Syskey.zip
- SHA256 f5f9bec45eda579187a441ef744709a51fad7d1713b89e43530fcc7690bca1d3
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Bkhive.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Bkhive.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
Bkreg.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Bkreg.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
Samdump2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
Samdump2.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target Syskey.zip
- Size 65KB
- Sample261027-dbcnksh14t
- SHA256 f5f9bec45eda579187a441ef744709a51fad7d1713b89e43530fcc7690bca1d3
- MD5 0ff1b279635db3fd61771f14c0845e7b
- SHA1 cf418978af85784ceeb2954b89f8c628c4f67825
- SHA512 ff87708f2f32076db6c65e4bfa8389092f64974031b660f4d048da2ed3b0116d8f9f194ddbcc79f5e69e3ec4017da82e96645b4c3c730ed2d3e238b083f5fedf
- SSDEEP 1536:1CMq7sw5l6FU7rv/vZD7rnQLaOJ2oYGVwwyY1Ji1OnV76e:1Zq7/l6FU5D4pj3PJc+ZL
- TLSH T1006302240E37261C53989B3CA415DBA089BCF025EA306DE9AE5DFCD885C74FDAE42D61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Bkhive.exe unpack001/Bkreg.exe unpack001/Samdump2.exe
File Explorer
-
Syskey.zip.zip 65KB
-
Bkhive.exe.exe 48KB
-
Bkreg.exe.exe 44KB
-
Samdump2.exe.exe 48KB
-
syskey.txt5KB
Bkhive.exe
- IMPHASH 379e5d65909de964bb2f31b06ff60ced
- SHA256 8b4a384301398ecb2c17d0e07f38d011b686489a99f4e14d51ef3f3e6c88977a
- MD5 edbccc5eba279504ddd7b0b8fe5ba087
- SHA1 ed377922c25ada1620617bcf54aa734c9cf75d03
- SHA512 e7eb7d838a15cb5e6710778ff107ccab2ac0039bdfe29c6d1a302aae23b5447b59d996c7146ca66bf4d026badc9f052cd3f51922ff4ecff93dc05f04f7438c66
- SSDEEP 768:2SAezphns4aOhuCiRVynC5+HnFKRWftTP8CYxcD:LAensquCA8nC54FGWftYCWc
- TLSH T142237E23B965C077C8C291F406AA86969B7394210275C3E38FD8695DFF627E47F3A306
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7561
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Documents and Settings\Ghost\Desktop\Bkhive\Release\Bkhive.pdb
kernel32
HeapFree
GetLastError
WideCharToMultiByte
HeapAlloc
ExitProcess
GetModuleHandleA
GetCommandLineA
GetVersionExA
CloseHandle
WriteFile
GetProcAddress
TerminateProcess
GetCurrentProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
ReadFile
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetStdHandle
FlushFileBuffers
CreateFileA
MultiByteToWideChar
VirtualProtect
GetSystemInfo
VirtualQuery
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
SetEndOfFile
HeapSize
GetStringTypeA
GetStringTypeW
RtlUnwind
LCMapStringA
LCMapStringW
GetLocaleInfoA
Name
.text
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=39, version=9162,
count=12, id=64, productName=VS2002 (.NET) build 9466, version=9466,
count=78, id=28, productName=VS2002 (.NET) build 9466, version=9466,
count=3, id=25, version=9210,
count=55, id=1, productName=Unmarked objects,
count=4, id=29, productName=VS2002 (.NET) build 9466, version=9466,
count=1, id=61, productName=VS2002 (.NET) build 9466, version=9466,
Bkreg.exe
- IMPHASH 217bb1c5af4fa32740e3acb8d194fbc1
- SHA256 1fe7bf34a6736cd7db7b1eae4c8f90fcc54b5aa498ebc32a1fd3e76dae3aaae8
- MD5 7b5e3719935e237fc9a7366bd7c0ce5a
- SHA1 c5d1ed5289d9eefc26b41d370f3dce042a7dfcd4
- SHA512 833cbda68c9a3ec302f6d56458ec4ff9485bfcfc535d5c7f25baf072c6ce33f2c7c1e943fddc7515b8e75935e6d3bc27bac997ce98cf4a8f3e3bdf76b17622cf
- SSDEEP 768:JOTY21a8Cx+rgW/CiAys6y6qcdUeQqZemxi8GQ+/8eYzcD:QJrCx+rgW/CiAybTqcrZFi8GQU5sc
- TLSH T139137C23BCB1C43BC89641F0556A8649AF3B152203B546738FAC289DEF637D07E3A359
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5331
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Documents and Settings\Ghost\Desktop\Bkreg\Release\Bkreg.pdb
advapi32
RegQueryInfoKeyA
RegOpenKeyExA
RegCloseKey
kernel32
ExitProcess
GetModuleHandleA
GetCommandLineA
GetVersionExA
HeapFree
GetLastError
CloseHandle
WriteFile
GetProcAddress
TerminateProcess
GetCurrentProcess
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
HeapAlloc
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
SetFilePointer
CreateFileA
MultiByteToWideChar
VirtualProtect
GetSystemInfo
VirtualQuery
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
SetEndOfFile
ReadFile
HeapSize
GetStringTypeA
GetStringTypeW
RtlUnwind
LCMapStringA
LCMapStringW
GetLocaleInfoA
Name
.text
Size
28KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=70, id=28, productName=VS2002 (.NET) build 9466, version=9466,
count=12, id=64, productName=VS2002 (.NET) build 9466, version=9466,
count=5, id=25, version=9210,
count=58, id=1, productName=Unmarked objects,
count=3, id=29, productName=VS2002 (.NET) build 9466, version=9466,
count=1, id=61, productName=VS2002 (.NET) build 9466, version=9466,
Samdump2.exe
- IMPHASH e8c53f6753d00064fc35c80065513caf
- SHA256 10518a83ac18b3f8aebf926a8c1d5447c63c3cf21ba84aab75dee6edcd91be13
- MD5 a9a902bcc2d240dfff82c47f6834b641
- SHA1 9aeebcd018b9597cb9c5cb6583aef224b046fffd
- SHA512 95d2c0675d4919000a45d20e8dd400000f8d3becd7eb2ed1d155a2dcbe9c6238832226e296bc6e04cba51a4ce12ae2515560eaf95d8107f73b2031102efc6cd6
- SSDEEP 768:KVVyfzxkKqe6wfuLjzK6q8gyjWmlA+34M7jP6bY30p:KVqmKqeNfA6htmlAyD7ObY0
- TLSH T1BB238D17FA51D137C88346F0046A8671FB77921003B5C396879C69BFBF627A9AD3630A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Documents and Settings\Ghost\Desktop\Samdump2\Release\Samdump2.pdb
kernel32
FreeLibrary
GetProcAddress
LoadLibraryA
HeapFree
GetLastError
WideCharToMultiByte
HeapAlloc
ExitProcess
GetModuleHandleA
GetCommandLineA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
CloseHandle
ReadFile
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
SetFilePointer
WriteFile
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
SetStdHandle
FlushFileBuffers
CreateFileA
GetACP
GetOEMCP
GetCPInfo
HeapSize
GetLocaleInfoA
VirtualProtect
GetSystemInfo
VirtualQuery
SetEndOfFile
RtlUnwind
LCMapStringA
LCMapStringW
Name
.text
Size
32KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=39, version=9162,
count=12, id=64, productName=VS2002 (.NET) build 9466, version=9466,
count=3, id=25, version=9210,
count=56, id=1, productName=Unmarked objects,
count=4, id=29, productName=VS2002 (.NET) build 9466, version=9466,
count=76, id=28, productName=VS2002 (.NET) build 9466, version=9466,
count=1, id=61, productName=VS2002 (.NET) build 9466, version=9466,
syskey.txt
- SHA256 5e54118e96184922990fba874662710c4252f38d808214cc9b67cf40384342bf
- MD5 a2806532e9c77075aff77d952e2214c9
- SHA1 6e8b7b750b18a03e7058b9cd1f07d60d61a65746
- SHA512 49e9a63fdc9cc4d956e61cc40896aabb7d35c089a3ff1a5f43909a35676b9e7681f3606bed0d219ed4eaa22517e2ed624f246badfadb455883dc5f72be5d7af5
- SSDEEP 96:Pmh4kMGltqOQrNEmx7czh4g400hLD9/H+rcu0TeUWG2q8+ZCr0nIw6Gsp1RafjMC:PmIO/mxU4gj0vH+gJOG2qPHqR4m1W
- TLSH T116C162A2AA4543310BD5C2966B4E93E0BF31B0AE63B30155795C9568B347C2A03F79F6
- MD5 SHA1 SHA512 SSDEEP TLSH