Analysis
-
max time kernel
128s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 13:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe
Resource
win7-20240221-en
General
-
Target
2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe
-
Size
525KB
-
MD5
a6e1e52c6ba49a3fc97508c84e51a435
-
SHA1
4142dfa81ca4c99b6f634cd30247b646c2ceeb6e
-
SHA256
069bd683d48e239fea7f0cb0d3d5c1d42c253debdceb5da029fba31b9036ff69
-
SHA512
d7f4f018c63ae68b0901cbd43ec9d0bb7b03a7c2396d59926b83ded8b233734fb44476c09c21bf3f17b6cd076e434b0e96f3a3a5adfbaf3503163acae62508fe
-
SSDEEP
6144:iYrIOXsqmWzJrdc6GJRQUXGUA9PRWLiFSbE56FORF5Y1RR8bf8HN:y2lWRPXhA9PRWg9pCKUHN
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe -
Processes:
2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe -
Processes:
2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 40 IoCs
Processes:
resource yara_rule behavioral2/memory/4616-1-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-4-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-12-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-11-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-10-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-8-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-7-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-6-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-5-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-3-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-21-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-22-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-23-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-24-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-25-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-27-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-28-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-29-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-31-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-34-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-37-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-38-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-41-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-43-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-45-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-47-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-49-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-51-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-53-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-54-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-60-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-62-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-64-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-65-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-66-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-69-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-70-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-72-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-74-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4616-79-0x0000000002360000-0x000000000341A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 40 IoCs
Processes:
resource yara_rule behavioral2/memory/4616-1-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-4-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-12-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-11-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-10-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-8-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-7-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-6-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-5-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-3-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-21-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-22-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-23-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-24-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-25-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-27-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-28-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-29-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-31-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-34-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-37-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-38-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-41-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-43-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-45-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-47-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-49-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-51-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-53-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-54-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-60-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-62-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-64-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-65-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-66-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-69-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-70-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-72-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-74-0x0000000002360000-0x000000000341A000-memory.dmp UPX behavioral2/memory/4616-79-0x0000000002360000-0x000000000341A000-memory.dmp UPX -
Executes dropped EXE 1 IoCs
Processes:
msedge.exepid process 2880 msedge.exe -
Processes:
resource yara_rule behavioral2/memory/4616-1-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-4-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-12-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-11-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-10-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-8-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-7-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-6-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-5-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-3-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-21-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-22-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-23-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-24-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-25-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-27-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-28-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-29-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-31-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-34-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-37-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-38-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-41-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-43-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-45-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-47-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-49-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-51-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-53-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-54-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-60-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-62-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-64-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-65-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-66-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-69-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-70-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-72-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-74-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/4616-79-0x0000000002360000-0x000000000341A000-memory.dmp upx -
Processes:
2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe -
Processes:
2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exedescription ioc process File opened (read-only) \??\U: 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened (read-only) \??\W: 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened (read-only) \??\X: 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened (read-only) \??\E: 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened (read-only) \??\H: 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened (read-only) \??\M: 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened (read-only) \??\N: 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened (read-only) \??\J: 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened (read-only) \??\P: 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened (read-only) \??\V: 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened (read-only) \??\Y: 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened (read-only) \??\Q: 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened (read-only) \??\R: 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened (read-only) \??\T: 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened (read-only) \??\G: 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened (read-only) \??\I: 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened (read-only) \??\L: 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened (read-only) \??\O: 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened (read-only) \??\K: 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened (read-only) \??\S: 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened (read-only) \??\Z: 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exedescription ioc process File opened for modification C:\autorun.inf 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened for modification F:\autorun.inf 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe -
Drops file in Program Files directory 12 IoCs
Processes:
2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exedescription ioc process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe -
Drops file in Windows directory 5 IoCs
Processes:
2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exedescription ioc process File created C:\Windows\e580395 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File opened for modification C:\Windows\SYSTEM.INI 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File created C:\Windows\Microsoft Terminal Services\e58aa54 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File created C:\Windows\Microsoft Windows Network\e58de84 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe File created C:\Windows\Web Client Network\e592224 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exepid process 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exedescription pid process Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Token: SeDebugPrivilege 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exepid process 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exedescription pid process target process PID 4616 wrote to memory of 772 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe fontdrvhost.exe PID 4616 wrote to memory of 780 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe fontdrvhost.exe PID 4616 wrote to memory of 1000 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe dwm.exe PID 4616 wrote to memory of 2528 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe sihost.exe PID 4616 wrote to memory of 2548 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe svchost.exe PID 4616 wrote to memory of 2816 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe taskhostw.exe PID 4616 wrote to memory of 3360 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Explorer.EXE PID 4616 wrote to memory of 3536 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe svchost.exe PID 4616 wrote to memory of 3716 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe DllHost.exe PID 4616 wrote to memory of 3856 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe StartMenuExperienceHost.exe PID 4616 wrote to memory of 3936 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe RuntimeBroker.exe PID 4616 wrote to memory of 4048 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe SearchApp.exe PID 4616 wrote to memory of 4116 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe RuntimeBroker.exe PID 4616 wrote to memory of 4504 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe RuntimeBroker.exe PID 4616 wrote to memory of 4488 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe TextInputHost.exe PID 4616 wrote to memory of 2652 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe msedge.exe PID 4616 wrote to memory of 4648 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe msedge.exe PID 4616 wrote to memory of 3420 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe msedge.exe PID 4616 wrote to memory of 2840 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe msedge.exe PID 4616 wrote to memory of 728 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe msedge.exe PID 4616 wrote to memory of 1864 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe msedge.exe PID 4616 wrote to memory of 4548 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe msedge.exe PID 4616 wrote to memory of 772 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe fontdrvhost.exe PID 4616 wrote to memory of 780 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe fontdrvhost.exe PID 4616 wrote to memory of 1000 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe dwm.exe PID 4616 wrote to memory of 2528 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe sihost.exe PID 4616 wrote to memory of 2548 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe svchost.exe PID 4616 wrote to memory of 2816 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe taskhostw.exe PID 4616 wrote to memory of 3360 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Explorer.EXE PID 4616 wrote to memory of 3536 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe svchost.exe PID 4616 wrote to memory of 3716 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe DllHost.exe PID 4616 wrote to memory of 3856 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe StartMenuExperienceHost.exe PID 4616 wrote to memory of 3936 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe RuntimeBroker.exe PID 4616 wrote to memory of 4048 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe SearchApp.exe PID 4616 wrote to memory of 4116 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe RuntimeBroker.exe PID 4616 wrote to memory of 4504 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe RuntimeBroker.exe PID 4616 wrote to memory of 4488 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe TextInputHost.exe PID 4616 wrote to memory of 2652 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe msedge.exe PID 4616 wrote to memory of 4648 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe msedge.exe PID 4616 wrote to memory of 3420 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe msedge.exe PID 4616 wrote to memory of 2840 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe msedge.exe PID 4616 wrote to memory of 728 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe msedge.exe PID 4616 wrote to memory of 1864 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe msedge.exe PID 4616 wrote to memory of 4548 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe msedge.exe PID 4616 wrote to memory of 772 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe fontdrvhost.exe PID 4616 wrote to memory of 780 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe fontdrvhost.exe PID 4616 wrote to memory of 1000 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe dwm.exe PID 4616 wrote to memory of 2528 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe sihost.exe PID 4616 wrote to memory of 2548 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe svchost.exe PID 4616 wrote to memory of 2816 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe taskhostw.exe PID 4616 wrote to memory of 3360 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe Explorer.EXE PID 4616 wrote to memory of 3536 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe svchost.exe PID 4616 wrote to memory of 3716 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe DllHost.exe PID 4616 wrote to memory of 3856 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe StartMenuExperienceHost.exe PID 4616 wrote to memory of 3936 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe RuntimeBroker.exe PID 4616 wrote to memory of 4048 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe SearchApp.exe PID 4616 wrote to memory of 4116 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe RuntimeBroker.exe PID 4616 wrote to memory of 4504 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe RuntimeBroker.exe PID 4616 wrote to memory of 4488 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe TextInputHost.exe PID 4616 wrote to memory of 2652 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe msedge.exe PID 4616 wrote to memory of 4648 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe msedge.exe PID 4616 wrote to memory of 3420 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe msedge.exe PID 4616 wrote to memory of 2840 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe msedge.exe PID 4616 wrote to memory of 728 4616 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe msedge.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-19_a6e1e52c6ba49a3fc97508c84e51a435_bkransomware.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffae3442e98,0x7ffae3442ea4,0x7ffae3442eb02⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2248 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2176 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:32⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3464 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5320 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5408 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:82⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFilesize
3.9MB
MD5faf79a48399d502194e87a5ad1ba7b8e
SHA109cd9d783ac126d33ec37de781beedce9ce6aa51
SHA2563d1266025af95bdb7b92d17debbf88a1386b19b7f7c2eeb9ced77debb9748e14
SHA512d84f8e25179e2cee6f95dc95c94a4a70dc56814aaf7f95e38f24f9828e64629cab0c184f5fddd67d834f419703f65d9d0e3a93e54d2730ed63d3d89644babb84
-
F:\idtyf.exeFilesize
97KB
MD5c13fb97c6aac1f0699d195b6bb2b8b62
SHA168c34c0d36186a91310414645ddc873a852423f4
SHA256cea5f35c842d943571a44205458a3353ed36b3d0fad79f372b48ae2da97c2e0e
SHA512dc3fe9834144b39cb39fe8c0bff0ea12281f7a11199c4fc90228f402021724cc32b85eb65f7be5edd85378df7a3d098ce1b19b20e9e3091b9e044c11fa813c02
-
memory/4616-34-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-1-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-12-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-11-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-10-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-8-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-20-0x00000000046C0000-0x00000000046C2000-memory.dmpFilesize
8KB
-
memory/4616-19-0x00000000046C0000-0x00000000046C2000-memory.dmpFilesize
8KB
-
memory/4616-7-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-6-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-5-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-3-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-18-0x0000000004810000-0x0000000004811000-memory.dmpFilesize
4KB
-
memory/4616-21-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-22-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-23-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-0-0x0000000000400000-0x0000000000489000-memory.dmpFilesize
548KB
-
memory/4616-25-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-27-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-28-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-29-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-31-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-38-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-17-0x00000000046C0000-0x00000000046C2000-memory.dmpFilesize
8KB
-
memory/4616-24-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-41-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-43-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-45-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-47-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-49-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-51-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-53-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-54-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-60-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-62-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-64-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-65-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-66-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-69-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-70-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-72-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-74-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-79-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-4-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-37-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/4616-89-0x00000000046C0000-0x00000000046C2000-memory.dmpFilesize
8KB