Static task
static1
Behavioral task
behavioral1
Sample
2024-09-12_2f973b99b2321e7f0ca75ac1611dc9db_bkransomware.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-12_2f973b99b2321e7f0ca75ac1611dc9db_bkransomware.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-12_2f973b99b2321e7f0ca75ac1611dc9db_bkransomware
-
Size
6.6MB
-
MD5
2f973b99b2321e7f0ca75ac1611dc9db
-
SHA1
2268460b1301f415a5e06acbc863e2bb2ea892bf
-
SHA256
f2f0b40534c54729ecdedc74483dd4b24e2eeb6723f8daba3f689c41f2e7ecc1
-
SHA512
bc763ef675e7967c89cd6215470b305aa37a4c22985e58173a938ee7540570826db1a69e9188667a17edfe0698ee9c0d8b90201eb71e8f8ac2dfa56e864f236a
-
SSDEEP
98304:cAcx7ZQPhW1aMaovFFvXaPnf1+BfxbHX5svUgzfQ+OyXqJ3j2rMlJ4QH9QcJxsWf:EZKzMaiUoze3zI+OyXqNCrmH3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-09-12_2f973b99b2321e7f0ca75ac1611dc9db_bkransomware
Files
-
2024-09-12_2f973b99b2321e7f0ca75ac1611dc9db_bkransomware.exe windows:6 windows x86 arch:x86
0bc57cafed03fd63a5e037dbe30738ec
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SuspendThread
ResumeThread
lstrcpyW
DeleteFileA
GetWindowsDirectoryW
ExitProcess
EncodePointer
GetDateFormatW
EnumResourceNamesW
SetFilePointer
TlsGetValue
GetLocaleInfoA
UnmapViewOfFile
VirtualQuery
FindResourceW
SetDllDirectoryW
EnumCalendarInfoW
GetEnvironmentStringsW
GetModuleHandleExW
SetHandleInformation
WaitForSingleObjectEx
ExpandEnvironmentStringsA
GetPrivateProfileStringW
GetProcessTimes
TlsSetValue
OpenProcess
GetSystemDirectoryW
LoadLibraryW
IsValidLocale
GetLocaleInfoW
GetSystemTimeAdjustment
HeapDestroy
IsProcessorFeaturePresent
Beep
MulDiv
GetSystemDirectoryA
CompareStringW
IsDBCSLeadByteEx
GetThreadLocale
VirtualAlloc
ResetEvent
CreateFileMappingA
GetFileType
GetSystemInfo
CreatePipe
GetOEMCP
WinExec
GetVersion
DeleteFileW
OpenFileMappingA
TlsFree
LocalFree
ExpandEnvironmentStringsW
SwitchToThread
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
LCMapStringW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
ReleaseSemaphore
VirtualProtect
VirtualFree
GetVersionExW
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
OutputDebugStringW
FreeEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
WriteFile
GetModuleFileNameW
GetStdHandle
GetCPInfo
GetACP
IsValidCodePage
IsDebuggerPresent
GetProcessHeap
HeapAlloc
HeapSize
UnregisterWait
CreateFileW
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
CloseHandle
DeleteCriticalSection
GetUserDefaultUILanguage
GetModuleFileNameA
DeviceIoControl
QueryDosDeviceW
LoadLibraryA
GetLocalTime
GetDiskFreeSpaceW
SetLastError
GetLastError
GetCPInfoExW
FindFirstFileA
GetPrivateProfileIntW
RaiseException
GetTempPathW
WritePrivateProfileStringW
GetStartupInfoW
MultiByteToWideChar
ExitThread
GetOverlappedResult
GetTimeZoneInformation
FileTimeToSystemTime
GetFileAttributesA
GetExitCodeProcess
FormatMessageW
Sleep
CreateEventA
WideCharToMultiByte
GetCommandLineA
SetCommState
VirtualQueryEx
GetCurrentThread
ConnectNamedPipe
WaitForSingleObject
GlobalLock
SetEnvironmentVariableW
CompareFileTime
GetCurrentProcess
GetCommState
LoadLibraryExW
FreeLibrary
MapViewOfFile
RtlCaptureContext
GetFileSize
GetEnvironmentVariableW
GetCommandLineW
EnumSystemLocalesW
GetFullPathNameW
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
SetEvent
CreateTimerQueue
HeapFree
CreateThread
CreateSemaphoreW
DuplicateHandle
GetCurrentThreadId
GetExitCodeThread
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DecodePointer
HeapReAlloc
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
CreateEventW
TerminateProcess
TlsAlloc
GetTickCount
GetModuleHandleW
GetProcAddress
user32
ClientToScreen
GetDlgItemInt
GetMessageW
CharNextW
GetWindowInfo
GetMenuStringW
DrawTextExW
ModifyMenuW
SetDlgItemInt
MessageBoxA
GetWindowLongW
GetClassNameW
MonitorFromWindow
DrawStateW
CharUpperW
SendDlgItemMessageW
EnumChildWindows
ShowWindow
DrawMenuBar
EnableScrollBar
GetMenuItemCount
CreateWindowExW
InsertMenuW
MessageBoxW
GetDlgItemTextW
SendMessageW
MapWindowPoints
UpdateWindow
DestroyMenu
GetDlgCtrlID
DestroyIcon
GetMonitorInfoW
PostMessageW
GetSubMenu
LoadStringA
CharLowerBuffW
GetDC
DrawFocusRect
CreateDialogIndirectParamA
SetWindowLongW
DestroyCursor
GetDesktopWindow
BeginDeferWindowPos
ValidateRgn
ToUnicode
SetMenuItemInfoW
GetWindowThreadProcessId
RegisterWindowMessageW
gdi32
ExtFloodFill
SetWindowExtEx
GetMetaFileBitsEx
CreateFontIndirectW
GetEnhMetaFileHeader
PtInRegion
CombineRgn
RectInRegion
SetPolyFillMode
StretchDIBits
CreateBitmapIndirect
SetStretchBltMode
GetNearestPaletteIndex
SetViewportExtEx
CloseEnhMetaFile
PolyPolygon
SetLayout
SetViewportOrgEx
SetTextColor
Polygon
StretchBlt
GetRgnBox
CreateEnhMetaFileW
CreatePolygonRgn
comdlg32
GetOpenFileNameW
FindTextW
advapi32
RegCloseKey
RegLoadKeyW
RegEnumKeyExW
ControlService
RegOpenKeyExW
SetSecurityDescriptorOwner
RegDeleteValueA
QueryServiceStatus
RegOpenKeyExA
SetSecurityDescriptorDacl
RegDeleteKeyA
OpenServiceW
OpenSCManagerW
RegConnectRegistryW
AdjustTokenPrivileges
StartServiceW
RegGetKeySecurity
LookupPrivilegeValueW
RegQueryInfoKeyW
RegSetValueExW
shell32
ExtractIconExW
ShellExecuteW
ShellExecuteExW
Shell_NotifyIconW
CommandLineToArgvW
SHGetFileInfoW
oleaut32
SysFreeString
VariantInit
VariantCopy
SysReAllocStringLen
SafeArrayPtrOfIndex
Sections
.text Size: 664KB - Virtual size: 663KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.aTI Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ