Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    01/09/2024, 16:22

General

  • Target

    2024-09-01_0a19f7a830e0b3fa0eebc29e45880106_bkransomware_virut.exe

  • Size

    3.2MB

  • MD5

    0a19f7a830e0b3fa0eebc29e45880106

  • SHA1

    440e0b6203845743eb0d44919ede5e39bb1f43ff

  • SHA256

    d5e4d596cf768369eca7762dfc7f9cec691847ec226162cde98d59a5de19bb3e

  • SHA512

    6a9fc65dbc2316343b9905d51b7f1321732f0616a43b140f2ebb7ebbe9a886b944f708bf2e2bba23756503bb72f858f0652f8f324e5545090fed85471f143f64

  • SSDEEP

    3072:ygci+rDtAjIEbNdsPueRmwKiL1M4BYnWqAwzQlQeQltF19g19Qh:yGatRmviIQl0lX19g7O

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1204
      • C:\Users\Admin\AppData\Local\Temp\2024-09-01_0a19f7a830e0b3fa0eebc29e45880106_bkransomware_virut.exe
        "C:\Users\Admin\AppData\Local\Temp\2024-09-01_0a19f7a830e0b3fa0eebc29e45880106_bkransomware_virut.exe"
        2⤵
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1296
        • C:\Users\Admin\AppData\Local\Temp\2024-09-01_0a19f7a830e0b3fa0eebc29e45880106_bkransomware_virut.exe
          "C:\Users\Admin\AppData\Local\Temp\2024-09-01_0a19f7a830e0b3fa0eebc29e45880106_bkransomware_virut.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1980

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1204-2-0x0000000002E50000-0x0000000002E51000-memory.dmp

      Filesize

      4KB

    • memory/1204-1-0x0000000002E50000-0x0000000002E51000-memory.dmp

      Filesize

      4KB

    • memory/1296-3-0x0000000001250000-0x000000000158B17C-memory.dmp

      Filesize

      3.2MB

    • memory/1296-4-0x0000000000A30000-0x0000000000D6C000-memory.dmp

      Filesize

      3.2MB

    • memory/1296-5-0x0000000001250000-0x000000000158B17C-memory.dmp

      Filesize

      3.2MB