e101f7550db0f220224e846a6a14da87450d2e401af676dc98c45aaf1cb22404

Analysis

max time kernel
93s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-13_9a9168e5de25fc2ff66702805cb63db4_bkransomware.exe
Size 71KB
Sample240613-ebe95swhqj
SHA256 e101f7550db0f220224e846a6a14da87450d2e401af676dc98c45aaf1cb22404
MD5 9a9168e5de25fc2ff66702805cb63db4
SHA1 a1b6b0fd7f88f08fd2c73c00dedda115d726e8f9
SHA512 13f001d00f44bcca8f74b06d9ce0fdc5889453f4720d3ab2c3a556fc5ee9877a15d2fee48890b66d8fdf7fa074f1bf7c227c6850566f7621f8b0105e142d83ab
SSDEEP 1536:Fc897UsWjcd9w+AyabjDbxE+MwmvlDuazTO:ZhpAyazIlyazTO
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
220	CTS.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2024-06-13_9a9168e5de25fc2ff66702805cb63db4_bkransomware.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	2024-06-13_9a9168e5de25fc2ff66702805cb63db4_bkransomware.exe
File created	C:\Windows\CTS.exe	CTS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3000	2024-06-13_9a9168e5de25fc2ff66702805cb63db4_bkransomware.exe
Token: SeDebugPrivilege	220	CTS.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 220	3000	2024-06-13_9a9168e5de25fc2ff66702805cb63db4_bkransomware.exe	82
PID 3000 wrote to memory of 220	3000	2024-06-13_9a9168e5de25fc2ff66702805cb63db4_bkransomware.exe	82
PID 3000 wrote to memory of 220	3000	2024-06-13_9a9168e5de25fc2ff66702805cb63db4_bkransomware.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-06-13_9a9168e5de25fc2ff66702805cb63db4_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-13_9a9168e5de25fc2ff66702805cb63db4_bkransomware.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

excel.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Size 392KB
SHA256 1433f659bae2a21a46f4c15c72d38c5158668ef90e838eabe01545d36edbfc11
MD5 588378ecff439c4526c7e4c52c08ef9a
SHA1 7c07db303e1b9a752f89b4d5d66ee199ddc27b41
SHA512 95d58898236bb3803766762c246f160a7a81703f7a30c661a29a10a7a2f5127c6da8393f0eda964ba82527dc19d6413535f515091ee5717b200b9f06247cfd59
SSDEEP 12288:hS0R7W6o2btmVZS06p4eOWeqNqdJE9AFI:Dzo25mVOz10k9AFI
MD5 SHA1 SHA512 SSDEEP

Submit Download

o59F1Hlo5AJliII.exe

Path C:\Users\Admin\AppData\Local\Temp\o59F1Hlo5AJliII.exe
Size 71KB
SHA256 492897401b2144711f7f6539e3165acde52912029c51520bb243c21274a4617d
MD5 b675ec69f7f2680f089b5322df4af297
SHA1 14966fce605fb22d9e335066be00791f8ac7fb3c
SHA512 16284705a8d6d33232c804a3290fbde565b89044d5e56d00ed165ae22352d304d3228871e263d6b91e5a0aac226f57cf3da794ebf7dfcf218a6a9e21326ea3ed
SSDEEP 1536:Fc897UsWjcd9w+AyabjDbxE+MwmvlDuazTI:ZhpAyazIlyazTI
MD5 SHA1 SHA512 SSDEEP

Submit Download

CTS.exe

Path C:\Windows\CTS.exe
Size 71KB
SHA256 075a6eecd8da1795532318f9cf880efe42461f9464d63f74deb271d33110f163
MD5 66df4ffab62e674af2e75b163563fc0b
SHA1 dec8a197312e41eeb3cfef01cb2a443f0205cd6e
SHA512 1588dd78e6e8972013c40cdb6acfb84c8df7b081197233ce621904b645356c805d0424bb93dd46c55834dc47d9ff39ee1323cf8e670841b3fff24ab98ba87f25
SSDEEP 1536:Fc897UsWjcd9w+AyabjDbxE+MwmvlDuazT:ZhpAyazIlyazT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads