Analysis
-
max time kernel
135s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30-10-2024 09:58
General
-
Target
2024-10-30_6908b774daad336d0ab1c55f55c344c4_bkransomware_hijackloader.exe
-
Size
2.5MB
-
MD5
6908b774daad336d0ab1c55f55c344c4
-
SHA1
04ea8a943ca41fe152a4c2ec99ede83967d546f3
-
SHA256
10c59dd6cef6195616ec76184885c1ed1134f9c2ca801652c81a018d040ebbe4
-
SHA512
aa283489d2474f7b8a5f2bb6f524aa5c3f99932b61e52737db36b8cc7b168e6040217ec69860592e473fab6df5597cc30ce79c23b17805f6cf3c854f41d41de8
-
SSDEEP
49152:GNfatughHaKLIKN1cueXlaYbsISTb/am5B8y6sEUhSSwoUK0:Gla4ghHaKMu2IYbsIW/amj8yF8SE
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-30_6908b774daad336d0ab1c55f55c344c4_bkransomware_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-30_6908b774daad336d0ab1c55f55c344c4_bkransomware_hijackloader.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses