Analysis
-
max time kernel
152s -
max time network
167s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12/07/2022, 14:50
Static task
static1
Behavioral task
behavioral1
Sample
4a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
4a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f.exe
-
Size
360KB
-
MD5
6ef1026b82ff5c587e4355a53c2c944e
-
SHA1
af5e5cdb2c1f58c2e020e07712a8d5cea162bbe3
-
SHA256
4a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f
-
SHA512
244ba69cc5d7300146cf83ec08b0e1e1fb255c569555e1c653b5ac1e42a5e7ceb64bdebb732c03261f80683423e44ae62ae3cd71130417a7531d59827986fe0f
Score
10/10
Malware Config
Extracted
Path
C:\$Recycle.Bin\S-1-5-21-2277218442-1199762539-2004043321-1000\_RECOVERY_+flkut.txt
Family
teslacrypt
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with AES
More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES
How did this happen ?
!!! Specially for your PC was generated personal AES KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:
1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/56B084A310D02246
2. http://tes543berda73i48fsdfsd.keratadze.at/56B084A310D02246
3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/56B084A310D02246
If for some reasons the addresses are not available, follow these steps:
1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en
2. After a successful installation, run the browser
3. Type in the address bar: xlowfznrg4wf7dli.onion/56B084A310D02246
4. Follow the instructions on the site.
---------------- IMPORTANT INFORMATION------------------------
*-*-* Your personal pages:
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/56B084A310D02246
http://tes543berda73i48fsdfsd.keratadze.at/56B084A310D02246
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/56B084A310D02246
*-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/56B084A310D02246
URLs
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/56B084A310D02246
http://tes543berda73i48fsdfsd.keratadze.at/56B084A310D02246
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/56B084A310D02246
http://xlowfznrg4wf7dli.ONION/56B084A310D02246
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
pid Process 1696 cexmikkggtka.exe -
Deletes itself 1 IoCs
pid Process 1464 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run cexmikkggtka.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\ubhhxiwnmjlw = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\cexmikkggtka.exe\"" cexmikkggtka.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\cexmikkggtka.exe 4a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f.exe File opened for modification C:\Windows\cexmikkggtka.exe 4a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe 1696 cexmikkggtka.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 1828 4a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f.exe Token: SeDebugPrivilege 1696 cexmikkggtka.exe Token: SeIncreaseQuotaPrivilege 1260 WMIC.exe Token: SeSecurityPrivilege 1260 WMIC.exe Token: SeTakeOwnershipPrivilege 1260 WMIC.exe Token: SeLoadDriverPrivilege 1260 WMIC.exe Token: SeSystemProfilePrivilege 1260 WMIC.exe Token: SeSystemtimePrivilege 1260 WMIC.exe Token: SeProfSingleProcessPrivilege 1260 WMIC.exe Token: SeIncBasePriorityPrivilege 1260 WMIC.exe Token: SeCreatePagefilePrivilege 1260 WMIC.exe Token: SeBackupPrivilege 1260 WMIC.exe Token: SeRestorePrivilege 1260 WMIC.exe Token: SeShutdownPrivilege 1260 WMIC.exe Token: SeDebugPrivilege 1260 WMIC.exe Token: SeSystemEnvironmentPrivilege 1260 WMIC.exe Token: SeRemoteShutdownPrivilege 1260 WMIC.exe Token: SeUndockPrivilege 1260 WMIC.exe Token: SeManageVolumePrivilege 1260 WMIC.exe Token: 33 1260 WMIC.exe Token: 34 1260 WMIC.exe Token: 35 1260 WMIC.exe Token: SeIncreaseQuotaPrivilege 1260 WMIC.exe Token: SeSecurityPrivilege 1260 WMIC.exe Token: SeTakeOwnershipPrivilege 1260 WMIC.exe Token: SeLoadDriverPrivilege 1260 WMIC.exe Token: SeSystemProfilePrivilege 1260 WMIC.exe Token: SeSystemtimePrivilege 1260 WMIC.exe Token: SeProfSingleProcessPrivilege 1260 WMIC.exe Token: SeIncBasePriorityPrivilege 1260 WMIC.exe Token: SeCreatePagefilePrivilege 1260 WMIC.exe Token: SeBackupPrivilege 1260 WMIC.exe Token: SeRestorePrivilege 1260 WMIC.exe Token: SeShutdownPrivilege 1260 WMIC.exe Token: SeDebugPrivilege 1260 WMIC.exe Token: SeSystemEnvironmentPrivilege 1260 WMIC.exe Token: SeRemoteShutdownPrivilege 1260 WMIC.exe Token: SeUndockPrivilege 1260 WMIC.exe Token: SeManageVolumePrivilege 1260 WMIC.exe Token: 33 1260 WMIC.exe Token: 34 1260 WMIC.exe Token: 35 1260 WMIC.exe Token: SeBackupPrivilege 1644 vssvc.exe Token: SeRestorePrivilege 1644 vssvc.exe Token: SeAuditPrivilege 1644 vssvc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1828 wrote to memory of 1696 1828 4a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f.exe 28 PID 1828 wrote to memory of 1696 1828 4a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f.exe 28 PID 1828 wrote to memory of 1696 1828 4a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f.exe 28 PID 1828 wrote to memory of 1696 1828 4a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f.exe 28 PID 1828 wrote to memory of 1464 1828 4a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f.exe 29 PID 1828 wrote to memory of 1464 1828 4a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f.exe 29 PID 1828 wrote to memory of 1464 1828 4a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f.exe 29 PID 1828 wrote to memory of 1464 1828 4a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f.exe 29 PID 1696 wrote to memory of 1260 1696 cexmikkggtka.exe 31 PID 1696 wrote to memory of 1260 1696 cexmikkggtka.exe 31 PID 1696 wrote to memory of 1260 1696 cexmikkggtka.exe 31 PID 1696 wrote to memory of 1260 1696 cexmikkggtka.exe 31 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cexmikkggtka.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" cexmikkggtka.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f.exe"C:\Users\Admin\AppData\Local\Temp\4a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\cexmikkggtka.exeC:\Windows\cexmikkggtka.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1696 -
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1260
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\4A06E0~1.EXE2⤵
- Deletes itself
PID:1464
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1644
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
360KB
MD56ef1026b82ff5c587e4355a53c2c944e
SHA1af5e5cdb2c1f58c2e020e07712a8d5cea162bbe3
SHA2564a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f
SHA512244ba69cc5d7300146cf83ec08b0e1e1fb255c569555e1c653b5ac1e42a5e7ceb64bdebb732c03261f80683423e44ae62ae3cd71130417a7531d59827986fe0f
-
Filesize
360KB
MD56ef1026b82ff5c587e4355a53c2c944e
SHA1af5e5cdb2c1f58c2e020e07712a8d5cea162bbe3
SHA2564a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f
SHA512244ba69cc5d7300146cf83ec08b0e1e1fb255c569555e1c653b5ac1e42a5e7ceb64bdebb732c03261f80683423e44ae62ae3cd71130417a7531d59827986fe0f