103a03c646a5e74b2a494dbf2e8467b669df1a98eed7a45ccae53b2f3c6f9e34

Analysis

max time kernel
134s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-24_f89c5acd1f23aa06926607dbe085c751_bkransomware.exe
Size

74KB
MD5

f89c5acd1f23aa06926607dbe085c751
SHA1

182f4749dbe3f93a84e4c255dd0c69ad639286b0
SHA256

103a03c646a5e74b2a494dbf2e8467b669df1a98eed7a45ccae53b2f3c6f9e34
SHA512

05852aeb0d914bbb2ceacf657d04a433edcc7fd916b56e97030d1811006c67eb6809c5b3bf287b4c52a6e1e70645251359e497b8923e82f95d003cc9f2f36339
SSDEEP

1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazTP9Zid:ZRpAyazIliazTVQd

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

CTS.exe

pid process

3076 CTS.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
3076	CTS.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

CTS.exe2024-05-24_f89c5acd1f23aa06926607dbe085c751_bkransomware.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2024-05-24_f89c5acd1f23aa06926607dbe085c751_bkransomware.exe

Drops file in Windows directory 2 IoCs

Processes:

2024-05-24_f89c5acd1f23aa06926607dbe085c751_bkransomware.exeCTS.exe

description ioc process

File created C:\Windows\CTS.exe 2024-05-24_f89c5acd1f23aa06926607dbe085c751_bkransomware.exe
File created C:\Windows\CTS.exe CTS.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2024-05-24_f89c5acd1f23aa06926607dbe085c751_bkransomware.exeCTS.exe

description pid process

Token: SeDebugPrivilege 5348 2024-05-24_f89c5acd1f23aa06926607dbe085c751_bkransomware.exe
Token: SeDebugPrivilege 3076 CTS.exe

description	ioc	process
File created	C:\Windows\CTS.exe	2024-05-24_f89c5acd1f23aa06926607dbe085c751_bkransomware.exe
File created	C:\Windows\CTS.exe	CTS.exe

description	pid	process
Token: SeDebugPrivilege	5348	2024-05-24_f89c5acd1f23aa06926607dbe085c751_bkransomware.exe
Token: SeDebugPrivilege	3076	CTS.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-24_f89c5acd1f23aa06926607dbe085c751_bkransomware.exe

description	pid	process	target process
PID 5348 wrote to memory of 3076	5348	2024-05-24_f89c5acd1f23aa06926607dbe085c751_bkransomware.exe	CTS.exe
PID 5348 wrote to memory of 3076	5348	2024-05-24_f89c5acd1f23aa06926607dbe085c751_bkransomware.exe	CTS.exe
PID 5348 wrote to memory of 3076	5348	2024-05-24_f89c5acd1f23aa06926607dbe085c751_bkransomware.exe	CTS.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-24_f89c5acd1f23aa06926607dbe085c751_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_f89c5acd1f23aa06926607dbe085c751_bkransomware.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5348

C:\Windows\CTS.exe
"C:\Windows\CTS.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3076

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Filesize
394KB

MD5
32bc4c3169351755114949afe37d2b10

SHA1
922142e6cfe2ef0f26eaa047df7161207b520a71

SHA256
5128594129a0c068b8b1d8782a761fa071bd553df92b4bffcb4ce5685cb5fe97

SHA512
810ded38690c4988fce21fdf7a0c1d07234ebe9474dfcbad9886c199a36f36b7944e01e1962d65e2a9ad28e7a5f3b6f178ee3e8aa4895c3853d75e28b5b4cfd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\lCiQdo8cILH9cRR.exe
Filesize
74KB

MD5
c4deb6d8e18ce984ea3b4ec226f4e98f

SHA1
92c4302589bffe37116d409eb72377879d5fcb27

SHA256
d0cda7d83b9a64c8c7e52e72cc594cb287296fc7ce7a8e4551e53782f35d4b73

SHA512
6ea4d183089aff8a730460bc20e71e02e0613c05ef5b46b2a4b7ea3cb4eff2a9f5425a02bb2c474d70ca44450380decfdaa85efd43251a0bd03398a8e50735a3

Download Submit
C:\Windows\CTS.exe
Filesize
71KB

MD5
f9d4ab0a726adc9b5e4b7d7b724912f1

SHA1
3d42ca2098475924f70ee4a831c4f003b4682328

SHA256
b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc

SHA512
22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432

Download Submit