Analysis

  • max time kernel
    145s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-06-2024 02:33

General

  • Target

    2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe

  • Size

    8.4MB

  • MD5

    73c91787f2db475b88b8bc58394872c3

  • SHA1

    f5e52c7b62852cfc9decd93a3f7c037bb88c33ee

  • SHA256

    a5c5fe498a1e31a91dea78f9f203475ccb9b620b0155ba7924bf492055ff9d2d

  • SHA512

    d4223ee06ba3c169c212a25e1f3dc68bbb9f4c775b67895d609a25b3c8e1a3d37fccb7397b59c900bbddcea70784835b5f3a86356680f249095a7f9cc9f0e268

  • SSDEEP

    196608:+sqbVwW8Od2Rh+MHAozYKdPccoMEP5Uz1RMmizLjhPB:+sUVwWnM5kKdj++zfMpPjb

Malware Config

Signatures

  • Detects executables packed with VMProtect. 2 IoCs
  • UPX dump on OEP (original entry point) 4 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 5 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 37 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4888
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3288

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\4888e582630\TApi.dll

      Filesize

      3.3MB

      MD5

      a03db8a3622fa9f6ff51765ca145e5ad

      SHA1

      9436684c2fea17c9a0b704872f79eb7257d94bb8

      SHA256

      fe3ba07a52618342e47087c73ee7e7bfc0ea841b8f5cb458afc1ef36ad022707

      SHA512

      74dc48ccadfbe980d4a3e4c47195c63050dc90067d8048898fd48dc8fec9358c58d127e90a3f23080a4318f0e2f59bc40d9f1814c0ca2b058f223af34d33dc42

    • C:\Users\Admin\AppData\Local\Temp\4888e582630\TLib.dll

      Filesize

      1.3MB

      MD5

      0fdc79cafb9898d0ef79db7eec184f03

      SHA1

      db3a53eca9ade3f473776fd473f7cbe8751c969b

      SHA256

      22a25e408bb431ad311a8f8ea5c205ec228652df8963701e614b08e6b327b8fd

      SHA512

      fd76fe4021677382039c4e4b75fdc76e63cb6f2259ffbbecf477fe8f5b207c8fe8cd1cb8344f6c10b106c5ef2798b2a5ec9fe729c4524570de23e3fcdb239589

    • C:\Users\Admin\AppData\Local\Temp\4888e582630\_.bmp

      Filesize

      548B

      MD5

      e0d3ed5e1e56fb11bfcfe6bd945c206b

      SHA1

      8ba212b241655110ed394be25e355c7335c56262

      SHA256

      f1e4ca14df25cf1d6313d38f461e9dcedebaa889ade70a7e8a404193f94c23c5

      SHA512

      efd658174054a9b80217135e770d830ee51eb3942d474e91bd52137ab091f1d354b4c0d48efb7eccf47bd8b5c5cd8c56e543ac68e7b9c9474ff46c23ade9aa34

    • C:\Users\Admin\AppData\Local\Temp\4888e582630\_.bmp

      Filesize

      744B

      MD5

      98bf6ad36aedcbb35ea5544f8a98dcb7

      SHA1

      d25c1994126310144f70aa69110fe602f96b7af7

      SHA256

      cc307b058485bd3f237a3a32419d02eca4bfc93e8e8b18ffe8544d95c28d99c2

      SHA512

      c36a34ef51eb2867124e23790e57a4ca05983a694f7fafad8b5e3fdcb627eded7fe148390fc84032e6cf8b9c46578680e56af269d5d0bdcd0e1863070a6f3231

    • C:\Users\Admin\AppData\Local\Temp\4888e582630\_.bmp

      Filesize

      588B

      MD5

      a3dc01997eadb6b6cd644aa94a094a4a

      SHA1

      596a1f64f7c36f98a804d437c0503ff95e089a13

      SHA256

      aa6802e771b59b1b1d79009acf36162cbc115260ad3f91031422237c98287e5d

      SHA512

      4f4dc13857d9e554f888c05339aefdf22565acf4cbab7ebc6d4dd0be5b0b7b66a2b174257802c9d8fd4fd3c8451b330e8b6e19faed90fdc09ed80f98598a304a

    • C:\Users\Admin\AppData\Local\Temp\4888e582630\__.bmp

      Filesize

      1020B

      MD5

      2aae8d9a47e732d36dd4985c98aa7eaa

      SHA1

      13417613eb03c042863f51e0e3c438b936074fcd

      SHA256

      bb40e6f90d70632f80eea20d1f53d92c3cd46767cf37a70bd83a397ee3c66b78

      SHA512

      8ec40d3710615d05c49853bdf40c7ef3560ad26c5dbbfde7be38bd0c667f6f1d408c2e3d975549bf2190791f5d3722c01647d2e5dcfd8d83d870c43858e81010

    • C:\Users\Admin\AppData\Local\Temp\4888e582630\__.bmp

      Filesize

      1020B

      MD5

      c4315ec0f35457fe11bb5eaf262b1720

      SHA1

      034c087abc82b2d709d6a43075856619e33b8440

      SHA256

      baa6bd72934642df6697479be1d96f17b8b370e631e4b8dfb0bc321fd6df46e2

      SHA512

      bcc945a8d00ee39a4e4634132595ebae626bda1d3fc1178a518c7e8ad05be8bc7615ea70008922cf3c3ece8692e8dbb2273be2e71eaf68bceaa6825dd9f4af01

    • C:\Users\Admin\AppData\Local\Temp\4888e582630\__.bmp

      Filesize

      1KB

      MD5

      46c8704a8bea749d676eb90dc5a0f815

      SHA1

      eb5273b38ac0201bf1224245a1a3afe2d084a7bf

      SHA256

      c7ab145e7154c3bbcbdc93c90d5f54dd287a000728ee2acfdf3d5142177ebd3e

      SHA512

      25d7cb87c795f095d2772b7cc42baca256fafbdf403125b492269c906d691e1f4315a305217557dd2402b1456da6b4a2720abd53fd9abe532bd74d2d11166a64

    • C:\Users\Admin\AppData\Local\Temp\4888e582630\t_baibaoyun_win32.dll

      Filesize

      1.2MB

      MD5

      430b269ba6ae3ae72b7c76848fc3dd8c

      SHA1

      9c1e62f6ccfd0661ccc5e8b95abff394fca4052e

      SHA256

      2f422a4ed4bec519c8840436cabaffe2ef4244630829ba1ebb3b806a871cb26f

      SHA512

      61ac557cc1169ceb0b83a2ef41d4e697efee0fcd3472d2a9bb0f04199430698c7a162be2c607bde0a6bb24ec68fcb3b6faebd1bfef264846250b2789dd9cee2a

    • C:\Windows\SysWOW64\dm.dll

      Filesize

      804KB

      MD5

      c578b6820bda5689940560147c6e5ffc

      SHA1

      922e50d89c9c44bdc205ef17aa57212b64e58852

      SHA256

      3b6ddc32b800a18b21a819e842cbfdd57cb065fd92cc69545e0ef29b97cfd389

      SHA512

      9f2a1bb5788ad245242d12968bbf198af2694a87c6e2342f14672e8c14e8489dd3319434592fc9b20f620557d0fa58482903d19c7f5ba32456a1e4076dc1bb85

    • memory/4888-224-0x000000007719D000-0x000000007719E000-memory.dmp

      Filesize

      4KB

    • memory/4888-233-0x0000000010000000-0x0000000010176000-memory.dmp

      Filesize

      1.5MB

    • memory/4888-241-0x0000000010000000-0x0000000010176000-memory.dmp

      Filesize

      1.5MB

    • memory/4888-242-0x0000000010000000-0x0000000010176000-memory.dmp

      Filesize

      1.5MB