Analysis
-
max time kernel
124s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 21:10
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe
Resource
win7-20240508-en
General
-
Target
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe
-
Size
524KB
-
MD5
82ba4743722a3621169dd7a3a67a3413
-
SHA1
3d5ccc769f9e2a9204fe9e5e349ad67f28613ec4
-
SHA256
f5d566a3c303e7c21c4c3ce40591befc2695c32dd4b26e99dd4116ba66840677
-
SHA512
d9ba7c82129ac5f448bbb154f323e4d34ea6fe4ac56352d08aa1b627cf1aaf552fd44eaded9a31d17e487a26002d29a84ad2a8db182cc54fc63f612af556c5c5
-
SSDEEP
6144:IoyZmTAsfJFakxaLjcMkc0Cax1PXGp6bYA0w601+dNT9/0626ASkVOAFl6IZBBRR:IoyIJsMPrPWp6bYboEdNK6IZB1LT
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 42 IoCs
Processes:
resource yara_rule behavioral2/memory/744-1-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-6-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-16-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-5-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-4-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-3-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-15-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-7-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-20-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-19-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-21-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-22-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-23-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-24-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-26-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-25-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-29-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-30-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-32-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-34-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-36-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-37-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-39-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-42-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-43-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-45-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-47-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-48-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-49-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-50-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-51-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-57-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-59-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-61-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-63-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-65-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-67-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-70-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-71-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-73-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-76-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/744-77-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 42 IoCs
Processes:
resource yara_rule behavioral2/memory/744-1-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-6-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-16-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-5-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-4-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-3-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-15-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-7-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-20-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-19-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-21-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-22-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-23-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-24-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-26-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-25-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-29-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-30-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-32-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-34-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-36-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-37-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-39-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-42-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-43-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-45-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-47-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-48-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-49-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-50-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-51-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-57-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-59-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-61-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-63-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-65-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-67-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-70-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-71-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-73-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-76-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/744-77-0x0000000002360000-0x000000000341A000-memory.dmp UPX -
Processes:
resource yara_rule behavioral2/memory/744-1-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-6-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-16-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-5-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-4-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-3-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-15-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-7-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-20-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-19-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-21-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-22-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-23-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-24-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-26-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-25-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-29-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-30-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-32-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-34-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-36-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-37-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-39-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-42-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-43-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-45-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-47-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-48-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-49-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-50-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-51-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-57-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-59-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-61-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-63-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-65-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-67-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-70-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-71-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-73-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-76-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/744-77-0x0000000002360000-0x000000000341A000-memory.dmp upx -
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription ioc process File opened (read-only) \??\H: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\N: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\R: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\W: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\G: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\M: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\P: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\Q: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\U: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\V: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\E: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\J: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\K: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\L: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\O: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\X: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\Y: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\Z: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\I: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\S: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened (read-only) \??\T: 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription ioc process File opened for modification C:\autorun.inf 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened for modification F:\autorun.inf 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Drops file in Program Files directory 12 IoCs
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7zFM.exe 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Drops file in Windows directory 5 IoCs
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription ioc process File created C:\Windows\e573bd0 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File opened for modification C:\Windows\SYSTEM.INI 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File created C:\Windows\Microsoft Terminal Services\e57f01d 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File created C:\Windows\Microsoft Windows Network\e58244c 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe File created C:\Windows\Web Client Network\e5867ec 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exepid process 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription pid process Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Token: SeDebugPrivilege 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exepid process 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription pid process target process PID 744 wrote to memory of 784 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe fontdrvhost.exe PID 744 wrote to memory of 788 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe fontdrvhost.exe PID 744 wrote to memory of 336 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe dwm.exe PID 744 wrote to memory of 2636 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe svchost.exe PID 744 wrote to memory of 2648 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe sihost.exe PID 744 wrote to memory of 2784 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe taskhostw.exe PID 744 wrote to memory of 3428 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Explorer.EXE PID 744 wrote to memory of 3560 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe svchost.exe PID 744 wrote to memory of 3756 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe DllHost.exe PID 744 wrote to memory of 3844 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe StartMenuExperienceHost.exe PID 744 wrote to memory of 3904 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe RuntimeBroker.exe PID 744 wrote to memory of 4004 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe SearchApp.exe PID 744 wrote to memory of 3788 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe RuntimeBroker.exe PID 744 wrote to memory of 1104 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe TextInputHost.exe PID 744 wrote to memory of 2976 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe RuntimeBroker.exe PID 744 wrote to memory of 5056 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe backgroundTaskHost.exe PID 744 wrote to memory of 2068 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe backgroundTaskHost.exe PID 744 wrote to memory of 784 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe fontdrvhost.exe PID 744 wrote to memory of 788 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe fontdrvhost.exe PID 744 wrote to memory of 336 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe dwm.exe PID 744 wrote to memory of 2636 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe svchost.exe PID 744 wrote to memory of 2648 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe sihost.exe PID 744 wrote to memory of 2784 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe taskhostw.exe PID 744 wrote to memory of 3428 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Explorer.EXE PID 744 wrote to memory of 3560 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe svchost.exe PID 744 wrote to memory of 3756 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe DllHost.exe PID 744 wrote to memory of 3844 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe StartMenuExperienceHost.exe PID 744 wrote to memory of 3904 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe RuntimeBroker.exe PID 744 wrote to memory of 4004 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe SearchApp.exe PID 744 wrote to memory of 3788 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe RuntimeBroker.exe PID 744 wrote to memory of 1104 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe TextInputHost.exe PID 744 wrote to memory of 2976 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe RuntimeBroker.exe PID 744 wrote to memory of 5056 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe backgroundTaskHost.exe PID 744 wrote to memory of 2068 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe backgroundTaskHost.exe PID 744 wrote to memory of 828 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe RuntimeBroker.exe PID 744 wrote to memory of 2716 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe RuntimeBroker.exe PID 744 wrote to memory of 3000 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe BackgroundTransferHost.exe PID 744 wrote to memory of 784 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe fontdrvhost.exe PID 744 wrote to memory of 788 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe fontdrvhost.exe PID 744 wrote to memory of 336 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe dwm.exe PID 744 wrote to memory of 2636 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe svchost.exe PID 744 wrote to memory of 2648 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe sihost.exe PID 744 wrote to memory of 2784 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe taskhostw.exe PID 744 wrote to memory of 3428 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Explorer.EXE PID 744 wrote to memory of 3560 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe svchost.exe PID 744 wrote to memory of 3756 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe DllHost.exe PID 744 wrote to memory of 3844 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe StartMenuExperienceHost.exe PID 744 wrote to memory of 3904 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe RuntimeBroker.exe PID 744 wrote to memory of 4004 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe SearchApp.exe PID 744 wrote to memory of 3788 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe RuntimeBroker.exe PID 744 wrote to memory of 1104 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe TextInputHost.exe PID 744 wrote to memory of 2976 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe RuntimeBroker.exe PID 744 wrote to memory of 5056 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe backgroundTaskHost.exe PID 744 wrote to memory of 828 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe RuntimeBroker.exe PID 744 wrote to memory of 2716 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe RuntimeBroker.exe PID 744 wrote to memory of 784 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe fontdrvhost.exe PID 744 wrote to memory of 788 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe fontdrvhost.exe PID 744 wrote to memory of 336 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe dwm.exe PID 744 wrote to memory of 2636 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe svchost.exe PID 744 wrote to memory of 2648 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe sihost.exe PID 744 wrote to memory of 2784 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe taskhostw.exe PID 744 wrote to memory of 3428 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe Explorer.EXE PID 744 wrote to memory of 3560 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe svchost.exe PID 744 wrote to memory of 3756 744 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe DllHost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:336
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2636
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2648
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2784
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-18_82ba4743722a3621169dd7a3a67a3413_bkransomware.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:744
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3560
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3756
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3844
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3904
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4004
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3788
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1104
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2976
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:5056
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2068
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:828
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2716
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:3000
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD50021eae91591233e7b8452c5b37603ef
SHA1efbe608d442987aacb74b80e7aa5f690bbb56ddf
SHA256a70e8897136d50c28161be4b178424f01164e157f05161e48b540f1cb64d8b6b
SHA512aee8ac2cd5469a4773d0272d2ab4d9bfa8e5743d4fb3b38e8095d0be4023cab4b15a61b633bc3d9c23afda82c0e1a45650621428bbc1c568302478f28dc5d0e7