Analysis

  • max time kernel
    95s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/06/2024, 20:33

General

  • Target

    2024-06-08_490cc71f335c60d7e0655c8258dba016_bkransomware.exe

  • Size

    71KB

  • MD5

    490cc71f335c60d7e0655c8258dba016

  • SHA1

    41d67dccb05c9baeb4b9bdc6263ad1b2a1caee77

  • SHA256

    ab0f890a4d3ebd0611f77ff7018453eac882a131a815b68798f73ff45d5c4fa3

  • SHA512

    32e6bb4c1644881b326b7e2eba921e101c7472a5533edc8372e9a18c804fb1c9272958e2b88baa7f3cc88ea864dce4b8c61d6645d76dda70dbd985f66656824f

  • SSDEEP

    1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazT7:ZRpAyazIliazT7

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-08_490cc71f335c60d7e0655c8258dba016_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-08_490cc71f335c60d7e0655c8258dba016_bkransomware.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2324
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1692

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

          Filesize

          394KB

          MD5

          943cdd802b2f6ef59efdb08624c42e60

          SHA1

          b686995f022711c56a81f10a771730871a9d83dd

          SHA256

          a2cc877ead25628e93d41909f8f5cc1e2a1bd1e35df734d53655206c8e34d8d3

          SHA512

          8f8b8e1d9a54926e67a23553820e7f9f20f895e40924ca003b0a1361eee5a627b201985456279b6d91239e8c8b5e0d8f5df1f824fdf047265fb098704ba918db

        • C:\Users\Admin\AppData\Local\Temp\MxZmWNAGJX7ADo2.exe

          Filesize

          71KB

          MD5

          fdfc604ac6340c19f4a59d8ee2610017

          SHA1

          5397e6a29fde3a1856c1a06d17444b17f6b74cb7

          SHA256

          c6ad9dc281d1ab8fd6f75f5491c43a557612d022873d2e0edbae823dc7d02505

          SHA512

          d7224a7972b53286d0ebab0c48cc39f832363772d5d43ccd6fdeee9e282db3cc13af5ff8d2cc6ecb84e6c9e926141d4074507b30a8f799054d4d70fd49211492

        • C:\Windows\CTS.exe

          Filesize

          71KB

          MD5

          f9d4ab0a726adc9b5e4b7d7b724912f1

          SHA1

          3d42ca2098475924f70ee4a831c4f003b4682328

          SHA256

          b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc

          SHA512

          22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432