Overview

overview

10

Static

static

1cc6588ef5...0b.exe

windows7_x64

10

1cc6588ef5...0b.exe

windows10-2004_x64

3

Analysis

  • max time kernel
    141s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    07-06-2022 14:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1cc6588ef5bedc29ed497ebd5acd253af95f6938c1d731cab2ca5d910b00ec0b.exe

  • Size

    370KB

  • MD5

    57b33c329990ba3f266fb59ef6468568

  • SHA1

    fc73e1a2aa3124e2924f62d09db42e10614d928a

  • SHA256

    1cc6588ef5bedc29ed497ebd5acd253af95f6938c1d731cab2ca5d910b00ec0b

  • SHA512

    ad8f3c76e9199a0d3b408426acc9163ce278ab11d951d3de7dd69b4ea54fd21a9ec37f65c16e70bfd440420a7e74f8ee55d9a30d6fa847d5af1dfccd82186f3b

Score
10/10
teslacryptpersistenceransomwarespywarestealersuricata

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1819626980-2277161760-1023733287-1000\_RECoVERY_+aecnt.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://yyre45dbvn2nhbefbmh.begumvelic.at/E507C241A439684 2. http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/E507C241A439684 3. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/E507C241A439684 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/E507C241A439684 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://yyre45dbvn2nhbefbmh.begumvelic.at/E507C241A439684 http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/E507C241A439684 http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/E507C241A439684 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/E507C241A439684
URLs

http://yyre45dbvn2nhbefbmh.begumvelic.at/E507C241A439684

http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/E507C241A439684

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/E507C241A439684

http://xlowfznrg4wf7dli.ONION/E507C241A439684

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt
  • suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon

    suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon

    suricata
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 25 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\1cc6588ef5bedc29ed497ebd5acd253af95f6938c1d731cab2ca5d910b00ec0b.exe
    "C:\Users\Admin\AppData\Local\Temp\1cc6588ef5bedc29ed497ebd5acd253af95f6938c1d731cab2ca5d910b00ec0b.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:536
    • C:\Windows\pycwtoxagmsy.exe
      C:\Windows\pycwtoxagmsy.exe
      2⤵
      • Executes dropped EXE
      • Modifies extensions of user files
      • Drops startup file
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1644
      • C:\Windows\System32\wbem\WMIC.exe
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:276
      • C:\Windows\SysWOW64\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:220
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:520
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:520 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1200
      • C:\Windows\System32\wbem\WMIC.exe
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1720
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\PYCWTO~1.EXE
        3⤵
          PID:1840
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\1CC658~1.EXE
        2⤵
        • Deletes itself
        PID:1716
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:784
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
      1⤵
      • Suspicious use of FindShellTrayWindow
      PID:632

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Desktop\RECOVERY.HTM
      Filesize

      10KB

      MD5

      a2196f3205fdd9e3a6bda5a721e071b6

      SHA1

      b23ca73edf809225490f0a9517a3c46d5405a8b8

      SHA256

      d1c6e971a1c865e28eae0f3fefc7bb29269663dc0f3b24c5b75459fc70de5ffa

      SHA512

      f3eefded3943e81a21e34ec06be5f8401221e1701068bb46b6408ae4d290228fd94b4ab56d527fd62de44ad9ae4aa4d8029c4ee28e93d84f1b5ba44f66dc3fd2

      Download Submit

    • C:\Users\Admin\Desktop\RECOVERY.TXT
      Filesize

      1KB

      MD5

      05c32b553d92385f2bb06616788df487

      SHA1

      7faeef0d408423f9cc5ce7f136ee315a01abcd11

      SHA256

      e24b488744679dbbc50cb90b0e48f6e833669bd5bc1b6bed098a0b1b4ad48e84

      SHA512

      182fcd64c86b5f648bb6c99d4fa1a590bc94f57d121e14ba14487a7d2c2d1e9f89e622d0d7d886aae2d0e488d96d04c96b21b39b8ec82b9a0a8e884aeba1c542

      Download Submit

    • C:\Users\Admin\Desktop\RECOVERY.png
      Filesize

      63KB

      MD5

      d28193864fee3dec7e41ffd967c1bac3

      SHA1

      749160fccfc14434f709e89ddaab7f4a60c62498

      SHA256

      233cf86ded59d0f0c46822e05c3beed7ee4dbfd3f1d31dbb520dd5670dfbd70a

      SHA512

      94bfebc5464d9c456f7299b65e1b8161a3d8995904e5bce9f27bde18b70f897671578c23e64ebcaa6561865f76fefccecf2df58434479f54344347296cfc08ea

      Download Submit

    • C:\Windows\pycwtoxagmsy.exe
      Filesize

      370KB

      MD5

      57b33c329990ba3f266fb59ef6468568

      SHA1

      fc73e1a2aa3124e2924f62d09db42e10614d928a

      SHA256

      1cc6588ef5bedc29ed497ebd5acd253af95f6938c1d731cab2ca5d910b00ec0b

      SHA512

      ad8f3c76e9199a0d3b408426acc9163ce278ab11d951d3de7dd69b4ea54fd21a9ec37f65c16e70bfd440420a7e74f8ee55d9a30d6fa847d5af1dfccd82186f3b

      Download Submit

    • C:\Windows\pycwtoxagmsy.exe
      Filesize

      370KB

      MD5

      57b33c329990ba3f266fb59ef6468568

      SHA1

      fc73e1a2aa3124e2924f62d09db42e10614d928a

      SHA256

      1cc6588ef5bedc29ed497ebd5acd253af95f6938c1d731cab2ca5d910b00ec0b

      SHA512

      ad8f3c76e9199a0d3b408426acc9163ce278ab11d951d3de7dd69b4ea54fd21a9ec37f65c16e70bfd440420a7e74f8ee55d9a30d6fa847d5af1dfccd82186f3b

      Download Submit

    • memory/220-66-0x0000000000000000-mapping.dmp

      Download

    • memory/276-65-0x0000000000000000-mapping.dmp

      Download

    • memory/536-61-0x0000000000400000-0x00000000004B3000-memory.dmp

      Filesize

      716KB

      Download

    • memory/536-55-0x0000000001CC0000-0x0000000001CEE000-memory.dmp

      Filesize

      184KB

      Download

    • memory/536-54-0x0000000075B61000-0x0000000075B63000-memory.dmp

      Filesize

      8KB

      Download

    • memory/536-56-0x0000000000400000-0x00000000004B3000-memory.dmp

      Filesize

      716KB

      Download

    • memory/1644-62-0x0000000000400000-0x00000000004B3000-memory.dmp

      Filesize

      716KB

      Download

    • memory/1644-57-0x0000000000000000-mapping.dmp

      Download

    • memory/1644-64-0x0000000000400000-0x00000000004B3000-memory.dmp

      Filesize

      716KB

      Download

    • memory/1644-74-0x0000000000400000-0x00000000004B3000-memory.dmp

      Filesize

      716KB

      Download

    • memory/1716-60-0x0000000000000000-mapping.dmp

      Download

    • memory/1720-70-0x0000000000000000-mapping.dmp

      Download

    • memory/1840-73-0x0000000000000000-mapping.dmp

      Download