Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/06/2024, 22:27

General

  • Target

    2024-06-28_ca67324f74fd9598267e995779dacf28_bkransomware.exe

  • Size

    71KB

  • MD5

    ca67324f74fd9598267e995779dacf28

  • SHA1

    0d2a8aad15de4ad9348d600b0f5587beabf6edee

  • SHA256

    824b105f9759660673334a4972aafa5c1da141972cebbb2eba1d543737a984c3

  • SHA512

    a0d72fec04254b577e322c4d6c0ea2bc22452270d24bfd104052387f7007de827046d660e25d9e47e761e49954fc60c6cc1dc6e6cc844ad0306aa26932995a34

  • SSDEEP

    1536:Fc897UsWjcd9w+AyabjDbxE+MwmvlDuazT0:ZhpAyazIlyazT0

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-28_ca67324f74fd9598267e995779dacf28_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-28_ca67324f74fd9598267e995779dacf28_bkransomware.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5076
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:3300
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1556

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

      Filesize

      789KB

      MD5

      ac0c58689787f1c379dbde58dd0a51de

      SHA1

      ec0a3e469977d7e469a800313bbe67aa94362617

      SHA256

      bf11d351fe85585fe664bdeecda86e2a96e5a5b28ca45e9a65a13dd80e25de5e

      SHA512

      825d516bb09bf26de6886ecb58c16baa375dea1174b62aab902bf3050835aecd878dc5e5dd56763abbbdd702e669fb3e12bc5abe35d7ca7d624829734092d791

    • C:\Users\Admin\AppData\Local\Temp\TLgxWa1vTZWR7j0.exe

      Filesize

      71KB

      MD5

      a0dd5632be16e73c6343378dab77e6cb

      SHA1

      c9de63c132cd253efe45fcb6ae7265adb4275d23

      SHA256

      2719d6179666a4b1c077d873e18c9e05ed9dcef726a5cb3281fd2277f6b8bac3

      SHA512

      b2fbb55929a9bde596ee3d2f4b96e79f767c7ce5eef461206d353a59bd72fdd575660e98483e0a402a5c5667339bf67762f38b2261e1b287b50cdfdabc3ba7a2

    • C:\Windows\CTS.exe

      Filesize

      71KB

      MD5

      66df4ffab62e674af2e75b163563fc0b

      SHA1

      dec8a197312e41eeb3cfef01cb2a443f0205cd6e

      SHA256

      075a6eecd8da1795532318f9cf880efe42461f9464d63f74deb271d33110f163

      SHA512

      1588dd78e6e8972013c40cdb6acfb84c8df7b081197233ce621904b645356c805d0424bb93dd46c55834dc47d9ff39ee1323cf8e670841b3fff24ab98ba87f25