Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08/06/2024, 20:33

General

  • Target

    2024-06-08_490cc71f335c60d7e0655c8258dba016_bkransomware.exe

  • Size

    71KB

  • MD5

    490cc71f335c60d7e0655c8258dba016

  • SHA1

    41d67dccb05c9baeb4b9bdc6263ad1b2a1caee77

  • SHA256

    ab0f890a4d3ebd0611f77ff7018453eac882a131a815b68798f73ff45d5c4fa3

  • SHA512

    32e6bb4c1644881b326b7e2eba921e101c7472a5533edc8372e9a18c804fb1c9272958e2b88baa7f3cc88ea864dce4b8c61d6645d76dda70dbd985f66656824f

  • SSDEEP

    1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazT7:ZRpAyazIliazT7

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-08_490cc71f335c60d7e0655c8258dba016_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-08_490cc71f335c60d7e0655c8258dba016_bkransomware.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2452
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2844

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\cjnACliiHABoqMh.exe

          Filesize

          71KB

          MD5

          9c70e3e3fa178cd80940079b570667d5

          SHA1

          d7f8af9dfb0527bf92bc6198414dee2d56a5f0d9

          SHA256

          c74cfbaa3095aecb5a7f40ba2a052af25d2eb8aa6195ef5fb44098719fe2b973

          SHA512

          ea8710abf7941b60c9d15070fb040d65863927b1a158b8ac0db25d18884e11c80d9eea7c868fe0de8c5ddddd1b7ddf45b7ce828f25835ea10b77e96b4b8e16df

        • C:\Windows\CTS.exe

          Filesize

          71KB

          MD5

          f9d4ab0a726adc9b5e4b7d7b724912f1

          SHA1

          3d42ca2098475924f70ee4a831c4f003b4682328

          SHA256

          b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc

          SHA512

          22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432