Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 22:14
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe
Resource
win7-20240221-en
General
-
Target
2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe
-
Size
1.8MB
-
MD5
d66a417b4ae966f5e3a6eb01b54f8d77
-
SHA1
7991a55a59ea8e1b6eb1b1644b79db50aa92d712
-
SHA256
231d8a8a4c9b3442be45aebc329948a106b1be9318e89313063403314f4b5fd5
-
SHA512
6db07e6cf2286c7d68bc7dfcd3e634fd26c25efe72daa5e43a5775f4c596ac1b5c1051e6778172d1eea0fb7bb8fa93fc56c5f36676cd6e8b1487c1a68514e472
-
SSDEEP
24576:R2lmA4RSgPvod50p/TXM2s0espsODZjB0IP:R2MA4RS0vo05s0eusONlP
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
alg.exepid process 480 2672 alg.exe -
Drops file in System32 directory 1 IoCs
Processes:
2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exedescription ioc process File opened for modification C:\Windows\System32\alg.exe 2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exedescription pid process Token: SeTakeOwnershipPrivilege 2180 2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exepid process 2180 2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe 2180 2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe 2180 2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_d66a417b4ae966f5e3a6eb01b54f8d77_bkransomware.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\System32\alg.exeFilesize
1.5MB
MD5d82f1e67d7ab31e7f362416e72c6f812
SHA11a8c3bef5bbee467badc68dc02a0a40b0c96e604
SHA25675c97ec7fb4c1e6d1088ee3d2db96191de59421972a69d39f570660c745336db
SHA512a396caa185a0d94a290c77cf35be2ebc903ef79b0bd23c129509bfd8070d0ebd7b4b48d4219b955669f34d08090999acf65e7cc72c2bbf4aa8f89d3505019c70
-
memory/2180-7-0x00000000005E0000-0x0000000000646000-memory.dmpFilesize
408KB
-
memory/2180-6-0x00000000005E0000-0x0000000000646000-memory.dmpFilesize
408KB
-
memory/2180-5-0x0000000000400000-0x00000000005DB000-memory.dmpFilesize
1.9MB
-
memory/2180-0-0x00000000005E0000-0x0000000000646000-memory.dmpFilesize
408KB
-
memory/2180-13-0x0000000000400000-0x00000000005DB000-memory.dmpFilesize
1.9MB
-
memory/2672-16-0x0000000100000000-0x0000000100179000-memory.dmpFilesize
1.5MB
-
memory/2672-17-0x0000000100000000-0x0000000100179000-memory.dmpFilesize
1.5MB