Analysis
-
max time kernel
133s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 07:56
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_846e60356121f3fcafd95e331689505c_bkransomware.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-05-23_846e60356121f3fcafd95e331689505c_bkransomware.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-23_846e60356121f3fcafd95e331689505c_bkransomware.exe
-
Size
13.3MB
-
MD5
846e60356121f3fcafd95e331689505c
-
SHA1
2f3dbf73aa2c681a6b4234bcd1aad339850d99fc
-
SHA256
7e18de9647f5bad9a5c56e796e78718ce570aa66b9b0835ad63e5558cb1e6a9a
-
SHA512
65e322edb9483417c90745e1fd30ec3d93419508e4cdd8b43d21275303b0f682c1e40ba30d53681be16ec74d0ff297fb6768fd61994ecc37af98272a14395b4f
-
SSDEEP
393216:fJMSrvzSYmaa2lCNo25azDRIk89zDmlHj9iYx7zgc+N:qSDzSYjImEa3O/xuj9NfA
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
F3bFX0t7IeLzs43.exeCTS.exeF3bFX0t7IeLzs43.exepid process 4484 F3bFX0t7IeLzs43.exe 3004 CTS.exe 2972 F3bFX0t7IeLzs43.exe -
Loads dropped DLL 1 IoCs
Processes:
F3bFX0t7IeLzs43.exepid process 2972 F3bFX0t7IeLzs43.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
CTS.exe2024-05-23_846e60356121f3fcafd95e331689505c_bkransomware.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 2024-05-23_846e60356121f3fcafd95e331689505c_bkransomware.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 2 IoCs
Processes:
2024-05-23_846e60356121f3fcafd95e331689505c_bkransomware.exeCTS.exedescription ioc process File created C:\Windows\CTS.exe 2024-05-23_846e60356121f3fcafd95e331689505c_bkransomware.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2024-05-23_846e60356121f3fcafd95e331689505c_bkransomware.exeCTS.exedescription pid process Token: SeDebugPrivilege 3796 2024-05-23_846e60356121f3fcafd95e331689505c_bkransomware.exe Token: SeDebugPrivilege 3004 CTS.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2024-05-23_846e60356121f3fcafd95e331689505c_bkransomware.exeF3bFX0t7IeLzs43.exedescription pid process target process PID 3796 wrote to memory of 4484 3796 2024-05-23_846e60356121f3fcafd95e331689505c_bkransomware.exe F3bFX0t7IeLzs43.exe PID 3796 wrote to memory of 4484 3796 2024-05-23_846e60356121f3fcafd95e331689505c_bkransomware.exe F3bFX0t7IeLzs43.exe PID 3796 wrote to memory of 4484 3796 2024-05-23_846e60356121f3fcafd95e331689505c_bkransomware.exe F3bFX0t7IeLzs43.exe PID 3796 wrote to memory of 3004 3796 2024-05-23_846e60356121f3fcafd95e331689505c_bkransomware.exe CTS.exe PID 3796 wrote to memory of 3004 3796 2024-05-23_846e60356121f3fcafd95e331689505c_bkransomware.exe CTS.exe PID 3796 wrote to memory of 3004 3796 2024-05-23_846e60356121f3fcafd95e331689505c_bkransomware.exe CTS.exe PID 4484 wrote to memory of 2972 4484 F3bFX0t7IeLzs43.exe F3bFX0t7IeLzs43.exe PID 4484 wrote to memory of 2972 4484 F3bFX0t7IeLzs43.exe F3bFX0t7IeLzs43.exe PID 4484 wrote to memory of 2972 4484 F3bFX0t7IeLzs43.exe F3bFX0t7IeLzs43.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_846e60356121f3fcafd95e331689505c_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_846e60356121f3fcafd95e331689505c_bkransomware.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\F3bFX0t7IeLzs43.exeC:\Users\Admin\AppData\Local\Temp\F3bFX0t7IeLzs43.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\Temp\{AC49E8AF-B4B0-4627-B838-3CED8D728D31}\.cr\F3bFX0t7IeLzs43.exe"C:\Windows\Temp\{AC49E8AF-B4B0-4627-B838-3CED8D728D31}\.cr\F3bFX0t7IeLzs43.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\F3bFX0t7IeLzs43.exe" -burn.filehandle.attached=540 -burn.filehandle.self=5483⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xmlFilesize
392KB
MD5891673a0ce8463ed462826ceab7bd56a
SHA1cd2c72400420c627764fd4ebb79c66b12e5296fd
SHA256922f7e0a1179ae6ff3d6a7c7abcf8d6895147a9f5c5104e3a32560739c6d1a3c
SHA512a33de8e67c1ac87214aadb14e9097a2dc802f0453c2f1540ed94521350089bfbb1b7eb973b1204c2ec9ea57e1ed96f5e566907dfc5bb77620ac304934504f49b
-
C:\Users\Admin\AppData\Local\Temp\F3bFX0t7IeLzs43.exeFilesize
13.2MB
MD5ca8c521c30f57c0c199d526b9a23fc4a
SHA1663399541a7d3bb1b5ea0e57a00c024e50d8506c
SHA2568ae59d82845159db3a70763f5cb1571e45ebf6a1adfecc47574ba17b019483a0
SHA51228cf976fa51e4c7abb57fd8fcde6381f1e140407924ef265fde6e59546fb6fdeb803f388a5d1e9e74fb80d47ce5fd9f275aaf41258a09002fba27c2cbbc2df4d
-
C:\Windows\CTS.exeFilesize
71KB
MD566df4ffab62e674af2e75b163563fc0b
SHA1dec8a197312e41eeb3cfef01cb2a443f0205cd6e
SHA256075a6eecd8da1795532318f9cf880efe42461f9464d63f74deb271d33110f163
SHA5121588dd78e6e8972013c40cdb6acfb84c8df7b081197233ce621904b645356c805d0424bb93dd46c55834dc47d9ff39ee1323cf8e670841b3fff24ab98ba87f25
-
C:\Windows\Temp\{8855D97D-8CD2-404F-98CC-51C6814F69A9}\.ba\logo.pngFilesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
C:\Windows\Temp\{8855D97D-8CD2-404F-98CC-51C6814F69A9}\.ba\wixstdba.dllFilesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
C:\Windows\Temp\{AC49E8AF-B4B0-4627-B838-3CED8D728D31}\.cr\F3bFX0t7IeLzs43.exeFilesize
634KB
MD52389d29f633df11642dff1bf5f21eb35
SHA1ce85460fd7cde25528142f4cdca4e6013bb4b1e8
SHA256ab91fbaab09a94839ba839275338ac42fe2661781d371e517f9b2e4866e2cc55
SHA51259d607112566d13d15a8de8e18be204e8bf0d2010310ebc9c8589ceb42fb8fce7800a6e58f30ffb92d4c1b3e0d17c1a2076a478de753e5334971465c52f8eeed