fe16631362752954aca7b7686e7058ced59ae0733bd69787e4e397e3d40519a5

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-11_15993f4d8eedb712fc67269aef2d052c_bkransomware.exe
Size

332KB
MD5

15993f4d8eedb712fc67269aef2d052c
SHA1

c22ebb52c6645a213fd136a47f489f74e686c850
SHA256

fe16631362752954aca7b7686e7058ced59ae0733bd69787e4e397e3d40519a5
SHA512

600e3536c94a3e12d5a54c826c6c14c1f862e13c53537f9bd13491a7407716d68fec89d456d799ba09eee5b1f5989586d71fc4a914e744d1daaeb31fe2718470
SSDEEP

6144:hZMazW8I9yn2tYIut9sXyeboTrMCCJe3OKN6stOMwuDFDe:hS0W8zSGt9jeboTrMLJeOKpwuBDe

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4476	3w9vJsC60UqIi1E.exe
4960	CTS.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2024-06-11_15993f4d8eedb712fc67269aef2d052c_bkransomware.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	2024-06-11_15993f4d8eedb712fc67269aef2d052c_bkransomware.exe
File created	C:\Windows\CTS.exe	CTS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	2024-06-11_15993f4d8eedb712fc67269aef2d052c_bkransomware.exe
Token: SeDebugPrivilege	4960	CTS.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 4476	2028	2024-06-11_15993f4d8eedb712fc67269aef2d052c_bkransomware.exe	82
PID 2028 wrote to memory of 4476	2028	2024-06-11_15993f4d8eedb712fc67269aef2d052c_bkransomware.exe	82
PID 2028 wrote to memory of 4960	2028	2024-06-11_15993f4d8eedb712fc67269aef2d052c_bkransomware.exe	84
PID 2028 wrote to memory of 4960	2028	2024-06-11_15993f4d8eedb712fc67269aef2d052c_bkransomware.exe	84
PID 2028 wrote to memory of 4960	2028	2024-06-11_15993f4d8eedb712fc67269aef2d052c_bkransomware.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-06-11_15993f4d8eedb712fc67269aef2d052c_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-11_15993f4d8eedb712fc67269aef2d052c_bkransomware.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\3w9vJsC60UqIi1E.exe
  C:\Users\Admin\AppData\Local\Temp\3w9vJsC60UqIi1E.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Filesize
394KB

MD5
17cce79db333e7425da774de0443a424

SHA1
6fd4ccf71578ebdf1c06baccc10a21b01c3a2ddf

SHA256
5ebbe2d7a6aca3a20858e648f547a8087b38f6db8cad6f68980d38f3bf30dd69

SHA512
4e3c3acd384211c499b23e2f3be1ccf93c90ee83bd71afae296c86b7a873123ec7b11a7bca56eb3c6ddfe7ea5bb33eb98d36ee966041134bf5df640d21925219

Download Submit
C:\Users\Admin\AppData\Local\Temp\3w9vJsC60UqIi1E.exe

Filesize
261KB

MD5
9dce6a120d094e5c925b967c4bb36277

SHA1
1ab60840e8d8ed14619fab2d1559f989f01f01a9

SHA256
3052784f3683c2bbe95f59560eb311e75f1eac7aa5476a91bbd9fe4d2aef880a

SHA512
20a7a4b8ecb1262ed730c8299ad0ada2ad93327f0886e5fdefc89564ff7510595ec53ac5aa88747e0548315c3037125d83756e3ae4d9a813cc553c12991c94df

Download Submit
C:\Users\Admin\AppData\Local\Temp\3w9vJsC60UqIi1E.exe

Filesize
332KB

MD5
1f5e12f03d592d906a856920324d4ca6

SHA1
44a2977498bc7e2f6c1d826f46bd8bc1d064a38d

SHA256
ad2cb829873d4f972c3386de93d39475cbadaaf65608ab5ad627c9c392e371f5

SHA512
34ae3b174476de63aa17e6b806e7541f1ee5caab71da64b9456e5df94094824f7d9056ad689c44a5426fc6d9d52f9778956c4a1c1f543e21d471a75d1c6f4ea0

Download Submit
C:\Windows\CTS.exe

Filesize
71KB

MD5
66df4ffab62e674af2e75b163563fc0b

SHA1
dec8a197312e41eeb3cfef01cb2a443f0205cd6e

SHA256
075a6eecd8da1795532318f9cf880efe42461f9464d63f74deb271d33110f163

SHA512
1588dd78e6e8972013c40cdb6acfb84c8df7b081197233ce621904b645356c805d0424bb93dd46c55834dc47d9ff39ee1323cf8e670841b3fff24ab98ba87f25

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads