Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/09/2026, 13:05
General
- Target 2026-09-23_1d02c3d5eade887dac3ce2988a889804_bkransomware_elex_maze.exe
- Size 2.4MB
- Sample260924-qbppcssw5l
- SHA256 157d2a92ee2bd87b2a846cf93af6bae8664bb398c8a61e3941a5892f71ab0eb6
Malware Config
Signatures
- Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
- Detects binaries and memory artifacts referencing sandbox product IDs 3 IoCs
- Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Stops running service(s) 4 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_1d02c3d5eade887dac3ce2988a889804_bkransomware_elex_maze.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_1d02c3d5eade887dac3ce2988a889804_bkransomware_elex_maze.exe"1⤵
- Enumerates VirtualBox registry keys
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop WerSvc2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop WerSvc3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
1Modify Registry
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/3852-0-0x00000000024E0000-0x0000000002561000-memory.dmp
memory/3852-2-0x00000000024E0000-0x0000000002561000-memory.dmp
memory/3852-3-0x00000000024E0000-0x0000000002561000-memory.dmp
memory/3852-1-0x00000000008A0000-0x00000000008A2000-memory.dmp
memory/3852-4-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3852-5-0x00000000008A0000-0x00000000008A2000-memory.dmp
memory/3852-6-0x0000000000400000-0x0000000000816000-memory.dmp
memory/3852-7-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3852-8-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3852-9-0x0000000000400000-0x0000000000816000-memory.dmp
memory/3852-10-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3852-11-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3852-12-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3852-13-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3852-14-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3852-15-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3852-16-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3852-17-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3852-18-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3852-19-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3852-20-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3852-21-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3852-22-0x0000000000400000-0x0000000000892000-memory.dmp