Analysis
-
max time kernel
51s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 18:28
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe
-
Size
1.3MB
-
MD5
183f1b1f3e62361c9d3b6f7b8d0c0ac0
-
SHA1
38413d1f260884387308b1f5c79fb1525e06e679
-
SHA256
09171c9dac4c7e0106d83653baded7108fa6ce7f218be6e2e93c41e8efc3ca59
-
SHA512
3872d07614bf4d67c9b8514329c61e350009a36833135a24fa58fa66e5824f6a0db037f8391c3b638a0b113d82a946e2c996fb427b0d69be19a34c689a68d889
-
SSDEEP
24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakZ:7rKo4ZwCOnYjVmJPai
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 624 set thread context of 4704 624 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 80 -
Program crash 2 IoCs
pid pid_target Process procid_target 1264 4704 WerFault.exe 80 1912 4704 WerFault.exe 80 -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4704 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 4704 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 4704 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 4704 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 4704 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 624 wrote to memory of 4704 624 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 80 PID 624 wrote to memory of 4704 624 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 80 PID 624 wrote to memory of 4704 624 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 80 PID 624 wrote to memory of 4704 624 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 80 PID 624 wrote to memory of 4704 624 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 80 PID 624 wrote to memory of 4704 624 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 80 PID 624 wrote to memory of 4704 624 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 80 PID 624 wrote to memory of 4704 624 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 80 PID 624 wrote to memory of 4704 624 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 80 PID 624 wrote to memory of 4704 624 2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\2024-06-12_183f1b1f3e62361c9d3b6f7b8d0c0ac0_bkransomware_buzus.exe2⤵
- Suspicious use of SetWindowsHookEx
PID:4704 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 19283⤵
- Program crash
PID:1912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 19643⤵
- Program crash
PID:1264
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4704 -ip 47041⤵PID:3632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4704 -ip 47041⤵PID:4612