Overview

overview

7

Static

static

3

2024-05-24...re.exe

windows7-x64

7

2024-05-24...re.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    24-05-2024 11:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-24_0079a5dbc66132b89962f01d25797e34_bkransomware.exe

  • Size

    1.6MB

  • MD5

    0079a5dbc66132b89962f01d25797e34

  • SHA1

    5090ce39c8c0c79d473250360963fcd085822eaa

  • SHA256

    223507ecbdb911994c72e2f91f5fdfe64d4c9508a4d939a20606776bd926460b

  • SHA512

    e99f20d7a944a533b47d7d46a2caf945cd4d84bb2eb2164b6987ca3241656d2e28fa802d69d3086cb3ead0f53ce6409e96132fbc8c057d314350e98e2178dea1

  • SSDEEP

    12288:H2lWRPDhA9PRWg9WUVpyNj3C/Ei9OQSt6uk3zO61zOQJjN6atJ6bVgwtZJz:H2lmD4RSUMj3C/Uvw3B8atQVpZJ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-24_0079a5dbc66132b89962f01d25797e34_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-24_0079a5dbc66132b89962f01d25797e34_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1876
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:2608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\System32\alg.exe
    Filesize

    1.3MB

    MD5

    2ee21e94bdf4dc57861bc50b5cb58fb4

    SHA1

    5143bb2217fc4e39c909989a6f1b9d63f6d670c9

    SHA256

    13cfc73cfbde792d6a0880aa1450dac9932804e0d9edb2e68fba6dd3c7c268a0

    SHA512

    a2d1cb2a96d872e1ba6031f35f19ec7910f3c0744876e92c62ce3e27f12212eea2d656f0dfa51884067b0369cc73fc8644a0ee66c22e9287de3514490952f3f5

    Download Submit
  • memory/1876-0-0x0000000000400000-0x00000000005A7000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/1876-8-0x0000000000280000-0x00000000002E7000-memory.dmp
    Filesize

    412KB

    Download
  • memory/1876-1-0x0000000000280000-0x00000000002E7000-memory.dmp
    Filesize

    412KB

    Download
  • memory/1876-16-0x0000000000400000-0x00000000005A7000-memory.dmp
    Filesize

    1.7MB

    Download
  • memory/2608-15-0x0000000100000000-0x0000000100145000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/2608-17-0x0000000100000000-0x0000000100145000-memory.dmp
    Filesize

    1.3MB

    Download