Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28/05/2024, 16:46

General

  • Target

    2024-05-28_125cdde9ea5244c500a03ccfe62e8300_bkransomware.exe

  • Size

    1017KB

  • MD5

    125cdde9ea5244c500a03ccfe62e8300

  • SHA1

    41011506b08f5ffd445332e279c1a7822f3e1ed8

  • SHA256

    47b0679a54a227393383cb87781a7270a37a428a8b67644ee02417ee5945a89d

  • SHA512

    88b885345b02946b72536cb46c712b3442b09529422b869ccce01578f1f0fc15f612d8e24c83fa9963a306c19758cd98ab4c183224c92e2e6681779e8798790e

  • SSDEEP

    24576:h2lmh4RpTduSZpUR0GHrVQ1aW4mSOgv3isi:h2Mh4RXpAHrVQ1/fSNvi

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-28_125cdde9ea5244c500a03ccfe62e8300_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-28_125cdde9ea5244c500a03ccfe62e8300_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1284

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1284-0-0x0000000000400000-0x0000000000506000-memory.dmp

          Filesize

          1.0MB

        • memory/1284-2-0x00000000005F0000-0x0000000000657000-memory.dmp

          Filesize

          412KB

        • memory/1284-8-0x00000000005F0000-0x0000000000657000-memory.dmp

          Filesize

          412KB

        • memory/1284-6-0x00000000005F0000-0x0000000000657000-memory.dmp

          Filesize

          412KB

        • memory/1284-13-0x0000000000400000-0x0000000000506000-memory.dmp

          Filesize

          1.0MB