Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29/06/2024, 15:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe
-
Size
655KB
-
MD5
956127faba9d4e4c7e4a5288d914b4d0
-
SHA1
e607926a41b5e81a1931f43cabcec5a8a75bacbc
-
SHA256
9760287daea0039abaa73fa4bcfefa269737fcfb3d3cdc8ee184a29ec198556f
-
SHA512
e33100ac673558f06c1bdf542deb9ea99567b75e705a8d5f00bf1c9bebd10e80dd0ad436624bdbf66c4d0d88ad296a1195f8a487a34fbf65669f0904ad6163d8
-
SSDEEP
12288:dDGxxpIZ1QwFtv7SmETDTSoqzBY3o0PMuupoM4:dDPfFtv7SVTvbqzBY3o0XDM
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened (read-only) \??\l: 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened (read-only) \??\r: 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened (read-only) \??\v: 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened (read-only) \??\x: 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened (read-only) \??\s: 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened (read-only) \??\u: 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened (read-only) \??\w: 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened (read-only) \??\y: 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened (read-only) \??\k: 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened (read-only) \??\m: 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened (read-only) \??\n: 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened (read-only) \??\o: 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened (read-only) \??\p: 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened (read-only) \??\q: 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened (read-only) \??\g: 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened (read-only) \??\h: 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened (read-only) \??\i: 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened (read-only) \??\j: 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened (read-only) \??\t: 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OFFOWC.DLL 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\DLGSETP.DLL 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files\Microsoft Games\Minesweeper\MineSweeper.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPCORE.DLL 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files\Java\jre7\bin\wsdetect.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Selectors.Resources.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\NL7MODELS0009.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\PhotoBase.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\MSOSVINT.DLL 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l2-1-0.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files\Windows Photo Viewer\ImagingEngine.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSTYLE.DLL 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files\Java\jre7\bin\splashscreen.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files\Internet Explorer\Timeline_is.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\logsession.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\STSLISTI.DLL 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files\Internet Explorer\perf_nt.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\VVIEWER.DLL 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CSS7DATA000C.DLL 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\ONPPTAddin.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Design.Resources.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Windows Media Player\WMPNSSUI.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\WMPMediaSharing.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\Microsoft.Office.Infopath.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files\Windows Media Player\WMPDMCCore.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files\Mozilla Firefox\osclientcerts.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\hxdsui.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONWordAddin.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.Runtime.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\Microsoft.Synchronization.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Resources.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\servertool.exe 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\freebl3.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_et.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files\Internet Explorer\iexplore.exe 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\OneNoteSyncPC.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Wordcnv.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\MOR6INT.DLL 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files\Windows Journal\NBMapTIP.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PPINTL.DLL 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files (x86)\Common Files\System\Ole DB\msdasqlr.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\MSB1FREN.DLL 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSHY7FR.DLL 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files\Microsoft Games\Purble Place\PurblePlace.dll 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\SLINTL.DLL 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1844 2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-29_956127faba9d4e4c7e4a5288d914b4d0_bkransomware.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
PID:1844