Analysis

  • max time kernel
    142s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-06-2024 10:50

General

  • Target

    2024-06-15_22120b87cbe5e194246fa4f19db74678_bkransomware.exe

  • Size

    3.7MB

  • MD5

    22120b87cbe5e194246fa4f19db74678

  • SHA1

    b716709f5328e5680a84cdaf73e505beffb6d7df

  • SHA256

    52deae9d2143ef00e3334135c119aca8e867b4231c27d6565fa0778fb1a57e59

  • SHA512

    41a0781d90016c71d2fe193fc38b699a992728d693e5df10cb0791974eb68ddcca926f9f8aa73b16d07447582cc661c2554909d67c61cf83b919a11c958bd921

  • SSDEEP

    98304:6jAnEcfx1KvmrS26gga/bIPajNHH9syAOhyvKD8G7szHFu:7Ec3Agjp3sDOhyvYR7s78

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-15_22120b87cbe5e194246fa4f19db74678_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-15_22120b87cbe5e194246fa4f19db74678_bkransomware.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4292
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ssd-life.com/eng/why-ssd-not-found.html
      2⤵
        PID:2932
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=3644 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:1
      1⤵
        PID:1000
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4820 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:1
        1⤵
          PID:1920
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4520 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
          1⤵
            PID:4828
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5756 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:1
            1⤵
              PID:4560
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5524 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
              1⤵
                PID:3620
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5520 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
                1⤵
                  PID:1212

                Network

                MITRE ATT&CK Matrix ATT&CK v13

                Persistence

                Pre-OS Boot

                1
                T1542

                Bootkit

                1
                T1542.003

                Defense Evasion

                Pre-OS Boot

                1
                T1542

                Bootkit

                1
                T1542.003

                Discovery

                System Information Discovery

                1
                T1082

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\laF915.tmp
                  Filesize

                  44KB

                  MD5

                  1c9c8f4c4ec16502045d308f365a3af1

                  SHA1

                  b82728c632d3d87b4ccbb170b420097b43490274

                  SHA256

                  33292b4403ad1eb74b1106a7d603a7c0a04046e1bff39bdbd77544f362756eb5

                  SHA512

                  daacc2ec3c3b981b397e3a3fbc3cf5cb884dd1b90a3ca7d87f39b8e4d62706c2393bf0ee7ef50fbea66fdab22cab392c80fb8c638ba80b35cdb14bb8d2526fee