Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 02:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe
-
Size
8.4MB
-
MD5
73c91787f2db475b88b8bc58394872c3
-
SHA1
f5e52c7b62852cfc9decd93a3f7c037bb88c33ee
-
SHA256
a5c5fe498a1e31a91dea78f9f203475ccb9b620b0155ba7924bf492055ff9d2d
-
SHA512
d4223ee06ba3c169c212a25e1f3dc68bbb9f4c775b67895d609a25b3c8e1a3d37fccb7397b59c900bbddcea70784835b5f3a86356680f249095a7f9cc9f0e268
-
SSDEEP
196608:+sqbVwW8Od2Rh+MHAozYKdPccoMEP5Uz1RMmizLjhPB:+sUVwWnM5kKdj++zfMpPjb
Malware Config
Signatures
-
Detects executables packed with VMProtect. 4 IoCs
resource yara_rule behavioral1/files/0x0006000000018ba2-215.dat INDICATOR_EXE_Packed_VMProtect behavioral1/files/0x0006000000018b96-218.dat INDICATOR_EXE_Packed_VMProtect behavioral1/memory/1500-223-0x0000000000EC0000-0x000000000173D000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/1500-241-0x0000000000EC0000-0x000000000173D000-memory.dmp INDICATOR_EXE_Packed_VMProtect -
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral1/files/0x0025000000015c23-228.dat UPX behavioral1/memory/1500-232-0x0000000010000000-0x0000000010176000-memory.dmp UPX behavioral1/memory/1500-237-0x0000000010000000-0x0000000010176000-memory.dmp UPX behavioral1/memory/1500-240-0x0000000010000000-0x0000000010176000-memory.dmp UPX -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0025000000015c23-228.dat acprotect -
Loads dropped DLL 5 IoCs
pid Process 1500 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe 1500 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe 1500 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe 1500 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe 1500 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe -
resource yara_rule behavioral1/files/0x0025000000015c23-228.dat upx behavioral1/memory/1500-232-0x0000000010000000-0x0000000010176000-memory.dmp upx behavioral1/memory/1500-237-0x0000000010000000-0x0000000010176000-memory.dmp upx behavioral1/memory/1500-240-0x0000000010000000-0x0000000010176000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dm.dll 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe File created C:\Windows\SysWOW64\dm.dll 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe = "10000" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe -
Modifies registry class 37 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D} 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ = "Idmsoft" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\ = "{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\ = "dm.dmsoft" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214} 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\ = "dm.dmsoft" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\ProgID\ = "dm.dmsoft" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CurVer 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\HELPDIR 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C} 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CLSID 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CurVer\ = "dm.dmsoft" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InprocServer32\ = "C:\\Windows\\SysWow64\\dm.dll" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InprocServer32\ThreadingModel = "Apartment" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\FLAGS 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CLSID\ = "{26037A0E-7CBD-4FFF-9C63-56F2D0770214}" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InprocServer32 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\0 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\Version = "1.0" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\ProgID 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\dm.dll" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ = "Idmsoft" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\ = "{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\ = "Dm" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\FLAGS\ = "0" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\0\win32 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C} 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\Version = "1.0" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1500 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe 1500 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe 1500 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1500
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
744B
MD598bf6ad36aedcbb35ea5544f8a98dcb7
SHA1d25c1994126310144f70aa69110fe602f96b7af7
SHA256cc307b058485bd3f237a3a32419d02eca4bfc93e8e8b18ffe8544d95c28d99c2
SHA512c36a34ef51eb2867124e23790e57a4ca05983a694f7fafad8b5e3fdcb627eded7fe148390fc84032e6cf8b9c46578680e56af269d5d0bdcd0e1863070a6f3231
-
Filesize
1020B
MD5c4315ec0f35457fe11bb5eaf262b1720
SHA1034c087abc82b2d709d6a43075856619e33b8440
SHA256baa6bd72934642df6697479be1d96f17b8b370e631e4b8dfb0bc321fd6df46e2
SHA512bcc945a8d00ee39a4e4634132595ebae626bda1d3fc1178a518c7e8ad05be8bc7615ea70008922cf3c3ece8692e8dbb2273be2e71eaf68bceaa6825dd9f4af01
-
Filesize
1020B
MD5462f550aba03212a8317887f403073f9
SHA152e72581ea2fbe2b69e3deb84e35cfde3a698bd8
SHA256c6060a4127f85c0f557fdf0b28a2a4221bf36f04a834edec1aadc1d54e1fd36d
SHA512960dd94c7c4ca8649ebae7bde94a87b6b4761898e834b75ca80c0c3043c479c0e11694d68aa940c6f4c4fff88e0e4617c681e61f80bae7aa661804cdf0133b44
-
Filesize
548B
MD5d4856280e621f0ab531338d2ae21d984
SHA1e3eceffdfbd5f3bbc6dbc77f62732cfc0fcd3beb
SHA2560a88c7dfc78f2e24ef64f1de3f38f969cd3f3a5000aee5351256d83e409f61c1
SHA512afa475e2dd938f3d8692c8a0234f1c0532f827761d4f693bf9378f8be80401ddaaefb8e3cd3323bc2ef6b8d49444b9e185f335c700e512bf1e1b5a2a07a6cc58
-
Filesize
804KB
MD5c578b6820bda5689940560147c6e5ffc
SHA1922e50d89c9c44bdc205ef17aa57212b64e58852
SHA2563b6ddc32b800a18b21a819e842cbfdd57cb065fd92cc69545e0ef29b97cfd389
SHA5129f2a1bb5788ad245242d12968bbf198af2694a87c6e2342f14672e8c14e8489dd3319434592fc9b20f620557d0fa58482903d19c7f5ba32456a1e4076dc1bb85
-
Filesize
3.3MB
MD5a03db8a3622fa9f6ff51765ca145e5ad
SHA19436684c2fea17c9a0b704872f79eb7257d94bb8
SHA256fe3ba07a52618342e47087c73ee7e7bfc0ea841b8f5cb458afc1ef36ad022707
SHA51274dc48ccadfbe980d4a3e4c47195c63050dc90067d8048898fd48dc8fec9358c58d127e90a3f23080a4318f0e2f59bc40d9f1814c0ca2b058f223af34d33dc42
-
Filesize
1.3MB
MD50fdc79cafb9898d0ef79db7eec184f03
SHA1db3a53eca9ade3f473776fd473f7cbe8751c969b
SHA25622a25e408bb431ad311a8f8ea5c205ec228652df8963701e614b08e6b327b8fd
SHA512fd76fe4021677382039c4e4b75fdc76e63cb6f2259ffbbecf477fe8f5b207c8fe8cd1cb8344f6c10b106c5ef2798b2a5ec9fe729c4524570de23e3fcdb239589
-
Filesize
1.2MB
MD5430b269ba6ae3ae72b7c76848fc3dd8c
SHA19c1e62f6ccfd0661ccc5e8b95abff394fca4052e
SHA2562f422a4ed4bec519c8840436cabaffe2ef4244630829ba1ebb3b806a871cb26f
SHA51261ac557cc1169ceb0b83a2ef41d4e697efee0fcd3472d2a9bb0f04199430698c7a162be2c607bde0a6bb24ec68fcb3b6faebd1bfef264846250b2789dd9cee2a