Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 02:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe
-
Size
8.4MB
-
MD5
73c91787f2db475b88b8bc58394872c3
-
SHA1
f5e52c7b62852cfc9decd93a3f7c037bb88c33ee
-
SHA256
a5c5fe498a1e31a91dea78f9f203475ccb9b620b0155ba7924bf492055ff9d2d
-
SHA512
d4223ee06ba3c169c212a25e1f3dc68bbb9f4c775b67895d609a25b3c8e1a3d37fccb7397b59c900bbddcea70784835b5f3a86356680f249095a7f9cc9f0e268
-
SSDEEP
196608:+sqbVwW8Od2Rh+MHAozYKdPccoMEP5Uz1RMmizLjhPB:+sUVwWnM5kKdj++zfMpPjb
Malware Config
Signatures
-
Detects executables packed with VMProtect. 2 IoCs
resource yara_rule behavioral2/files/0x000700000002329e-213.dat INDICATOR_EXE_Packed_VMProtect behavioral2/files/0x000700000002329d-217.dat INDICATOR_EXE_Packed_VMProtect -
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/files/0x000200000001e32b-229.dat UPX behavioral2/memory/4888-233-0x0000000010000000-0x0000000010176000-memory.dmp UPX behavioral2/memory/4888-241-0x0000000010000000-0x0000000010176000-memory.dmp UPX behavioral2/memory/4888-242-0x0000000010000000-0x0000000010176000-memory.dmp UPX -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000200000001e32b-229.dat acprotect -
Loads dropped DLL 5 IoCs
pid Process 4888 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe 4888 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe 4888 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe 4888 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe 4888 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe -
resource yara_rule behavioral2/files/0x000200000001e32b-229.dat upx behavioral2/memory/4888-233-0x0000000010000000-0x0000000010176000-memory.dmp upx behavioral2/memory/4888-241-0x0000000010000000-0x0000000010176000-memory.dmp upx behavioral2/memory/4888-242-0x0000000010000000-0x0000000010176000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\dm.dll 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe File opened for modification C:\Windows\SysWOW64\dm.dll 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe = "10000" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe -
Modifies registry class 37 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CLSID\ = "{26037A0E-7CBD-4FFF-9C63-56F2D0770214}" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InprocServer32\ = "C:\\Windows\\SysWow64\\dm.dll" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\HELPDIR 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CurVer 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\ = "{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\ = "dm.dmsoft" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InprocServer32 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\Version = "1.0" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214} 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\0 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\0\win32 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C} 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CurVer\ = "dm.dmsoft" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D} 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\ = "Dm" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\FLAGS 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ = "Idmsoft" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\Version = "1.0" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CLSID 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\ProgID 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\ProgID\ = "dm.dmsoft" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InprocServer32\ThreadingModel = "Apartment" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C} 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\ = "dm.dmsoft" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\FLAGS\ = "0" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\dm.dll" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ = "Idmsoft" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\ = "{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}" 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4888 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe 4888 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe 4888 2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-04_73c91787f2db475b88b8bc58394872c3_bkransomware.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4888
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:81⤵PID:3288
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD5a03db8a3622fa9f6ff51765ca145e5ad
SHA19436684c2fea17c9a0b704872f79eb7257d94bb8
SHA256fe3ba07a52618342e47087c73ee7e7bfc0ea841b8f5cb458afc1ef36ad022707
SHA51274dc48ccadfbe980d4a3e4c47195c63050dc90067d8048898fd48dc8fec9358c58d127e90a3f23080a4318f0e2f59bc40d9f1814c0ca2b058f223af34d33dc42
-
Filesize
1.3MB
MD50fdc79cafb9898d0ef79db7eec184f03
SHA1db3a53eca9ade3f473776fd473f7cbe8751c969b
SHA25622a25e408bb431ad311a8f8ea5c205ec228652df8963701e614b08e6b327b8fd
SHA512fd76fe4021677382039c4e4b75fdc76e63cb6f2259ffbbecf477fe8f5b207c8fe8cd1cb8344f6c10b106c5ef2798b2a5ec9fe729c4524570de23e3fcdb239589
-
Filesize
548B
MD5e0d3ed5e1e56fb11bfcfe6bd945c206b
SHA18ba212b241655110ed394be25e355c7335c56262
SHA256f1e4ca14df25cf1d6313d38f461e9dcedebaa889ade70a7e8a404193f94c23c5
SHA512efd658174054a9b80217135e770d830ee51eb3942d474e91bd52137ab091f1d354b4c0d48efb7eccf47bd8b5c5cd8c56e543ac68e7b9c9474ff46c23ade9aa34
-
Filesize
744B
MD598bf6ad36aedcbb35ea5544f8a98dcb7
SHA1d25c1994126310144f70aa69110fe602f96b7af7
SHA256cc307b058485bd3f237a3a32419d02eca4bfc93e8e8b18ffe8544d95c28d99c2
SHA512c36a34ef51eb2867124e23790e57a4ca05983a694f7fafad8b5e3fdcb627eded7fe148390fc84032e6cf8b9c46578680e56af269d5d0bdcd0e1863070a6f3231
-
Filesize
588B
MD5a3dc01997eadb6b6cd644aa94a094a4a
SHA1596a1f64f7c36f98a804d437c0503ff95e089a13
SHA256aa6802e771b59b1b1d79009acf36162cbc115260ad3f91031422237c98287e5d
SHA5124f4dc13857d9e554f888c05339aefdf22565acf4cbab7ebc6d4dd0be5b0b7b66a2b174257802c9d8fd4fd3c8451b330e8b6e19faed90fdc09ed80f98598a304a
-
Filesize
1020B
MD52aae8d9a47e732d36dd4985c98aa7eaa
SHA113417613eb03c042863f51e0e3c438b936074fcd
SHA256bb40e6f90d70632f80eea20d1f53d92c3cd46767cf37a70bd83a397ee3c66b78
SHA5128ec40d3710615d05c49853bdf40c7ef3560ad26c5dbbfde7be38bd0c667f6f1d408c2e3d975549bf2190791f5d3722c01647d2e5dcfd8d83d870c43858e81010
-
Filesize
1020B
MD5c4315ec0f35457fe11bb5eaf262b1720
SHA1034c087abc82b2d709d6a43075856619e33b8440
SHA256baa6bd72934642df6697479be1d96f17b8b370e631e4b8dfb0bc321fd6df46e2
SHA512bcc945a8d00ee39a4e4634132595ebae626bda1d3fc1178a518c7e8ad05be8bc7615ea70008922cf3c3ece8692e8dbb2273be2e71eaf68bceaa6825dd9f4af01
-
Filesize
1KB
MD546c8704a8bea749d676eb90dc5a0f815
SHA1eb5273b38ac0201bf1224245a1a3afe2d084a7bf
SHA256c7ab145e7154c3bbcbdc93c90d5f54dd287a000728ee2acfdf3d5142177ebd3e
SHA51225d7cb87c795f095d2772b7cc42baca256fafbdf403125b492269c906d691e1f4315a305217557dd2402b1456da6b4a2720abd53fd9abe532bd74d2d11166a64
-
Filesize
1.2MB
MD5430b269ba6ae3ae72b7c76848fc3dd8c
SHA19c1e62f6ccfd0661ccc5e8b95abff394fca4052e
SHA2562f422a4ed4bec519c8840436cabaffe2ef4244630829ba1ebb3b806a871cb26f
SHA51261ac557cc1169ceb0b83a2ef41d4e697efee0fcd3472d2a9bb0f04199430698c7a162be2c607bde0a6bb24ec68fcb3b6faebd1bfef264846250b2789dd9cee2a
-
Filesize
804KB
MD5c578b6820bda5689940560147c6e5ffc
SHA1922e50d89c9c44bdc205ef17aa57212b64e58852
SHA2563b6ddc32b800a18b21a819e842cbfdd57cb065fd92cc69545e0ef29b97cfd389
SHA5129f2a1bb5788ad245242d12968bbf198af2694a87c6e2342f14672e8c14e8489dd3319434592fc9b20f620557d0fa58482903d19c7f5ba32456a1e4076dc1bb85