Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2024, 07:53
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-05_6e877e91ebdc0fbbced46af7bdedb9b6_bkransomware.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-05_6e877e91ebdc0fbbced46af7bdedb9b6_bkransomware.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-05_6e877e91ebdc0fbbced46af7bdedb9b6_bkransomware.exe
-
Size
6.7MB
-
MD5
6e877e91ebdc0fbbced46af7bdedb9b6
-
SHA1
3878083686d6eba27e7d914235d8a817ec516f56
-
SHA256
4661333bebfb27d6d26b199112c8f18198539198a30f53bf1aabc717f543684b
-
SHA512
5524bd01e8dffad336ebee644b6285dc0f1476b65d3d8b368ac304d8fa056055b5988e1b83e64806009e658fd09c35bdcff3819046d091ba35e4dbfcaa34ecb7
-
SSDEEP
196608:r5VyxQv+JRbIeBTsWrupdujxWVckrxrujUt3lHM3:1we+JREeCWrsu4rrsUt3l
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 1732 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation 2024-08-05_6e877e91ebdc0fbbced46af7bdedb9b6_bkransomware.exe -
Indirect Command Execution 1 TTPs 5 IoCs
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
pid Process 4256 forfiles.exe 564 forfiles.exe 2064 forfiles.exe 2172 forfiles.exe 2000 forfiles.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2228 4820 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language forfiles.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language forfiles.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language forfiles.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gpupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language forfiles.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language forfiles.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-08-05_6e877e91ebdc0fbbced46af7bdedb9b6_bkransomware.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1732 powershell.exe 1732 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1732 powershell.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 4820 wrote to memory of 5060 4820 2024-08-05_6e877e91ebdc0fbbced46af7bdedb9b6_bkransomware.exe 88 PID 4820 wrote to memory of 5060 4820 2024-08-05_6e877e91ebdc0fbbced46af7bdedb9b6_bkransomware.exe 88 PID 4820 wrote to memory of 5060 4820 2024-08-05_6e877e91ebdc0fbbced46af7bdedb9b6_bkransomware.exe 88 PID 5060 wrote to memory of 2000 5060 cmd.exe 90 PID 5060 wrote to memory of 2000 5060 cmd.exe 90 PID 5060 wrote to memory of 2000 5060 cmd.exe 90 PID 2000 wrote to memory of 2016 2000 forfiles.exe 91 PID 2000 wrote to memory of 2016 2000 forfiles.exe 91 PID 2000 wrote to memory of 2016 2000 forfiles.exe 91 PID 2016 wrote to memory of 3980 2016 cmd.exe 92 PID 2016 wrote to memory of 3980 2016 cmd.exe 92 PID 2016 wrote to memory of 3980 2016 cmd.exe 92 PID 5060 wrote to memory of 4256 5060 cmd.exe 93 PID 5060 wrote to memory of 4256 5060 cmd.exe 93 PID 5060 wrote to memory of 4256 5060 cmd.exe 93 PID 4256 wrote to memory of 2012 4256 forfiles.exe 94 PID 4256 wrote to memory of 2012 4256 forfiles.exe 94 PID 4256 wrote to memory of 2012 4256 forfiles.exe 94 PID 2012 wrote to memory of 1392 2012 cmd.exe 95 PID 2012 wrote to memory of 1392 2012 cmd.exe 95 PID 2012 wrote to memory of 1392 2012 cmd.exe 95 PID 5060 wrote to memory of 564 5060 cmd.exe 96 PID 5060 wrote to memory of 564 5060 cmd.exe 96 PID 5060 wrote to memory of 564 5060 cmd.exe 96 PID 564 wrote to memory of 2632 564 forfiles.exe 97 PID 564 wrote to memory of 2632 564 forfiles.exe 97 PID 564 wrote to memory of 2632 564 forfiles.exe 97 PID 2632 wrote to memory of 464 2632 cmd.exe 98 PID 2632 wrote to memory of 464 2632 cmd.exe 98 PID 2632 wrote to memory of 464 2632 cmd.exe 98 PID 5060 wrote to memory of 2064 5060 cmd.exe 99 PID 5060 wrote to memory of 2064 5060 cmd.exe 99 PID 5060 wrote to memory of 2064 5060 cmd.exe 99 PID 2064 wrote to memory of 2904 2064 forfiles.exe 100 PID 2064 wrote to memory of 2904 2064 forfiles.exe 100 PID 2064 wrote to memory of 2904 2064 forfiles.exe 100 PID 2904 wrote to memory of 1328 2904 cmd.exe 101 PID 2904 wrote to memory of 1328 2904 cmd.exe 101 PID 2904 wrote to memory of 1328 2904 cmd.exe 101 PID 5060 wrote to memory of 2172 5060 cmd.exe 102 PID 5060 wrote to memory of 2172 5060 cmd.exe 102 PID 5060 wrote to memory of 2172 5060 cmd.exe 102 PID 2172 wrote to memory of 3984 2172 forfiles.exe 103 PID 2172 wrote to memory of 3984 2172 forfiles.exe 103 PID 2172 wrote to memory of 3984 2172 forfiles.exe 103 PID 3984 wrote to memory of 1732 3984 cmd.exe 104 PID 3984 wrote to memory of 1732 3984 cmd.exe 104 PID 3984 wrote to memory of 1732 3984 cmd.exe 104 PID 1732 wrote to memory of 4780 1732 powershell.exe 105 PID 1732 wrote to memory of 4780 1732 powershell.exe 105 PID 1732 wrote to memory of 4780 1732 powershell.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-05_6e877e91ebdc0fbbced46af7bdedb9b6_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-05_6e877e91ebdc0fbbced46af7bdedb9b6_bkransomware.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"3⤵
- Indirect Command Execution
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 65⤵
- System Location Discovery: System Language Discovery
PID:3980
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"3⤵
- Indirect Command Execution
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 65⤵
- System Location Discovery: System Language Discovery
PID:1392
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"3⤵
- Indirect Command Execution
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 65⤵
- System Location Discovery: System Language Discovery
PID:464
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"3⤵
- Indirect Command Execution
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\cmd.exe/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 65⤵
- System Location Discovery: System Language Discovery
PID:1328
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"3⤵
- Indirect Command Execution
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\cmd.exe/C powershell start-process -WindowStyle Hidden gpupdate.exe /force4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell start-process -WindowStyle Hidden gpupdate.exe /force5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force6⤵
- System Location Discovery: System Language Discovery
PID:4780
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 6482⤵
- Program crash
PID:2228
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4820 -ip 48201⤵PID:2452
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82