Analysis

  • max time kernel
    51s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/06/2024, 11:38

General

  • Target

    2024-06-16_6ee709ee51cc7adc5f01acf44eb7b4c9_bkransomware.exe

  • Size

    174KB

  • MD5

    6ee709ee51cc7adc5f01acf44eb7b4c9

  • SHA1

    1c1ae7798f31fd194cdc844a3977fb90a9d7b593

  • SHA256

    5fd062ba8c0642cb519ea307fd3a4d9ed710328547de1ddb3371c18fbd46f063

  • SHA512

    c04586d5295f44af497c7af453e20ddcebea0d9d45ff72ba87791b2d677d53e108f4793e1eebc125240dea88bd3f539b9446bcf692f6cd7b76f3cb243bdedd4f

  • SSDEEP

    3072:ZRpAyazIliazTx6DFfblDKsSBwUnQpS3FtFNqTqaz3zT59mi6Ue:xZ8azduF58wUQpSVtFoTquzKi4

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-16_6ee709ee51cc7adc5f01acf44eb7b4c9_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-16_6ee709ee51cc7adc5f01acf44eb7b4c9_bkransomware.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:372
    • C:\Users\Admin\AppData\Local\Temp\G0fSq9ab8eGIoJ1.exe
      C:\Users\Admin\AppData\Local\Temp\G0fSq9ab8eGIoJ1.exe
      2⤵
      • Executes dropped EXE
      PID:2944
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:3268

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

    Filesize

    394KB

    MD5

    db6295bb91d09e135bbeb300752bb896

    SHA1

    bb6e14303be785d7c017cecfadd8b5e788e0c692

    SHA256

    0578cc889549f5218e4e5ef692023dd176cdf61f36dadfc9a6ad7a96e8dd6fd6

    SHA512

    e9c961aa171de5ed5feb9ebb6e7884a3f53efdebf490da45af86d9a79bec0a594762bbeae8cfb119f362e50bc47bba3f55b7c49ad294b149fac4850c25d4bd96

  • C:\Users\Admin\AppData\Local\Temp\G0fSq9ab8eGIoJ1.exe

    Filesize

    103KB

    MD5

    e4d92b5ef0a285e516346f7cfdb4e28a

    SHA1

    6f8ef7957e10b7a05e05a9627c6694787105af24

    SHA256

    9b3e52a8c3bb12380d3e87f470f76ef48a1eb570bbc83de17b7ed10aee398f5d

    SHA512

    b65cd1855a73ab028482e2dc183b61874f45373e1f9cae3b14ca9fe8bb25172117b37594c052df5ee4d7dfae36199e7c7139b18afb61153fe3aac0feaefa705a

  • C:\Windows\CTS.exe

    Filesize

    71KB

    MD5

    f9d4ab0a726adc9b5e4b7d7b724912f1

    SHA1

    3d42ca2098475924f70ee4a831c4f003b4682328

    SHA256

    b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc

    SHA512

    22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432