File opened (read-only) \??\J: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\L: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\U: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\Z: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\I: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\S: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\V: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\W: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\X: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\H: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\M: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\O: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\Q: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\R: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\T: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\E: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\K: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\N: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\P: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\Y: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\G: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription ioc process File opened for modification C:\autorun.inf 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened for modification F:\autorun.inf 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Drops file in Program Files directory 5 IoCs
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Drops file in Windows directory 6 IoCs
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File created C:\Windows\Microsoft Terminal Services\f76c82f 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File created C:\Windows\Microsoft Windows Network\f76fc49 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File created C:\Windows\WORKGROUP\f770944 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File created C:\Windows\Web Client Network\f77e1a8 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File created C:\Windows\f762d19 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exepid process 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription pid process Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exepid process 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription pid process target process PID 3008 wrote to memory of 1128 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe taskhost.exe PID 3008 wrote to memory of 1172 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Dwm.exe PID 3008 wrote to memory of 1204 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Explorer.EXE PID 3008 wrote to memory of 2248 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe DllHost.exe PID 3008 wrote to memory of 1128 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe taskhost.exe PID 3008 wrote to memory of 1172 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Dwm.exe PID 3008 wrote to memory of 1204 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Explorer.EXE PID 3008 wrote to memory of 1128 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe taskhost.exe PID 3008 wrote to memory of 1172 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Dwm.exe PID 3008 wrote to memory of 1204 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Explorer.EXE PID 3008 wrote to memory of 1128 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe taskhost.exe PID 3008 wrote to memory of 1172 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Dwm.exe PID 3008 wrote to memory of 1204 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Explorer.EXE PID 3008 wrote to memory of 1128 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe taskhost.exe PID 3008 wrote to memory of 1172 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Dwm.exe PID 3008 wrote to memory of 1204 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Explorer.EXE PID 3008 wrote to memory of 1128 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe taskhost.exe PID 3008 wrote to memory of 1172 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Dwm.exe PID 3008 wrote to memory of 1204 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Explorer.EXE PID 3008 wrote to memory of 1128 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe taskhost.exe PID 3008 wrote to memory of 1172 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Dwm.exe PID 3008 wrote to memory of 1204 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Explorer.EXE PID 3008 wrote to memory of 1128 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe taskhost.exe PID 3008 wrote to memory of 1172 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Dwm.exe PID 3008 wrote to memory of 1204 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Explorer.EXE PID 3008 wrote to memory of 1128 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe taskhost.exe PID 3008 wrote to memory of 1172 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Dwm.exe PID 3008 wrote to memory of 1204 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Explorer.EXE PID 3008 wrote to memory of 1128 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe taskhost.exe PID 3008 wrote to memory of 1172 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Dwm.exe PID 3008 wrote to memory of 1204 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Explorer.EXE PID 3008 wrote to memory of 1128 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe taskhost.exe PID 3008 wrote to memory of 1172 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Dwm.exe PID 3008 wrote to memory of 1204 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Explorer.EXE PID 3008 wrote to memory of 1128 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe taskhost.exe PID 3008 wrote to memory of 1172 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Dwm.exe PID 3008 wrote to memory of 1204 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Explorer.EXE PID 3008 wrote to memory of 1128 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe taskhost.exe PID 3008 wrote to memory of 1172 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Dwm.exe PID 3008 wrote to memory of 1204 3008 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Explorer.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1128
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3008
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2248
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD58c39f3df6dcf2f33071e7c846ef0ab63
SHA15e1828500db549b4c4d3e0900dd35b85e2ea068b
SHA256b8371d1365c9478228bbaacf0023ff658e8231bd9bea17ffd483649c8aa8b77b
SHA51278998c71ca01a633548b3b4f34f7dce1892e71bee882d69546c4a03b2d0883808a0fadf106ad1b8a64b8fecd92d359bc3d0dc5843777488570ecea66878ad520