Overview

overview

7

Static

static

3

2024-05-24...re.exe

windows7-x64

7

2024-05-24...re.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    24-05-2024 22:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe

  • Size

    1.8MB

  • MD5

    d66a417b4ae966f5e3a6eb01b54f8d77

  • SHA1

    7991a55a59ea8e1b6eb1b1644b79db50aa92d712

  • SHA256

    231d8a8a4c9b3442be45aebc329948a106b1be9318e89313063403314f4b5fd5

  • SHA512

    6db07e6cf2286c7d68bc7dfcd3e634fd26c25efe72daa5e43a5775f4c596ac1b5c1051e6778172d1eea0fb7bb8fa93fc56c5f36676cd6e8b1487c1a68514e472

  • SSDEEP

    24576:R2lmA4RSgPvod50p/TXM2s0espsODZjB0IP:R2MA4RS0vo05s0eusONlP

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2180
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:2672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\System32\alg.exe
    Filesize

    1.5MB

    MD5

    d82f1e67d7ab31e7f362416e72c6f812

    SHA1

    1a8c3bef5bbee467badc68dc02a0a40b0c96e604

    SHA256

    75c97ec7fb4c1e6d1088ee3d2db96191de59421972a69d39f570660c745336db

    SHA512

    a396caa185a0d94a290c77cf35be2ebc903ef79b0bd23c129509bfd8070d0ebd7b4b48d4219b955669f34d08090999acf65e7cc72c2bbf4aa8f89d3505019c70

    Download Submit
  • memory/2180-7-0x00000000005E0000-0x0000000000646000-memory.dmp
    Filesize

    408KB

    Download
  • memory/2180-6-0x00000000005E0000-0x0000000000646000-memory.dmp
    Filesize

    408KB

    Download
  • memory/2180-5-0x0000000000400000-0x00000000005DB000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/2180-0-0x00000000005E0000-0x0000000000646000-memory.dmp
    Filesize

    408KB

    Download
  • memory/2180-13-0x0000000000400000-0x00000000005DB000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/2672-16-0x0000000100000000-0x0000000100179000-memory.dmp
    Filesize

    1.5MB

    Download
  • memory/2672-17-0x0000000100000000-0x0000000100179000-memory.dmp
    Filesize

    1.5MB

    Download