Analysis
-
max time kernel
157s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
22-05-2024 21:25
General
-
Target
2024-05-22_02f1d1a290d28cdfd1da597722aa0d5c_bkransomware.exe
-
Size
712KB
-
MD5
02f1d1a290d28cdfd1da597722aa0d5c
-
SHA1
6fbe442a85e254a2a2075295c952dd94a0ee28d3
-
SHA256
705c69bb628dcfea6af054fc7ff266c57f45bd063289572b6ad23ee5bfacae4f
-
SHA512
d3f70762c454d8d11a509a7ce538f25a5cdd8caff150a7f178a4ab914477cbaf15277165d5525460762ff1f298cd4eff8850b855ccb5e1e6e94dec8111789505
-
SSDEEP
12288:BtOw6BaYoH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:z6Bw2JOt934J7Z6bQaj1BvUm9J
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_02f1d1a290d28cdfd1da597722aa0d5c_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_02f1d1a290d28cdfd1da597722aa0d5c_bkransomware.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 8962⤵
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1400 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD51f7a1f56671c9c00ec3f8ecec04e8ddf
SHA14167476f06449631ea80dd61740e37004374c055
SHA2563fc7d404404e4b14cef40350931069576d4ea8c9c83749192b1869a0bc02b94c
SHA51270c881e83c127d99e900172f818e29d0b145869670ee4769cc8e6d6b7cc3ec15124708ca4fd7f5f6d80afea0985a8fcac7fe2643c7ab1fa63116a2b42831d95d
-
Filesize
781KB
MD580109ed5a90263272f7140328c47b340
SHA1ed0c5cecdc87e3330b3d74c0268e504ec748e9c2
SHA256ea983744815f10a5c2d73f519b440089403f973d7c2b84e3a9dffb62c09311cd
SHA512ade155d59974cc11e0c87f3daa77d990e9bc6ba2268850f39391697eb932338df669e125686b989cdf1a41a1fdeb089c951be444a375e244ff7b5aa11fcb7e6c
-
Filesize
805KB
MD50ebd4e32327fc736c4878e33de50d994
SHA1fda96b6c99f95d724328ad7af5842a48fdcfaa42
SHA25614f6a62b497691bfcb787b3cf7951681c0ca3be390fa8ec8be6e6b3c33ca53a2
SHA512cc44d24a87847bbd3487dba40612d42535412307d94dfb1b2b14d349fa3152c6e1d8f1a9c07003f5c223ff0b1654146e2f1b53c4bbc4ab72294c05aa6020e4ce
-
Filesize
2.1MB
MD5693d1716fcfdb0f04175c88b1f6d0d89
SHA190c9a4d92755629515f80c26e9ee3b946d062c71
SHA2561a45db32d35dcba49a9c13c87c47cdee243797c8f3a116cbd56023d5403088e8
SHA512bd47523247eb69fe27fb4cac39c177bcf970d94687ee42f995246d099b87f6519fb09ae2051ccc127c064c79808ea951885d67d36ec613260da4f45fe212f061
-
Filesize
588KB
MD5fd44469a33ef6a7bc64e421835985eb0
SHA1ea92cf9f76a141ee24e5353819d000848e06b9aa
SHA256845438e35d8b3a68b86c964bab321e369a6633723672b06f5aaf38f6d82ee739
SHA512ea8c5720f03e4b56cfcde216f315efa66b496a697a46e60b13490704972e1973ba3b9f0c85dd50df089bc0fb3e88d6869549030665e2f31422a31ac338cea4be
-
Filesize
1.7MB
MD5711a4676dd6b42f881d389861d07f6bb
SHA12d7b6956451324db9f578ec965fc42cc7c7c0cfe
SHA2566aea69a8d5861871a402a1619c1190ebbf8255f5e26d8e3307eb9ee287c093bb
SHA512646634116bbc2d51b1d739b53a25d3492b8847025c51b4c404422724c9093500aa3e7bad072d3f0da315457353243f6059a3c6bc3ad099f0524ad2f4efdcb3ce
-
Filesize
659KB
MD55685ecec8341ecb2dcc5a2d4dc113119
SHA11a7a405667a04246eb59380b4700a9d5f388bfb6
SHA2562abd9d1be7d8b333bd7268ca92cd9cf77de3412d7765d40abbf1e3fdb6707d29
SHA512a552690db7eb5624b9553c1347fb3778f071d247327499254a107828289dcde8f8dd068e09bc3b61b27aa05bad63d43a95c690a8f9eeceb40b576b5d2c25138c
-
Filesize
1.2MB
MD5795b60cd25b1d68e86907bb67dfdebe0
SHA17b20ae9256a63fd08e1107fbf6075cc612449719
SHA256816bbb7e17fdec07ab7c886f6ab27e45d3f8497e080ddd78366c356f02d70844
SHA512cbb0e9e2f85f7ec899fd87c354e078fce77b1a508b052a294bfc74935dc99689bd9154d33056fd1bf1d890f69227d7ae016fed68d210863bc0ed9e7a72880b0b
-
Filesize
578KB
MD570bcee26a5ad221d1bcb72addadd622b
SHA17f937ace085352c58e26287c5b041410546ee0f3
SHA25648a5564004c1a5ba54a35a2c8db22d10c7191140318916103787a154abc63e72
SHA51219ecb121afde38fa8d8bf43814f71b3d732d48cb97b8c38210b99b5c81d3be3b596b4ab4243365ac93b3d4ede6465ec1f3b39e1d5dc41e08a703de4620dc3bb8
-
Filesize
940KB
MD5ffaf4690552ec880b9a795b6a897ce06
SHA1954fefddbeee7e8798ca9f997988afb9d0dfdc89
SHA25626070e0606665129ee1097c7d35a37a398fa87099c34b9a5e9aaae13439ae701
SHA5123e90ec92b43d2cee00289a632253b54d84ff521f6dfac7ed0c32653472cf2ac53d307878f7861669c900e2e1623d1fe42631235908abd33ec22f8edf476ff060
-
Filesize
671KB
MD5acd9d1ed0fb16e1e919a41e9eab18e11
SHA1bbfed54f8dc09c243de979fbb8952d682ef9d00d
SHA25632d7ce1d5a13854227b9ae6569779b79ef719de7cb3d19ab9f3d71661ccb7115
SHA51233f02e9d26aaac120a0377654517ea07c623d3afde29b4c68cfa1671cc4ee0a6572791195f5a115698c28d77b13cb7749719d8d5a88dcf5e85b61ecb415f69a4
-
Filesize
1.4MB
MD5eef64b369264b43937d59c230dc52dfa
SHA1faa833cdfad298f43b1a89289e6e9c9f02646b9d
SHA256785b75282eedf5b80948057a8d9fd9365e29dedf5577c0906dbe1b0932a7e346
SHA5125578a6cb9769a40c794446c6c8b6ba249490f755e2b819814f4d22aa33a720f66ec555c07b9e54db83b07f1ca62e33173a8bc50dd54b0dbd7070a0d775e0a8a6
-
Filesize
1.8MB
MD5e6d777d07fe43da694f7251c2b52420f
SHA1acadaaf6f2c9dcb149e4483eced3467d18fa9430
SHA256b251ea9fe0e01a513fd49932d702f31df6acec77e23e6e60c763caf6bf3b9078
SHA5124d2e647e88100876c36d8975a7e69b6709b0daa085cac2db203515c40ef313fde7f5b17a1e375faee4fe166bf4b5ee9c7324e8480a3d4b85bcae9043e48a54b3
-
Filesize
1.4MB
MD5bf8830b72b01cad42e582cd34511c20f
SHA1de1739a05733da2dfcddf3771cee7a1f3774fd60
SHA256682b4817ba179a51bbf742fb0d1326a59d7530138164e0d40908a1f54b2a2e53
SHA5127039699f74a193a0d2f271f335d45ad6aec3d148f168a69b310bd953fddce234d6cebbafdd1514b224ba2890aa188c2538f4b8aac916f38b392b42aed5d390b6
-
Filesize
885KB
MD57d4d81098ed0f947345b149aa3127b8d
SHA178ac11ccf96713a06f1529f289b1fc864cccc16a
SHA256d65850e8df0732079565afb25a1dcf51ee6d38375f2ea448fdd8a37077dca684
SHA512bf66eb660879ba50e8c4c3c1727a87543ae1b241e8bc3dc4ff62690ae67f6a697d479750f2b11493410646fe1f2a4923dedcf5b96d268fa9f32a020846037344
-
Filesize
2.0MB
MD5871d75d2bd7a69475fc8b8a3700a836b
SHA18ee376db86f4973a05b8693a5177367224cc01b4
SHA256f1c6c2d21e8994bfde7b228f0f64aece0e343e011cf0e1c17e1a75ae86e9a162
SHA512c6cabee2c068481e9fadf73cb89fec7f36a3f2d09bd07425f9a5c4f92d048d7d8990045c4cbfe394488f068274fee3111d7f1bee1ee764826a0b2716982b63ba
-
Filesize
661KB
MD532f77b15c6b79d249d28624b995eefae
SHA1bef966833487f93335ad4b34905aca340e5b01ff
SHA25622b5cb3a67fcdf0ce0c47fe95636385d98b1a1390896de20a25efaeeb3c3f3e8
SHA51285e2777b43595c655e2ae4b5d48d8d4b73f22ebea94d8b8467f4854fed9bf4f2be52e52c8e9105daf4871ce8845a93186d6ed9ebac22c4767da7f11693440eb1
-
Filesize
712KB
MD51a175ae2b0c58892f414bac8f6a05f7d
SHA113e5910e62cc54d88514e7ae40519e0fbf711a7d
SHA2563bcbcf6024255a158bc3d86d570b98ae82785bd95fc044a524003f2889143769
SHA5128f3bc5d0035af174a29fb89c600dfb5df969a71f899e96168543033e92758dce22818c1a0c959eb9b1944c466b17ac145334b3f3b81695104069d3a5ad94ef8a
-
Filesize
584KB
MD58bec7c9be3aaea1d295909ed3360a6e6
SHA16e0233e0285a122fbe1986b4370181a09c1388ec
SHA2567e8c094bfcd87115cbfbb9fce2e590cdeaa8271d146c38460cc892748f751ef8
SHA512431403b4333a6d37913c5d2b955948298c63865e1b1e68fd64964da078685d907e026b8b24e291de03a85133db1ba2f38b7877ff2da2f88079c07f3c793815f2
-
Filesize
1.3MB
MD5f258e7180363b4aa7a4de99e9b86a41b
SHA1632c367b72576692cc8e65de7d5203661d2476f9
SHA2563df929f3fa9d8cfa3ebe8068dba99107df209cc2e89fcd81d3f82b8f150d9ad9
SHA512eac62dffe6d622910f140803255de17a6303129e69809b456befcbb42c5b74cfa1ad8e7ebc87edda19aaf091b9a15ec3673c0dd9b9198b62849475ced1119585
-
Filesize
772KB
MD5475c72762a9f4681ff45ff3c68c90d3c
SHA11650a731d6c15837b65f75d1230d1ccb52ec06b6
SHA256688e9540ba99740dbf57411f278a057a93b233ecfc96f4565f28373016d6db27
SHA512be8bc7a1794543937f2b27b9a4d709527da9c70d97c46789476356889b6be34de974550665d770f2d6a498718d69aa8e26fccafcffbefceb3c36b7e891895641
-
Filesize
2.1MB
MD511cc823f82e7c82e59850d2269bed25f
SHA1bfade1e60f516e3b698485499b1fb76ba956e2d0
SHA25696e4b4ad1fedb9dbbbb964cfc71e94020ca046070dedd489aee64466756bb44a
SHA512572ff1776ba07d9a1c4113a8279c368ce083b542e5cb50b51cd26a339822a05ceec28a6eea00389e2f5704ae3a760c4ae62dae7400f38568cf7f8516a6a6393b
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
740KB
-
Filesize
384KB
-
Filesize
740KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.5MB
-
Filesize
412KB
-
Filesize
1.5MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
680KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
680KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
600KB
-
Filesize
600KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
2.0MB
-
Filesize
2.0MB