Analysis
-
max time kernel
132s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 03:27
General
-
Target
2024-05-23_1f38c1928312b4aa7900fdf58e75c41b_bkransomware.exe
-
Size
71KB
-
MD5
1f38c1928312b4aa7900fdf58e75c41b
-
SHA1
c3dac5f45a882b3e81e01bf94c3a2dd47ff75585
-
SHA256
a7e584ccf13f597301dfbbb7c3c592c94d1fb1b607e1907771b4592eb5dfe5b6
-
SHA512
e5fb4d641b116e387b51fcd6119ee455b111ff06681ee669556e6536267174e368a016499b2d13170ecabdc56b59bd824ed95375476b75532f205ddf2619421f
-
SSDEEP
1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazT8:ZRpAyazIliazT8
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_1f38c1928312b4aa7900fdf58e75c41b_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_1f38c1928312b4aa7900fdf58e75c41b_bkransomware.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
394KB
MD57d7fe99725edb0c70269ac5f53bafe79
SHA1477d35df97985408d0f6fc991fce3c4487e70ca1
SHA2564ea358c4656de322627d60e4bb8be66125473fc0a5176ac7bf1ddca4fc90ece6
SHA512e84ee09aab848cf419aba57a489fe69a68ba52e59d555e71ff811f1599752c380739fb77bd07ef204c34ab79ea530407d9a60a1d1f609ca363980af2a2314e5e
-
Filesize
71KB
MD522b1eadd65cdbc8e7d491843db7fba4d
SHA1ba012c74a8b59178582e3cbb5299889710fbcc27
SHA2569ca76db8654ffc790f0a85180dddec9c3bc13c02ad90cf5f86a2089ede643044
SHA5127833740a4ca577ee90eea476e9a2807f4636f03fe148170000e4aa71c6a17eb3727f4004af8afef7e503017f09000e20fe78a53aac4515b9fd36db964f7af251
-
Filesize
71KB
MD5f9d4ab0a726adc9b5e4b7d7b724912f1
SHA13d42ca2098475924f70ee4a831c4f003b4682328
SHA256b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc
SHA51222a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432