Overview

overview

7

Static

static

3

2024-05-24...ny.exe

windows7-x64

7

2024-05-24...ny.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    24-05-2024 17:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-24_cfefb97ddc161f242b4be0e0bfa8fa3d_bkransomware_karagany.exe

  • Size

    677KB

  • MD5

    cfefb97ddc161f242b4be0e0bfa8fa3d

  • SHA1

    4f23edf479475a5ba2f42be0199036035e0c2c05

  • SHA256

    9d4811daf5f0d9635ffe23e14e959aa5fab4e9d17c477992d673590deb790a95

  • SHA512

    68afdaa64afa4c8675d193553efb27c7fe74b639bc7d164c776d0dd22b1241d61ce1c0839e735b1e402058bdceb023919abf937d1ab5b8e07dd89d7b11579cec

  • SSDEEP

    12288:IvXk1MXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sk1MsqjnhMgeiCl7G0nehbGZpbD

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-24_cfefb97ddc161f242b4be0e0bfa8fa3d_bkransomware_karagany.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-24_cfefb97ddc161f242b4be0e0bfa8fa3d_bkransomware_karagany.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2648
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:2652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\System32\alg.exe
    Filesize

    644KB

    MD5

    52eb906720912510fb445da6db6dda0f

    SHA1

    9eb3253b2463864e789487f87129b9f8fa62e85f

    SHA256

    7aca2658d99d3bcb3aea94515e345adcfb5172ef95a120a4737415f13d55de53

    SHA512

    1304e99aebb62c0c0c665f2b6f74e0505a46c0ad0711207512b01ffe5811ceefaff874490d2f9a6a5feea66885a0cb54690a4cbf81ef117e0bec98029376c4e0

    Download Submit
  • memory/2648-0-0x0000000000400000-0x00000000004B0000-memory.dmp
    Filesize

    704KB

    Download
  • memory/2648-8-0x0000000000230000-0x0000000000297000-memory.dmp
    Filesize

    412KB

    Download
  • memory/2648-1-0x0000000000230000-0x0000000000297000-memory.dmp
    Filesize

    412KB

    Download
  • memory/2648-16-0x0000000000400000-0x00000000004B0000-memory.dmp
    Filesize

    704KB

    Download
  • memory/2652-13-0x0000000100000000-0x00000001000A4000-memory.dmp
    Filesize

    656KB

    Download
  • memory/2652-17-0x0000000100000000-0x00000001000A4000-memory.dmp
    Filesize

    656KB

    Download