Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
30/05/2024, 11:22
General
-
Target
2024-05-30_7095745acb2e838004ab87e87851e5a0_bkransomware_karagany.exe
-
Size
677KB
-
MD5
7095745acb2e838004ab87e87851e5a0
-
SHA1
76c3f83742ddf82021c0db8133d47db772b3d5e6
-
SHA256
17c60ee82a400df89d28336f838fcb5c41413135f84025b979b20ebf87e9b167
-
SHA512
276219fe928e0441585bf284cad8aa5ea1390f3e26a8a055c1b144a9c8e17bde365b1713b4c8f1ded4996ecce10b64c2c0ab69bd4ed028615692e91bda853e7e
-
SSDEEP
12288:svXk1pZI3XPWvOYRcDRJZ4w8qIV8mQR8XZi/mWcSjpI0Tkdure6:Ik1pW+vxWJq0Q7QqtWLjXTqM
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_7095745acb2e838004ab87e87851e5a0_bkransomware_karagany.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_7095745acb2e838004ab87e87851e5a0_bkransomware_karagany.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
603KB
MD5f9b21d834dc34267bc60a7310f5cbd31
SHA1cc9fba24333c0ae6357a4d5afe74dfff1bd558a8
SHA256f939a368952651ad5c777f252c0bee525f18a911f692ee520daeaa7f0973a1c2
SHA512d6a46905853ac8e7714920f8be24f564811c41506b792e7cdf224d07bdb07639125dc8d2e74950782f533e108633063d4a4914d0e5505ef40243e552373159df
-
Filesize
644KB
MD5a90f822437aec73d668e79785c3e8e5b
SHA1b6e1345628fbfd3fcea7a3804a6ae9d5b8094c72
SHA256abcd026d0b531eae9e5fb400fa2c1b3c239d1943a6169ff335ec0de7fc9f9a39
SHA512462e1045762beadddf5580f359e267283d22cf467ae363c79e2323731b2fd3da9c1dba3e42ab212c6399c04e46c06ae324f1bef5fa7d5a0c4580360a09cc94dd
-
Filesize
704KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
704KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
628KB
-
Filesize
628KB