Analysis
-
max time kernel
143s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
30-05-2024 11:17
General
-
Target
2024-05-30_6ae569ae52a0812f67d914e1f4703423_bkransomware.exe
-
Size
712KB
-
MD5
6ae569ae52a0812f67d914e1f4703423
-
SHA1
e96fced988304008e30e97a834abfa8589b0364d
-
SHA256
d33978001acf7334879c8abfaf815471fc8f04ec45812de899e6d81597422d45
-
SHA512
fe340520d927d9a5e96d9ca2c457639c4564e65202f7d5f8bb0d92d947018b313c9d2137ece76540c65db353cc42f55c5bd73140012c975a079523d9f841d8b1
-
SSDEEP
12288:9tOw6BaoGZFExQZsVp9c6kH9ZcoeCzS0cUpUpONqHEtKfUAsLE5:n6BdGrExQZ+W6kd55S0c8CO6bcbE
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_6ae569ae52a0812f67d914e1f4703423_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_6ae569ae52a0812f67d914e1f4703423_bkransomware.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 8962⤵
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4004 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5dab479f3101403131806c957b4f84723
SHA1f038eb347a46145fc9abf57848e5f3d752d4b515
SHA25634e11a2207c6e40307bf8d92f873a332621fa4ac7c39638b068f0039fb95fa2b
SHA512c78efa1c5ae158072871ab56d25f78a4198dc1119fa5570623ee81152139385565c8372fd81ab072b3b16754f09bdd815f82f693c058432427645527f9eed43e
-
Filesize
781KB
MD55f2003ccc1ba16a854b9efb2c28a2159
SHA11d2ddd4c1fed74d53ddecd5d5eb65fa07db870b2
SHA256d8db99e741b8b71b9ecd1910c47a4dd8842423161c19110695cd613d16d2a54e
SHA5124f2d9da0309aca4b920a6fbf3f04d4b799806530d2a64e2639cb62ad19907307fdffa3676f9759c80e7eb0d50cfd6ff3c39949c5587c56dd6a0628c5982c1a58
-
Filesize
805KB
MD5912d724ebd57ba7f99edd7e8f8ebbba1
SHA1a62d7673ae5ee3cb0b544105ae4bf2dd2c770ba4
SHA256d5fff89f0d1467895b096c69090c25360c584c7b37370588f9263083ce8a5806
SHA51296a2c6f1a722bdb7eb99fb8b9087cc193a3662a7375660d9bb138375d6a2e2067bb9f81abd4a8030934cba53f98597f01a091234f2f31135abf4b1f1c878bc32
-
Filesize
2.1MB
MD50cf80571221599b9dbdfe130fa5c11d7
SHA1a767341f208223212bab5bf55f4fa2ece2f553c6
SHA2564c2c2e3dd72565798b87188b0ad1712723d72757fd15a4a6c8986dbcbc5f942e
SHA512748e93c6de8fa4bb61c65ec33b8fdd412551047c3a9df823275ea2c22be401a1a7a71f57c03c48ba0b4fb872f6931a7b89e6d1447760059ed8a371a70218d718
-
Filesize
588KB
MD5c3b103828ba11edf58ec3d7dca52503a
SHA179de462d5c84bae2150d41118c9f6356c6d105a6
SHA2564406f9f961cda0e6c3aeccd2dfd37bbaf484ba132a0c759b2fd982208c843ee0
SHA51240871e23b801f95b9dab0b81ba1120084e25f0932a22b490eec0a45552345655e54a539fd56190c36ac063c1ee1772d86607f12101318f70d1d3068f29b9c548
-
Filesize
1.7MB
MD59e359a303eb570ea1bf0fc0b4349373e
SHA1b4032488525315fbfd94d582b8b0cc641ba1f03f
SHA256988fdbff3194d6f361e4d6a70444842ea8a4e5a6f02e0575923355da812df452
SHA512f2b3ced38f3e18d608eb07b38a4e972b79a9e8b32e3aac604a24398b548c205a5f4d0ece1014131e7bf23e382b8070ce82331fffaf913401620827d2988b3176
-
Filesize
659KB
MD5af0641136dd3d755d9fbea75290fe553
SHA1b1fbfe143e84b5e1569e3c690ce3110f3ce2e9c1
SHA25636905ad42b6f5d93200da88b38a9a7c51efe30197ec7d37178bf4a2ab65733b5
SHA512c836a07a2c80a5ed8c45ede412c9999e297b432e98240832f01154a570b26b881e5a4efea03835e6038fe6d1f4f80d60da2279ca4a632038dbeee69fdf59966c
-
Filesize
1.2MB
MD54de6a04209990c98a366a9ae2ca4fab7
SHA13f1ed312f335ad3cc2bc6d81118e65f13a16f000
SHA2565dfcee4cdbfd3180db56a8485ecb8c3c47d79f7b1f20936bd4253199bdeda55a
SHA512d638c2be2e3f88ac91c10239bd97548db60b021b174c176d0e316fd578065cc993ec4c0a54f8089ad1f4785ac27a202af82436fb565dc91b234f15a4bdb2af4f
-
Filesize
578KB
MD5d815a6ebf9d4db6214c24892e0c020dc
SHA1442e328d8b7b74ad2785053777760b4b46f31ea3
SHA256c79f2b212a51e4b634f370fcda1dfe67c64bdcf122084e748a00749c965a55df
SHA512084e6e4c737e40772d4f225f1170dd757a2154d1761d5cb6e6dc6a2d35c989fb2d6ee22779b4a40cec4b40afca7bbcc18b4c460b48859e515001feef238aa27f
-
Filesize
940KB
MD56128c2e361df60e169a5a8b4debb77dd
SHA1e3df5339901af405e5fe96cb10e0602c4440ca02
SHA256380ceabeccaff7968cfdfec2a6ed78251f1f40b0d82c58e4a4857a1358a53e35
SHA51212cafa96754aca3bb407eb47a451ff1b1a43b8f237391a968d8f93fcae08a4a33c7c98c4bcf6255f02566924d40e5f3caa0e7a9216293c79f185e46ca5589dd0
-
Filesize
671KB
MD5994fee069868798bfe01787183128a8f
SHA1cb8621436441cc2700b79ef5b34bc7d7bd097106
SHA25640709a83c7d6787dd5916b4dc1107031e874f2f93d6e903f0b8349c2b140ec27
SHA51232e930eb41399f3106561f671e75c5a58408d18881d2d58b8ef8d0432ff0545d39d3ba619048931883235223447b36ec456ac54b6c95e4185958cdf73125df1c
-
Filesize
1.4MB
MD5403a38b84fb68a9b810192eb8e723f65
SHA1ac95eee753c7d2a068d1a3e2a91a4f3bded3dd45
SHA256d59cbf3dec82141c5227154a407209049cb842d97ce6d7597892f961ebcc6acf
SHA5125b64e77c91fdc0bab420e253c5202bde07c684da7bd74d9956edad7550369181c2f1b1f4e916c2465b7712fc50adf3dd64de9914fdcb4ccf38ed3f4206a08773
-
Filesize
1.8MB
MD5c5bcd80c1575c43637650524f82a14f8
SHA15abb7bf06b4a0f21d51ca7f48d6d789cd62526f0
SHA2566d0344e0cc8923613239b1f3da064e07eb8b2491a015b6762ed40159c6576e6f
SHA512f4229f1324d31e725323c1f79b789507032c633e9bd5eda08830a56a38572caffeae31cfef7e306befcd14d84805e3651967a78c77a860f355746000907fef7e
-
Filesize
1.4MB
MD5f5bcc775118da73d5aa5f8342624ed8c
SHA1d455e5009240ca01418c0f12cfe916a0f71c1b98
SHA256891c55eb599d5865d4996dfee1f93c1adea4552a41b62c0e3e0da640a0ff3a46
SHA512554757aa27a3e943b841627301c26f2e456197f73a253af44d5d4461f1d33c61feac0e118962ae8f3ba47ff5fc05d5eb876817ec599c1b637a5c43c21d02648d
-
Filesize
885KB
MD5aab8d53499fbf9245224200d2084848c
SHA16d08b1ba74d300308a9807f061e0c9bfd12ca097
SHA25617331380f8a7c7c126867f9f385c6d0b3809283823dfdd5da82b6870ae7458ba
SHA512985e4b06a8339f51f42dce26fa47dfe5a58188494dc54c7b768cd272c0437b9366c0d4cde2adc4058ac14cdd56c431a2db3b45b855c5f3ff985c9e3f0fa9c2af
-
Filesize
2.0MB
MD53023475acef7082f9cf08aacc93568d7
SHA1e7b223e07cfe543bce68a1e64a24a1b9df3febf8
SHA25609fab29cd35e1d3bb6951d16562813b2bb72068caa7558f09e3826d16fc7a3d5
SHA512481d0a2bb69a74654d4fc2ba14edf4b44ce10cff834b58a55af93ed9e01e0f0bbbf4661bd5b29923246b90ed93b036b0ee846242767aa634f0ad749db3d5d62e
-
Filesize
661KB
MD5c212711ec7ec60321e222cd5fe1115e1
SHA19ba5e3a8076e1752aed7896f144307b562cc6dc7
SHA256034380dab25317a1ffabf086660c6265f462e5b8a47b4c59b5e98621a6fa7165
SHA512aa757fbfd315166299b47421fc2003217825c58ca6e8e20822d73ee3a1b7b5b5b4144676e6a308d57cd5348623dfc26a5cc229dc3c482037ad1e957448288671
-
Filesize
712KB
MD58235e6b3560d0ede3973d3296209ef16
SHA1ea84601c9fbad62df32fa5c481c19bdb2d9f2c1c
SHA25635dd9fdded22635c97151127769a185d5925f97e5950543b4aca9b405ccfdfb5
SHA51271f7f7f7881b356a333cad7ff312ac34fa7a99b5917bedd8a1105c3bd56bef285c16ff51268f6d678113c9ec24a8f0b6bf638b493dd261c00a298fc99a210dac
-
Filesize
584KB
MD5ccb9c61d76cde990cdfdaf0fdb81b249
SHA17e4c5ee43b46dadd0e66e4a02a0a895af64d203f
SHA256a6ce770ca057a7da89e71d37d7c442d9e300f10a03592adebc8ebf85c8fe5c81
SHA5129897e7fd273b2e7da402b2f0f95208d364b268c7801fafbcf0303d02c896bfab94e41ae217505b45d82875a4b40e7af00fd2a7d12e3def533f75b486f77f1b18
-
Filesize
1.3MB
MD55cef30be1ce3ca480458910c48de60dd
SHA172ee30cbcf9d44c34e2efb0c8ff651bffb32f891
SHA256dd88bac8ed7dbaa9e74b674a16bc6d0637bd435e7dbbb34a957b466f506f18f2
SHA512361940d8d47290622866eb28b60ce90a8aa84fb83c48a2fbed4ec8a36cf5b5a761929712de5ec00f5b070cdf49f90196d92dd135ae74eb9edde8c01916f474ea
-
Filesize
772KB
MD5213eefda8de84231e3b783f738f5a174
SHA1e5f60d0d738fe057ba9f17d930bb6307f3f1c884
SHA256b0220d60b2ffe01d8bfc014aab981f5ef52fa236a959c99d3fac845e60fd6b62
SHA512718727cf4b23df5734377e051a88e458fa151767878f6ca02faaf1cc3c0b991602aec9db45730a424db1a6add9f03dc4184f0c1d3832f71f02a78375f4159f33
-
Filesize
2.1MB
MD574281ec9361cc6c68a13a2596e8f704e
SHA1dbb378d23a8439ce972a5f751402afd64539c947
SHA2563f7a2837d78bb17e78e8fb5acf7bc4cbe1dfdaac2d9ffcfc60aeaf4e91735d99
SHA512a577b1434e702dcc44c09f656ca68072411df0108198e462183c86e0dbcfb30637799c0b5e390f2602a9ff7ec15c6371c8ca587d3e34239ab4df2573e87bb9a9
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
412KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
384KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
680KB
-
Filesize
384KB
-
Filesize
680KB
-
Filesize
384KB
-
Filesize
604KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
600KB
-
Filesize
600KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
384KB