Analysis

  • max time kernel
    143s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    04-06-2024 02:33

General

  • Target

    2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe

  • Size

    8.4MB

  • MD5

    73c91787f2db475b88b8bc58394872c3

  • SHA1

    f5e52c7b62852cfc9decd93a3f7c037bb88c33ee

  • SHA256

    a5c5fe498a1e31a91dea78f9f203475ccb9b620b0155ba7924bf492055ff9d2d

  • SHA512

    d4223ee06ba3c169c212a25e1f3dc68bbb9f4c775b67895d609a25b3c8e1a3d37fccb7397b59c900bbddcea70784835b5f3a86356680f249095a7f9cc9f0e268

  • SSDEEP

    196608:+sqbVwW8Od2Rh+MHAozYKdPccoMEP5Uz1RMmizLjhPB:+sUVwWnM5kKdj++zfMpPjb

Malware Config

Signatures

  • Detects executables packed with VMProtect. 4 IoCs
  • UPX dump on OEP (original entry point) 4 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 5 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 37 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1500

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1500f768e5b\_.bmp

    Filesize

    744B

    MD5

    98bf6ad36aedcbb35ea5544f8a98dcb7

    SHA1

    d25c1994126310144f70aa69110fe602f96b7af7

    SHA256

    cc307b058485bd3f237a3a32419d02eca4bfc93e8e8b18ffe8544d95c28d99c2

    SHA512

    c36a34ef51eb2867124e23790e57a4ca05983a694f7fafad8b5e3fdcb627eded7fe148390fc84032e6cf8b9c46578680e56af269d5d0bdcd0e1863070a6f3231

  • C:\Users\Admin\AppData\Local\Temp\1500f768e5b\__.bmp

    Filesize

    1020B

    MD5

    c4315ec0f35457fe11bb5eaf262b1720

    SHA1

    034c087abc82b2d709d6a43075856619e33b8440

    SHA256

    baa6bd72934642df6697479be1d96f17b8b370e631e4b8dfb0bc321fd6df46e2

    SHA512

    bcc945a8d00ee39a4e4634132595ebae626bda1d3fc1178a518c7e8ad05be8bc7615ea70008922cf3c3ece8692e8dbb2273be2e71eaf68bceaa6825dd9f4af01

  • C:\Users\Admin\AppData\Local\Temp\1500f768e5b\__.bmp

    Filesize

    1020B

    MD5

    462f550aba03212a8317887f403073f9

    SHA1

    52e72581ea2fbe2b69e3deb84e35cfde3a698bd8

    SHA256

    c6060a4127f85c0f557fdf0b28a2a4221bf36f04a834edec1aadc1d54e1fd36d

    SHA512

    960dd94c7c4ca8649ebae7bde94a87b6b4761898e834b75ca80c0c3043c479c0e11694d68aa940c6f4c4fff88e0e4617c681e61f80bae7aa661804cdf0133b44

  • C:\Users\Admin\AppData\Local\Temp\1500f768e5b\__1.bmp

    Filesize

    548B

    MD5

    d4856280e621f0ab531338d2ae21d984

    SHA1

    e3eceffdfbd5f3bbc6dbc77f62732cfc0fcd3beb

    SHA256

    0a88c7dfc78f2e24ef64f1de3f38f969cd3f3a5000aee5351256d83e409f61c1

    SHA512

    afa475e2dd938f3d8692c8a0234f1c0532f827761d4f693bf9378f8be80401ddaaefb8e3cd3323bc2ef6b8d49444b9e185f335c700e512bf1e1b5a2a07a6cc58

  • C:\Windows\SysWOW64\dm.dll

    Filesize

    804KB

    MD5

    c578b6820bda5689940560147c6e5ffc

    SHA1

    922e50d89c9c44bdc205ef17aa57212b64e58852

    SHA256

    3b6ddc32b800a18b21a819e842cbfdd57cb065fd92cc69545e0ef29b97cfd389

    SHA512

    9f2a1bb5788ad245242d12968bbf198af2694a87c6e2342f14672e8c14e8489dd3319434592fc9b20f620557d0fa58482903d19c7f5ba32456a1e4076dc1bb85

  • \Users\Admin\AppData\Local\Temp\1500f768e5b\TApi.dll

    Filesize

    3.3MB

    MD5

    a03db8a3622fa9f6ff51765ca145e5ad

    SHA1

    9436684c2fea17c9a0b704872f79eb7257d94bb8

    SHA256

    fe3ba07a52618342e47087c73ee7e7bfc0ea841b8f5cb458afc1ef36ad022707

    SHA512

    74dc48ccadfbe980d4a3e4c47195c63050dc90067d8048898fd48dc8fec9358c58d127e90a3f23080a4318f0e2f59bc40d9f1814c0ca2b058f223af34d33dc42

  • \Users\Admin\AppData\Local\Temp\1500f768e5b\TLib.dll

    Filesize

    1.3MB

    MD5

    0fdc79cafb9898d0ef79db7eec184f03

    SHA1

    db3a53eca9ade3f473776fd473f7cbe8751c969b

    SHA256

    22a25e408bb431ad311a8f8ea5c205ec228652df8963701e614b08e6b327b8fd

    SHA512

    fd76fe4021677382039c4e4b75fdc76e63cb6f2259ffbbecf477fe8f5b207c8fe8cd1cb8344f6c10b106c5ef2798b2a5ec9fe729c4524570de23e3fcdb239589

  • \Users\Admin\AppData\Local\Temp\1500f768e5b\t_baibaoyun_win32.dll

    Filesize

    1.2MB

    MD5

    430b269ba6ae3ae72b7c76848fc3dd8c

    SHA1

    9c1e62f6ccfd0661ccc5e8b95abff394fca4052e

    SHA256

    2f422a4ed4bec519c8840436cabaffe2ef4244630829ba1ebb3b806a871cb26f

    SHA512

    61ac557cc1169ceb0b83a2ef41d4e697efee0fcd3472d2a9bb0f04199430698c7a162be2c607bde0a6bb24ec68fcb3b6faebd1bfef264846250b2789dd9cee2a

  • memory/1500-223-0x0000000000EC0000-0x000000000173D000-memory.dmp

    Filesize

    8.5MB

  • memory/1500-1-0x00000000035F0000-0x0000000003B2E000-memory.dmp

    Filesize

    5.2MB

  • memory/1500-232-0x0000000010000000-0x0000000010176000-memory.dmp

    Filesize

    1.5MB

  • memory/1500-237-0x0000000010000000-0x0000000010176000-memory.dmp

    Filesize

    1.5MB

  • memory/1500-239-0x0000000003F40000-0x0000000003F4A000-memory.dmp

    Filesize

    40KB

  • memory/1500-238-0x0000000003F40000-0x0000000003F4A000-memory.dmp

    Filesize

    40KB

  • memory/1500-240-0x0000000010000000-0x0000000010176000-memory.dmp

    Filesize

    1.5MB

  • memory/1500-241-0x0000000000EC0000-0x000000000173D000-memory.dmp

    Filesize

    8.5MB

  • memory/1500-243-0x0000000003F40000-0x0000000003F4A000-memory.dmp

    Filesize

    40KB

  • memory/1500-244-0x0000000003F40000-0x0000000003F4A000-memory.dmp

    Filesize

    40KB