Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 18:28
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe
-
Size
1.3MB
-
MD5
183f1b1f3e62361c9d3b6f7b8d0c0ac0
-
SHA1
38413d1f260884387308b1f5c79fb1525e06e679
-
SHA256
09171c9dac4c7e0106d83653baded7108fa6ce7f218be6e2e93c41e8efc3ca59
-
SHA512
3872d07614bf4d67c9b8514329c61e350009a36833135a24fa58fa66e5824f6a0db037f8391c3b638a0b113d82a946e2c996fb427b0d69be19a34c689a68d889
-
SSDEEP
24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakZ:7rKo4ZwCOnYjVmJPai
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2192 set thread context of 1520 2192 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 28 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1520 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 1520 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 1520 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 1520 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 1520 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2192 wrote to memory of 1520 2192 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 28 PID 2192 wrote to memory of 1520 2192 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 28 PID 2192 wrote to memory of 1520 2192 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 28 PID 2192 wrote to memory of 1520 2192 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 28 PID 2192 wrote to memory of 1520 2192 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 28 PID 2192 wrote to memory of 1520 2192 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 28 PID 2192 wrote to memory of 1520 2192 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 28 PID 2192 wrote to memory of 1520 2192 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 28 PID 2192 wrote to memory of 1520 2192 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 28 PID 2192 wrote to memory of 1520 2192 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 28 PID 2192 wrote to memory of 1520 2192 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1520
-