fca4b804361bc51e300ec6c9432522d03dc2448fc5a4ddbb7812fa9aeb1969e3

Analysis

max time kernel
133s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-03_379baa9f8807856cfcc43b4fb02a3cd5_bkransomware.exe
Size 71KB
Sample240603-1bv69aaf75
SHA256 fca4b804361bc51e300ec6c9432522d03dc2448fc5a4ddbb7812fa9aeb1969e3
MD5 379baa9f8807856cfcc43b4fb02a3cd5
SHA1 b6e354ad4a4899926dddce2f75aa5f14c6578b61
SHA512 687bf5da5aed18e02a6b4576608d572fb3a461ff162ab00fefef96c2fd592e81cebccbbcefb4225ef56d4527af56718870a65eae07720925d5cbfb56e35bd45a
SSDEEP 1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazTn:ZRpAyazIliazTn
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2908	CTS.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2024-06-03_379baa9f8807856cfcc43b4fb02a3cd5_bkransomware.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	2024-06-03_379baa9f8807856cfcc43b4fb02a3cd5_bkransomware.exe
File created	C:\Windows\CTS.exe	CTS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4824	2024-06-03_379baa9f8807856cfcc43b4fb02a3cd5_bkransomware.exe
Token: SeDebugPrivilege	2908	CTS.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 2908	4824	2024-06-03_379baa9f8807856cfcc43b4fb02a3cd5_bkransomware.exe	83
PID 4824 wrote to memory of 2908	4824	2024-06-03_379baa9f8807856cfcc43b4fb02a3cd5_bkransomware.exe	83
PID 4824 wrote to memory of 2908	4824	2024-06-03_379baa9f8807856cfcc43b4fb02a3cd5_bkransomware.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-06-03_379baa9f8807856cfcc43b4fb02a3cd5_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_379baa9f8807856cfcc43b4fb02a3cd5_bkransomware.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

excel.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Size 392KB
SHA256 02080d0bcbfca0c6dff48daa29d04d9b743f11c0d568e5445d380c8ef937f1a0
MD5 b08258be12e9e0831d4f000828533cde
SHA1 c2d437b6d3ab4313bced6248192b6e4106faf449
SHA512 b9fc91f5b8deff75581a11b91e840f2ab78f4e35d435bc542ccccfa56b98fb2332fdf49c4ff6cc09f06becbdce40bf1b293440dca9e8f998318e619e1aaf149c
SSDEEP 6144:xZ8azQLqxaogYVfj55rcQ+2liQjua5FVW5i1ehOkx2ZCz9z12:xC0QLiRFj5428za5FVzehmQz1o
MD5 SHA1 SHA512 SSDEEP

Submit Download

UAxa20RHEb9QoMq.exe

Path C:\Users\Admin\AppData\Local\Temp\UAxa20RHEb9QoMq.exe
Size 71KB
SHA256 a3fb336eedc2c50f1840ea8ecbc9a41b8944d248ed73f22a6e02c5d1c93bc9fe
MD5 416c11e8b8d232bfc6400586f18e3013
SHA1 e9473dce859c6187de00570e5c050d1eba544d5d
SHA512 6d5b2eadb8c2d2507697e24ab8a55d165bc9e2abb2904dfae5c377a311e50bba7047aa94b5cae4402a6ed9c16d6cb9bee752a815f41595116c3f222ca2f0e566
SSDEEP 1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazT89QC:ZRpAyazIliazTI
MD5 SHA1 SHA512 SSDEEP

Submit Download

CTS.exe

Path C:\Windows\CTS.exe
Size 71KB
SHA256 b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc
MD5 f9d4ab0a726adc9b5e4b7d7b724912f1
SHA1 3d42ca2098475924f70ee4a831c4f003b4682328
SHA512 22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432
SSDEEP 1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazT:ZRpAyazIliazT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads