3727dfc70cce2050d9b5db1677571431c32b516851e1133df3aa5a0a4ad6e06e

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-24_e6c89aeab5a9ff4fef6497c5ddb3d23b_bkransomware.exe
Size

71KB
MD5

e6c89aeab5a9ff4fef6497c5ddb3d23b
SHA1

a09b1e72ceae245e983e3c7dfc0eb59707d8c272
SHA256

3727dfc70cce2050d9b5db1677571431c32b516851e1133df3aa5a0a4ad6e06e
SHA512

984d8f7fb9219f5f0fbd5d1ba0ae3287833e676e41c2884b537099a050e06de279db3382865dcc0bf96f8017ef76bd4daef8b5c4defae6ec483c3174a55b7409
SSDEEP

1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazT2p:ZRpAyazIliazTy

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

CTS.exe

pid process

220 CTS.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
220	CTS.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2024-05-24_e6c89aeab5a9ff4fef6497c5ddb3d23b_bkransomware.exeCTS.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2024-05-24_e6c89aeab5a9ff4fef6497c5ddb3d23b_bkransomware.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

Processes:

2024-05-24_e6c89aeab5a9ff4fef6497c5ddb3d23b_bkransomware.exeCTS.exe

description ioc process

File created C:\Windows\CTS.exe 2024-05-24_e6c89aeab5a9ff4fef6497c5ddb3d23b_bkransomware.exe
File created C:\Windows\CTS.exe CTS.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2024-05-24_e6c89aeab5a9ff4fef6497c5ddb3d23b_bkransomware.exeCTS.exe

description pid process

Token: SeDebugPrivilege 4684 2024-05-24_e6c89aeab5a9ff4fef6497c5ddb3d23b_bkransomware.exe
Token: SeDebugPrivilege 220 CTS.exe

description	ioc	process
File created	C:\Windows\CTS.exe	2024-05-24_e6c89aeab5a9ff4fef6497c5ddb3d23b_bkransomware.exe
File created	C:\Windows\CTS.exe	CTS.exe

description	pid	process
Token: SeDebugPrivilege	4684	2024-05-24_e6c89aeab5a9ff4fef6497c5ddb3d23b_bkransomware.exe
Token: SeDebugPrivilege	220	CTS.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-24_e6c89aeab5a9ff4fef6497c5ddb3d23b_bkransomware.exe

description	pid	process	target process
PID 4684 wrote to memory of 220	4684	2024-05-24_e6c89aeab5a9ff4fef6497c5ddb3d23b_bkransomware.exe	CTS.exe
PID 4684 wrote to memory of 220	4684	2024-05-24_e6c89aeab5a9ff4fef6497c5ddb3d23b_bkransomware.exe	CTS.exe
PID 4684 wrote to memory of 220	4684	2024-05-24_e6c89aeab5a9ff4fef6497c5ddb3d23b_bkransomware.exe	CTS.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-24_e6c89aeab5a9ff4fef6497c5ddb3d23b_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_e6c89aeab5a9ff4fef6497c5ddb3d23b_bkransomware.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684

C:\Windows\CTS.exe
"C:\Windows\CTS.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:220

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Filesize
392KB

MD5
7a288c67ebbd1a8d371c85ade14a6575

SHA1
0207a871489d6502cda90b5bb9e3896d670fb656

SHA256
f95dc22cb81cc7fc3dd83afaa0adafb7c7edba2a5645c84f0719ff349402f3de

SHA512
5dbc53c5389743ad5005a86f08ee64f9f537a5bc8f6eba083ce8f302fe8937b209ecea9c67c0437c01e928fe9d8f57c4a73233f50a8407a29f886d112981df33

Download Submit
C:\Users\Admin\AppData\Local\Temp\gtpKMkFJhryyNLf.exe
Filesize
71KB

MD5
6dbb93c99a09537b5481814744a9b8d1

SHA1
fdd3c960f3e4c1c78f546bc6d75930a1f29390ea

SHA256
664b27a8fe2bc667ebca7b0e13a2ae52b189791654ca8c0624dcea9e4bb6cf93

SHA512
4b40c809b9fb65ac245dc9e94e5ae984ad872373b1c6ac3f781c4e430928b947565091b32385867eae8dd3ec40fa9bd272cea17f7f92630296f2fb538a74b60e

Download Submit
C:\Windows\CTS.exe
Filesize
71KB

MD5
f9d4ab0a726adc9b5e4b7d7b724912f1

SHA1
3d42ca2098475924f70ee4a831c4f003b4682328

SHA256
b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc

SHA512
22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432

Download Submit