Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 07:28
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_78974cff0bb93e59f13be0e144721cd5_bkransomware.exe
Resource
win7-20240215-en
General
-
Target
2024-05-23_78974cff0bb93e59f13be0e144721cd5_bkransomware.exe
-
Size
15.7MB
-
MD5
78974cff0bb93e59f13be0e144721cd5
-
SHA1
16bb5867be143503a743813ac1f1d4bacaa07b7e
-
SHA256
13538ed711a737fa7969c6a8babef2c424eca2e3514af4a99c2a3ca6b49ae9fe
-
SHA512
1b3c04142e9b2fbdf142bff8da80931b310a61072a269247712d36ec8d48db523170c9684c570a2161c26fb63ed4df0d25b0fa0a073212fc27df857a2792a504
-
SSDEEP
393216:guTr6T7nbNhsLcQAkpK+QupT4+7ZN03Jx3/:guTrWrbNCLcQAAKPaf05N
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
2024-05-23_78974cff0bb93e59f13be0e144721cd5_bkransomware.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2024-05-23_78974cff0bb93e59f13be0e144721cd5_bkransomware.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
2024-05-23_78974cff0bb93e59f13be0e144721cd5_bkransomware.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2024-05-23_78974cff0bb93e59f13be0e144721cd5_bkransomware.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2024-05-23_78974cff0bb93e59f13be0e144721cd5_bkransomware.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
2024-05-23_78974cff0bb93e59f13be0e144721cd5_bkransomware.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Wine 2024-05-23_78974cff0bb93e59f13be0e144721cd5_bkransomware.exe -
Processes:
2024-05-23_78974cff0bb93e59f13be0e144721cd5_bkransomware.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2024-05-23_78974cff0bb93e59f13be0e144721cd5_bkransomware.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_78974cff0bb93e59f13be0e144721cd5_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_78974cff0bb93e59f13be0e144721cd5_bkransomware.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled