Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/07/2024, 12:52

General

  • Target

    2024-07-06_c8c66d5499ff03d8ef49547e6f34c102_bkransomware.exe

  • Size

    96KB

  • MD5

    c8c66d5499ff03d8ef49547e6f34c102

  • SHA1

    2751ab5a3f653105da8b2297c55ca948950c25f0

  • SHA256

    a1faef54471bc8daad50766cfd7664bebb6e13ab8ef9a12cbb2453ac2eb723ed

  • SHA512

    2f28b8ade81809c635ee28a6d2cdc1314827cdeab596bb5acef32b019dcf6c4da97a71dab36958654ace84e1790ea68410a66c14b26d0b6a5391c7703a88722d

  • SSDEEP

    1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazTPKVfSle8iuL9MnSGaPc:ZRpAyazIliazTSkleDuxELqc

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-07-06_c8c66d5499ff03d8ef49547e6f34c102_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-07-06_c8c66d5499ff03d8ef49547e6f34c102_bkransomware.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:976
    • C:\Users\Admin\AppData\Local\Temp\2eLms0S5g7jOpEw.exe
      C:\Users\Admin\AppData\Local\Temp\2eLms0S5g7jOpEw.exe
      2⤵
      • Executes dropped EXE
      PID:1208
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:780

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

    Filesize

    394KB

    MD5

    8613c2f576cd2c290fb6d0cca39abf11

    SHA1

    5b8731c69df1884f876a214bc63adde328ebf15a

    SHA256

    20b501e85014df95168d95360015a0ab1ad8d568190fe82b1ecd217a1dcfd213

    SHA512

    d19e39a946035a5fc5a2be6bda9e63bac778ae1b5a62e7af407bfbb682c8edc945d8f6300a28632ab8753b2d9af7db3dcc276a16e1ddba73821dd550c3e979ee

  • C:\Users\Admin\AppData\Local\Temp\2eLms0S5g7jOpEw.exe

    Filesize

    25KB

    MD5

    abbd49c180a2f8703f6306d6fa731fdc

    SHA1

    d63f4bfe7f74936b2fbace803e3da6103fbf6586

    SHA256

    5f411c0bd9ed9a42b0f07ed568c7d0cf358a83063b225a1f8f7da3296dde90f1

    SHA512

    290dd984acc451b778f3db8c510bae7aec1d9547c3ad0a1829df731c136e4ecc9a37dc6a786cf8f1ecc4d14339aed1288af25055f450f6f953138c8d4d5c36e9

  • C:\Windows\CTS.exe

    Filesize

    71KB

    MD5

    f9d4ab0a726adc9b5e4b7d7b724912f1

    SHA1

    3d42ca2098475924f70ee4a831c4f003b4682328

    SHA256

    b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc

    SHA512

    22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432

  • memory/1208-10-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB