Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 04:25

General

  • Target

    2024-06-13_3a5b1baa996b35b243dd161b3e4b292a_bkransomware.exe

  • Size

    71KB

  • MD5

    3a5b1baa996b35b243dd161b3e4b292a

  • SHA1

    998fc1e4f533139fa5a4205305c99b58e2aaab15

  • SHA256

    b732cd56ad5917c6e082eb84073c11575c1b4db0560d5257a204112d081c7bae

  • SHA512

    6148ae456f6faa526e76ff00ff61514ee831e060890fc3a70dd59be23ddbe4f02204dc2e0cc30e2d993208e0a870b9a1431c5bc836ad30a3d0a8019d9ff1a429

  • SSDEEP

    1536:Fc897UsWjcd9w+AyabjDbxE+MwmvlDuazTC:ZhpAyazIlyazTC

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-13_3a5b1baa996b35b243dd161b3e4b292a_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-13_3a5b1baa996b35b243dd161b3e4b292a_bkransomware.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1860
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\QGDIMOtOf2FSLiS.exe

    Filesize

    71KB

    MD5

    cec80b3a0758cda009f483214caae369

    SHA1

    85191d763632804b7ac60d712614ea3aea7a4b5a

    SHA256

    123dece3768ea57b3b481bdaf46130146fa768d0f4863b5b90cc000923d728d4

    SHA512

    2e3795a9d4610b9655534eb821415716d3331e40dea39b92188a69327ba4a477e5d7c9e051495a8f8c5a36fca5448701ceeda3b5658610858d6c0ce1292b7e45

  • C:\Windows\CTS.exe

    Filesize

    71KB

    MD5

    66df4ffab62e674af2e75b163563fc0b

    SHA1

    dec8a197312e41eeb3cfef01cb2a443f0205cd6e

    SHA256

    075a6eecd8da1795532318f9cf880efe42461f9464d63f74deb271d33110f163

    SHA512

    1588dd78e6e8972013c40cdb6acfb84c8df7b081197233ce621904b645356c805d0424bb93dd46c55834dc47d9ff39ee1323cf8e670841b3fff24ab98ba87f25