Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
24/06/2024, 16:58
General
-
Target
2024-06-24_af4829afa8b7ec1faf89bc0f7c982d9e_bkransomware.exe
-
Size
1.8MB
-
MD5
af4829afa8b7ec1faf89bc0f7c982d9e
-
SHA1
681528afb2022682de588820c3b223136644e361
-
SHA256
cc48129c4457460c4ebe6cdee9dc03789b760e92232f045ee404383dc59118ce
-
SHA512
e64f282fe7286e78ecc4d03e442c33b743daae10da08d5be7a625d7030cc6ffd9b6828551f6b35ee6c00cbaa27805cb04190da36f7dca75e40b2965bd10d979f
-
SSDEEP
49152:ME19+ApwXk1QE1RzsEQPaxHN2/snji6attJM:x93wXmoKeEnW6at
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_af4829afa8b7ec1faf89bc0f7c982d9e_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-24_af4829afa8b7ec1faf89bc0f7c982d9e_bkransomware.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3872 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD530c19aabec3b95a291a56b8cbdc4a299
SHA12930a32b3125d9176972b458359428a3a1614166
SHA2564ff1c789b8c8565d4c6708bf37d91904ae0770ad980d38b5d91d5b718e666200
SHA51256a21f8397b1c2390aa973dea8586035a91d450d1f62b65df74381184d9846608d94ed7a01682e84be5f159f915c9e6eb196357a7a107855f811c74ea6537017
-
Filesize
781KB
MD57e7390d7075c55cd315e80ad59771c55
SHA1d12c6b4c6ba8ed713e96909e36aac4bc14a87bff
SHA256488f4dfbe760bd38c8f57b9582d391950e2e59dfea7098e394f1ae2d35bae25f
SHA51238728645c56ae2f844e08e3f1c6f198c83d5074b7544a8b361f84bb261a7499c59fea44ba266a3abb7af67cd157d4027bc14ed37e31a8978e93740334537abc1
-
Filesize
805KB
MD5685d977bd9cf93aecbf2b465475a88bd
SHA1163a94ba4a60bf767e3b4add43ff8e27b343b392
SHA256b5d5ed169be273e6f16a6d786654589a6c584500ec3b8305d4d213b532fab855
SHA5126f9e82ffabb6565153bb943d1c4397dd3838e1a8965248597d7930e99eed752814f27dacfca92ed8612abbe3ee02780f2afd732c31d60a01b6877e6359f57260
-
Filesize
2.1MB
MD5de6e26bc673e080b3796088ac14cc320
SHA1e6e900d6c09cd3c0a0beb8804eeff166c86cf2db
SHA256151d7bac8fb79a1a7e47266229e411caa2051dc02733352e0c8b3df13c6346ee
SHA512352c5ad34dae705009acc4eba80a4c014464171eb450dbabc78f508474df8e5675d2b7442f4365c6c05d966ecb0fa1fc6460480ff2cc0c48b23530b13a110845
-
Filesize
588KB
MD5f846f4f3dfab65def9f6ae5951b9eca8
SHA1a383600174735195598a714c4fdb7d799dd23c07
SHA2562c37fc7e22a843045c5b985ce354650643a071d15b8ea8c8d4832b98ad4d11d4
SHA512f408ce56cad98e68e8b98bf33942c0463ca28666b185a68d2ad72250833a3ac6020757735a8ba2bedcd7660310beacdd5bd4b24172df54001634d28511f8e758
-
Filesize
1.7MB
MD5c27d73a288e8f171a93d10dd94f17db8
SHA14a938ec24f2b99bb38726c1740ac7e7d1f16e871
SHA256c37ac0494732d31bba476e221a4c1049583427a8407f3eaaf3248ce56495dde6
SHA512a3f29b6aef71b0667f1b72e6cce26ba59d67584b4833d528ea3e1ef98919d26140b64209c2e9ac7b79717cf3af49603b993b7e82245fb356f07d3e2d3bdde0f0
-
Filesize
659KB
MD5b4bec9ee2dd0a4b938137366a574ad86
SHA15e6d77b92ee1beef10535b1adcf93da9b1e6710e
SHA256ad8e57e32e3ff6816dcd1dd346f29d41c48c064b83a1ef45afe599859868d86e
SHA512923f88706f969c1f2d8cec87f5a596127a04e22c281cd957c5b360f937b375eaac8f7aa8b010dc38dd4c8be3b817f2cce089d4b5113d462380bca601c83e7143
-
Filesize
1.2MB
MD546c404991a74bbf7632940cadf6b9c77
SHA1f7a023872dd84b8e7d91e6c9be028554c258d35a
SHA2563b922b034a812e4bf46c5150bc4607522e6391ec2d9c1c7c65def501889b856b
SHA512ff7a37515b39a3b9af20cb7414d637edfa0cc7171998db39adc396799ede6a184165323c22e2d7f11b56dd4fab2e0cde2d16357b0fcff378520c4fadf1c7119e
-
Filesize
578KB
MD50a334399afeae618a43318c87109ad20
SHA1488a7652c423243f0c92a00f1cddcaba735b972d
SHA256549912a84a74bb1f1218dd8d6c36b2e5378d2ed7d95d5090c3a84fd1469b2901
SHA5122046855069623afb1b06f5ff05351ff6b06343ecb80ff3d4aa927fe02eac8223be3d4aa5fc6ad5c0e1d4906e6d79b1d1f4f657574246e88139962ae85a88bf44
-
Filesize
940KB
MD5dc89a27c71552217f7e1671201023455
SHA1ee431b47bed8937214819443824b12dbc499b91e
SHA2566451de4403565a7976419433d06381c44bb5c68467a27d9d409f257e1985300a
SHA512246f4cf2fc1fde85f7f45098d6795f17e735f9157b914a674d9cef9a882b4460099cd00f69ef5571d8d8ddc6c51a04ac2a5cd813ac9600dcea86940bab675546
-
Filesize
671KB
MD51674eff0c3e7d2f972eabe4ff8855789
SHA197832307e353b4db386fda65a9bf6bacb1319c23
SHA25672b6efea243ab041af7b7119b4f33557d19030427da348d1fd9a550d654a0c95
SHA512223418f8b3697bef7fafaee12a74bb6e10ed0f202ec0a0d7ea71a4887947c2a8f75320cf8778b394c27b826bb18abfcae9b6205eab16e7e14fef6f8fdf81e44f
-
Filesize
1.4MB
MD5feb2bffa68d17b420453f1d646de8836
SHA12968adae70396a3041612a3c63afbe27905c1e13
SHA2569b9148563cef9e7527ccacd6deade3f26653780d121d0916a7f5f127982da6e1
SHA5127227933acfcb4e5c3ea77228c59a049241903346ddba5b618817c40e7a537f8d8f2009f48ee29525c536d8b67ae69863fb0809de803a0825ac78a5fbbfd7c7a1
-
Filesize
1.8MB
MD508203db77c82cde0f8a6da9bf778f8f8
SHA100fdc3d608ae48112771092d693abc376559f1c7
SHA2569bcf866453695e0ae1d15b9a863d89981ae7bf9b30ac5ced399c64274927eff3
SHA51235e1d02257caa7485e38edc39e8fafbd872eb740c90e643ba1c06130319e3d662b58b084ad43f5c7f9425ca594d72c8017fe77246342172af475e328a132ee94
-
Filesize
1.4MB
MD5e2380df6a7570b728bebed3b7733e7b0
SHA19d99d9cb262ba3584e4875e66f00a6309da87d56
SHA25634a59deb2cfe32312555148743fc2e65959e20da0e67cf09b096fa28bd4ee98c
SHA512ed9e957ce1aea83ae3ce633cd1015ae69d8ef744174f693c48881a92f813da85411098cca25a4e9a19492bc74d5a9510ffec9a43877da5d78cd15f2282b49422
-
Filesize
885KB
MD509fdd8c9239673d1c4aca8fa8347dbdd
SHA196ef92e625d796d0e90afb3f7540be9381373f71
SHA256b18315e01d533476d253a4ec01f5046ffad60d3977cbed1e6f59393d4867209c
SHA5127116632a2ceb2131dd07bdeaec32cfd5e07edb384bb27aa833acc4cce401e792cf491cb615ffa8aaa00db3993a009066132f6e5fa5015f551867266551c6012f
-
Filesize
2.0MB
MD52381f5404c0157b51f5beb662d6c30ab
SHA1188479e477ae0b00a6855297934af8e8b49d4fdc
SHA2566061ecb576bdcc73123a9bcf9fafab58c7b2f5a61c273b99b5ef64f5ea54aa25
SHA5125a32807719749f3d2f283fcaa45e51fc7e742d9bfd436260b56c88180db56886d76871c47d84e79e0de9614c81ebf5103149d954a25122390d2b3df016c3a08a
-
Filesize
661KB
MD54b4788c19bca0ef4a3c1aff66d618367
SHA1c7ae7070f81a1c423bb2a5714fbc33e3b21dc5a8
SHA256a93bf369bc0faa2571a871075b561cb6c727bc989ba5b0694b66c01d5d536a67
SHA51254f90c79c0b32273ff274b8756c8c9b955959e728c731193a70a47a262c2083d753a723677151d366932cd76a6ed373198a10db9374001426ba7d3c6249bea40
-
Filesize
712KB
MD5dfcc894330d40826a023367bac33daec
SHA1106b81561679ceb41a488b70ec1fe236b7e2bd2a
SHA256ee73bfc45f594f9faf7f291d45592f2459acbdd5505adb8609ff171be14b18e9
SHA5120eb2aa062960035821b0f57904f0da4a26b15707df02114281463926ec8836327eb223cbeeee9f1ce0dcbc48cad64682b6a511f1f149d1f65799c325ef9afdf8
-
Filesize
584KB
MD59dedce7a030876669e2fba34b694f46b
SHA1054dea1fcc8a787e107e949b12c52198207ae588
SHA2560fb44b6ee003fcd928c39dc75e3e4e6b64d9fc9aaa7a16e2b6e0d77e030a46fa
SHA512432ee82472499c5deff680c51aa10191c225a22bb1d26b724116498b0b5b7592beafd8e5dcdc7533c2f93f3dad8d49c88d12c650b448d231b0369fb4fc1b30e8
-
Filesize
1.3MB
MD51fb3a8696050187506f608bddf973f6e
SHA17d48399e66e2b5d38c79499319fa9645731a8d19
SHA2563c11dfcd84bd82980c7a4d4528a447dbc4b816f4f6175432c6ef1cb05dbd57d6
SHA512bf4a0545e21715daae32a1db14d8960187285efa7fffca3d96459c51f3fd6115b4faea237f9be95b7962e91bc3999fc10a0ed6dda3a7286654b22401206361ca
-
Filesize
772KB
MD5328b6083c07642d44e7ec05450540370
SHA18340dd8587382304c090b5a7cc3edda7a10ad723
SHA2565b409fb65d09debc50ca5cf0f43eb68ad3e5a5c21eca3455708771df8b1e9ea0
SHA51231fa80f5e031065ba05d3a1dd734bb0f9d72e879f4a14ad546c1411abe66f396db26144c88c8ed6783b503a0f5bb4b94cf3d76a38b920a4fe35b874c9749964a
-
Filesize
2.1MB
MD51c60ed7edaae4c127ee3265d5c3b3441
SHA17d3c4f43a93c3ba5040f01fe1c6720692c1d1d35
SHA2569e05fe1202c09b7442b0e69d35fbdeccfb806ed0a792a0336db07151bcbeb2fe
SHA512d3aedb8902c353df62dae1ae3d9e21ca071587efa95ca01d7c7c841730e1c42b91134293131947c1b7896e2fa6005b62040e0d898275f839534eb131d386a517
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
600KB
-
Filesize
600KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
384KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
676KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
676KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
904KB
-
Filesize
904KB