c533c7aa25582fd7496e0fb8c6f84f82435aff99e8e0c7097f3392405059d677

Analysis

max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-06_a151a32a0232239c8ea251c707aad212_bkransomware.exe
Size

13.3MB
MD5

a151a32a0232239c8ea251c707aad212
SHA1

a7cc96caa50f9cea4f3de9d31bd0fddb5638e9e6
SHA256

c533c7aa25582fd7496e0fb8c6f84f82435aff99e8e0c7097f3392405059d677
SHA512

ccb21be8743e263d0ac7d5763b62c8699fd91cfcdc5a2cde4814556932be444218a90be2f8df1cdbcb4bebe97b9b3cc21b2f35e1d7b3cf74cca2b52a175829bf
SSDEEP

98304:DJtjRMNT7Fn4xFzxKNzeIoZIaSv83J9r0fPEEy:NSTRnmFzxK9on/3J9oHa

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2024-06-06_a151a32a0232239c8ea251c707aad212_bkransomware.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	2024-06-06_a151a32a0232239c8ea251c707aad212_bkransomware.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3860	2024-06-06_a151a32a0232239c8ea251c707aad212_bkransomware.exe

C:\Users\Admin\AppData\Local\Temp\2024-06-06_a151a32a0232239c8ea251c707aad212_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-06_a151a32a0232239c8ea251c707aad212_bkransomware.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\msoia.exe_Rules.xml

Filesize
13.3MB

MD5
bc153cb81a30d9827ba339137ece131e

SHA1
e4632f1d5d26b9936b62aa8e1f623c1799c4eba9

SHA256
3b1df28856b3dd95a32a4f0ad4622f5746c06b6cdbae28977ac13f344bae3ced

SHA512
1c7e3d0a8be1651ded3f39f07fd664a49e6a4da793d178b60c9e6f918a29da16464e60acb39f265a904c24735d943f717cfdf26fb5a05214c4f87caa004a09b8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads