Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 04:41
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-26_72c0cb0bb6b57a50feadb375e8e6011e_bkransomware.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
2024-07-26_72c0cb0bb6b57a50feadb375e8e6011e_bkransomware.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
General
-
Target
2024-07-26_72c0cb0bb6b57a50feadb375e8e6011e_bkransomware.exe
-
Size
499KB
-
MD5
72c0cb0bb6b57a50feadb375e8e6011e
-
SHA1
978dc705c584bcbe13808246db677875e0df42c4
-
SHA256
4397d9a9b39f88d6fd436d053d123413d028f77156f92cdc7b9ba27d955280b9
-
SHA512
f805dfe49f5c4f1f73997577c0abe4153908c14f15d54bf3bb48c9a326ee68c77454f23e8fc053000d0c86f3f182fb24ac38de55300c2d288b8b2cc1005cd9ca
-
SSDEEP
12288:3UWO6nfIdUgnkXz63Tvp0X9BI9o3r7a+6s8c5:3UWO6nfIpnkXzKTGBI4r7ys8
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2856 mv4ahbt2dzn1vralab9a.exe 2840 xsqlblrcgnc.exe 2636 lcvvrvtys.exe 2560 xsqlblrcgnc.exe -
Loads dropped DLL 6 IoCs
pid Process 2652 2024-07-26_72c0cb0bb6b57a50feadb375e8e6011e_bkransomware.exe 2652 2024-07-26_72c0cb0bb6b57a50feadb375e8e6011e_bkransomware.exe 2840 xsqlblrcgnc.exe 2840 xsqlblrcgnc.exe 2856 mv4ahbt2dzn1vralab9a.exe 2856 mv4ahbt2dzn1vralab9a.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\jevwjfxdwynun\lekmkx xsqlblrcgnc.exe File created C:\Windows\jevwjfxdwynun\lekmkx 2024-07-26_72c0cb0bb6b57a50feadb375e8e6011e_bkransomware.exe File created C:\Windows\jevwjfxdwynun\lekmkx mv4ahbt2dzn1vralab9a.exe File created C:\Windows\jevwjfxdwynun\lekmkx xsqlblrcgnc.exe File created C:\Windows\jevwjfxdwynun\lekmkx lcvvrvtys.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lcvvrvtys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mv4ahbt2dzn1vralab9a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-07-26_72c0cb0bb6b57a50feadb375e8e6011e_bkransomware.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xsqlblrcgnc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2840 xsqlblrcgnc.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe 2636 lcvvrvtys.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2652 wrote to memory of 2856 2652 2024-07-26_72c0cb0bb6b57a50feadb375e8e6011e_bkransomware.exe 30 PID 2652 wrote to memory of 2856 2652 2024-07-26_72c0cb0bb6b57a50feadb375e8e6011e_bkransomware.exe 30 PID 2652 wrote to memory of 2856 2652 2024-07-26_72c0cb0bb6b57a50feadb375e8e6011e_bkransomware.exe 30 PID 2652 wrote to memory of 2856 2652 2024-07-26_72c0cb0bb6b57a50feadb375e8e6011e_bkransomware.exe 30 PID 2840 wrote to memory of 2636 2840 xsqlblrcgnc.exe 32 PID 2840 wrote to memory of 2636 2840 xsqlblrcgnc.exe 32 PID 2840 wrote to memory of 2636 2840 xsqlblrcgnc.exe 32 PID 2840 wrote to memory of 2636 2840 xsqlblrcgnc.exe 32 PID 2856 wrote to memory of 2560 2856 mv4ahbt2dzn1vralab9a.exe 33 PID 2856 wrote to memory of 2560 2856 mv4ahbt2dzn1vralab9a.exe 33 PID 2856 wrote to memory of 2560 2856 mv4ahbt2dzn1vralab9a.exe 33 PID 2856 wrote to memory of 2560 2856 mv4ahbt2dzn1vralab9a.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-26_72c0cb0bb6b57a50feadb375e8e6011e_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-26_72c0cb0bb6b57a50feadb375e8e6011e_bkransomware.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\jevwjfxdwynun\mv4ahbt2dzn1vralab9a.exe"C:\jevwjfxdwynun\mv4ahbt2dzn1vralab9a.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\jevwjfxdwynun\xsqlblrcgnc.exe"C:\jevwjfxdwynun\xsqlblrcgnc.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2560
-
-
-
C:\jevwjfxdwynun\xsqlblrcgnc.exeC:\jevwjfxdwynun\xsqlblrcgnc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\jevwjfxdwynun\lcvvrvtys.exehvrxbsi3myzl "c:\jevwjfxdwynun\xsqlblrcgnc.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2636
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12B
MD5ece1de60016e2e2b72724b856d29a3d3
SHA1ad399f7ebab2f542b85671f055fc6b52a95505d0
SHA256ad1f154c45ad901e6bcd52458f496d69b746a2dc45e377b38e8def679782716d
SHA512e06782293a45ceb35faf5476c07d2ad9701168348a02306c8d0875ada764648f9c7c128ab89fd438b559044e8354743820c1d4ea62a36def42d173d80d0152d4
-
Filesize
499KB
MD572c0cb0bb6b57a50feadb375e8e6011e
SHA1978dc705c584bcbe13808246db677875e0df42c4
SHA2564397d9a9b39f88d6fd436d053d123413d028f77156f92cdc7b9ba27d955280b9
SHA512f805dfe49f5c4f1f73997577c0abe4153908c14f15d54bf3bb48c9a326ee68c77454f23e8fc053000d0c86f3f182fb24ac38de55300c2d288b8b2cc1005cd9ca