4d8983237a587bdcae132fe75def12d736c8bf415bb17e8ea8958a8e13fe421e

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-24_7e65099ac2021e34cdc06f76bac9071b_bkransomware.exe
Size

71KB
MD5

7e65099ac2021e34cdc06f76bac9071b
SHA1

8a7f6359b6782c910f796ff6c8f55565e921d766
SHA256

4d8983237a587bdcae132fe75def12d736c8bf415bb17e8ea8958a8e13fe421e
SHA512

e6950dc32ef9344e92437f051fe2fa9baea64156979703b29c30dc343b9570a5c9369b5a94664982ed6eec84f28924dc16d6135e376740d36060681bd7401dfe
SSDEEP

1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazTI:ZRpAyazIliazTI

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

CTS.exe

pid process

5076 CTS.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
5076	CTS.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2024-05-24_7e65099ac2021e34cdc06f76bac9071b_bkransomware.exeCTS.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2024-05-24_7e65099ac2021e34cdc06f76bac9071b_bkransomware.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

Processes:

2024-05-24_7e65099ac2021e34cdc06f76bac9071b_bkransomware.exeCTS.exe

description ioc process

File created C:\Windows\CTS.exe 2024-05-24_7e65099ac2021e34cdc06f76bac9071b_bkransomware.exe
File created C:\Windows\CTS.exe CTS.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2024-05-24_7e65099ac2021e34cdc06f76bac9071b_bkransomware.exeCTS.exe

description pid process

Token: SeDebugPrivilege 3000 2024-05-24_7e65099ac2021e34cdc06f76bac9071b_bkransomware.exe
Token: SeDebugPrivilege 5076 CTS.exe

description	ioc	process
File created	C:\Windows\CTS.exe	2024-05-24_7e65099ac2021e34cdc06f76bac9071b_bkransomware.exe
File created	C:\Windows\CTS.exe	CTS.exe

description	pid	process
Token: SeDebugPrivilege	3000	2024-05-24_7e65099ac2021e34cdc06f76bac9071b_bkransomware.exe
Token: SeDebugPrivilege	5076	CTS.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-24_7e65099ac2021e34cdc06f76bac9071b_bkransomware.exe

description	pid	process	target process
PID 3000 wrote to memory of 5076	3000	2024-05-24_7e65099ac2021e34cdc06f76bac9071b_bkransomware.exe	CTS.exe
PID 3000 wrote to memory of 5076	3000	2024-05-24_7e65099ac2021e34cdc06f76bac9071b_bkransomware.exe	CTS.exe
PID 3000 wrote to memory of 5076	3000	2024-05-24_7e65099ac2021e34cdc06f76bac9071b_bkransomware.exe	CTS.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-24_7e65099ac2021e34cdc06f76bac9071b_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_7e65099ac2021e34cdc06f76bac9071b_bkransomware.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000

C:\Windows\CTS.exe
"C:\Windows\CTS.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5076

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Filesize
392KB

MD5
a0fe33bc14731e78d64176d7a444f23d

SHA1
018aca06886fc8381b0ef1036a37eef53d497dca

SHA256
09be434ce89bbd0d6bcb01aa17ec501857ae76d2a54711b546ef4077861830ed

SHA512
aca79f7a95cead7789490e49e8e26f2cc8b2d5df26819b76ec6e919e247e828851f88cb8144a15625a4c46e03ff84497eff29e9673564924159d5ffc1097a77f

Download Submit
C:\Users\Admin\AppData\Local\Temp\gbUCX8Rr40hJDX5.exe
Filesize
71KB

MD5
21a4d078812711e1873d92cfd4f3a0d6

SHA1
800c1990d61ddb0bfe8e8e6efcdc6a42591a4a39

SHA256
6f8becec96b60c740c3534c242f55f226325a1d87f92533227e2e2fa27d0b9fc

SHA512
e8cbc21be54873f92ff2e4737068634c6690326dcce68f8e9dca4c71ca2eef6044dd9cdf58a0f9b643b4c6e1ddb8c55ea7afccccbd4c4c17d2720a6ecc632b28

Download Submit
C:\Windows\CTS.exe
Filesize
71KB

MD5
f9d4ab0a726adc9b5e4b7d7b724912f1

SHA1
3d42ca2098475924f70ee4a831c4f003b4682328

SHA256
b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc

SHA512
22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432

Download Submit