Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/09/2026, 13:05
General
- Target 2026-09-23_1d02c3d5eade887dac3ce2988a889804_bkransomware_elex_maze.exe
- Size 2.4MB
- Sample260924-qbppcssw5l
- SHA256 157d2a92ee2bd87b2a846cf93af6bae8664bb398c8a61e3941a5892f71ab0eb6
Malware Config
Signatures
- Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
- Detects binaries and memory artifacts referencing sandbox product IDs 2 IoCs
- Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
- Stops running service(s) 4 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_1d02c3d5eade887dac3ce2988a889804_bkransomware_elex_maze.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_1d02c3d5eade887dac3ce2988a889804_bkransomware_elex_maze.exe"1⤵
- Enumerates VirtualBox registry keys
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop WerSvc2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop WerSvc3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
1Modify Registry
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/3556-2-0x0000000002770000-0x00000000027F1000-memory.dmp
memory/3556-1-0x0000000002770000-0x00000000027F1000-memory.dmp
memory/3556-3-0x0000000002750000-0x0000000002752000-memory.dmp
memory/3556-4-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3556-5-0x0000000002750000-0x0000000002752000-memory.dmp
memory/3556-6-0x0000000000400000-0x0000000000816000-memory.dmp
memory/3556-7-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3556-8-0x0000000002770000-0x00000000027F1000-memory.dmp
memory/3556-9-0x0000000002770000-0x00000000027F1000-memory.dmp
memory/3556-10-0x0000000002750000-0x0000000002752000-memory.dmp
memory/3556-11-0x0000000000400000-0x0000000000816000-memory.dmp
memory/3556-12-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3556-13-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3556-14-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3556-15-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3556-16-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3556-17-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3556-18-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3556-19-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3556-20-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3556-21-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3556-22-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3556-23-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3556-24-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3556-25-0x0000000000400000-0x0000000000892000-memory.dmp