Overview

overview

10

Static

static

4a06e0c0fa...2f.exe

windows7_x64

10

4a06e0c0fa...2f.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    152s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    12-07-2022 14:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f.exe

  • Size

    360KB

  • MD5

    6ef1026b82ff5c587e4355a53c2c944e

  • SHA1

    af5e5cdb2c1f58c2e020e07712a8d5cea162bbe3

  • SHA256

    4a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f

  • SHA512

    244ba69cc5d7300146cf83ec08b0e1e1fb255c569555e1c653b5ac1e42a5e7ceb64bdebb732c03261f80683423e44ae62ae3cd71130417a7531d59827986fe0f

Score
10/10
teslacryptpersistenceransomwarespywarestealersuricata

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1809750270-3141839489-3074374771-1000\_RECOVERY_+oobbj.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/8CEA6C67DED556 2. http://tes543berda73i48fsdfsd.keratadze.at/8CEA6C67DED556 3. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/8CEA6C67DED556 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/8CEA6C67DED556 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/8CEA6C67DED556 http://tes543berda73i48fsdfsd.keratadze.at/8CEA6C67DED556 http://tt54rfdjhb34rfbnknaerg.milerteddy.com/8CEA6C67DED556 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/8CEA6C67DED556
URLs

http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/8CEA6C67DED556

http://tes543berda73i48fsdfsd.keratadze.at/8CEA6C67DED556

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/8CEA6C67DED556

http://xlowfznrg4wf7dli.ONION/8CEA6C67DED556

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt
  • suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon

    suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon

    suricata
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f.exe
    "C:\Users\Admin\AppData\Local\Temp\4a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Windows\whykhtmerolf.exe
      C:\Windows\whykhtmerolf.exe
      2⤵
      • Executes dropped EXE
      • Modifies extensions of user files
      • Checks computer location settings
      • Drops startup file
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1224
      • C:\Windows\System32\wbem\WMIC.exe
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1592
      • C:\Windows\SysWOW64\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:4664
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
        3⤵
          PID:1996
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7ffa99a746f8,0x7ffa99a74708,0x7ffa99a74718
            4⤵
              PID:4216
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
            3⤵
              PID:3592
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\4A06E0~1.EXE
            2⤵
              PID:4324
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:616

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\Desktop\RECOVERY.TXT
            Filesize

            1KB

            MD5

            15061e6e468c78436989e66c53dc1189

            SHA1

            e638439bf01083ed2526dd57f8fec99db58ecdf4

            SHA256

            90a180a857f054509ec68ec7fe2a767ff0b772fbd946e70d7048e259c642d3ba

            SHA512

            5d2b26d647702eea51cb581f867d83c7e2871ca5ee90f4f4eb0f0bf42fe34f6ac8ea3a592a88869f3a1d05b0e4dfccb3d8ae84dd7464447e36437a3cd8e8119e

            Download Submit

          • C:\Windows\whykhtmerolf.exe
            Filesize

            360KB

            MD5

            6ef1026b82ff5c587e4355a53c2c944e

            SHA1

            af5e5cdb2c1f58c2e020e07712a8d5cea162bbe3

            SHA256

            4a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f

            SHA512

            244ba69cc5d7300146cf83ec08b0e1e1fb255c569555e1c653b5ac1e42a5e7ceb64bdebb732c03261f80683423e44ae62ae3cd71130417a7531d59827986fe0f

            Download Submit

          • C:\Windows\whykhtmerolf.exe
            Filesize

            360KB

            MD5

            6ef1026b82ff5c587e4355a53c2c944e

            SHA1

            af5e5cdb2c1f58c2e020e07712a8d5cea162bbe3

            SHA256

            4a06e0c0face5ed9d31164328a73d9cdc145a61945bfe4678e49d31d6ee34e2f

            SHA512

            244ba69cc5d7300146cf83ec08b0e1e1fb255c569555e1c653b5ac1e42a5e7ceb64bdebb732c03261f80683423e44ae62ae3cd71130417a7531d59827986fe0f

            Download Submit

          • memory/1224-143-0x00000000021B0000-0x0000000002235000-memory.dmp

            Filesize

            532KB

            Download

          • memory/1224-135-0x0000000000000000-mapping.dmp

            Download

          • memory/1592-144-0x0000000000000000-mapping.dmp

            Download

          • memory/1996-146-0x0000000000000000-mapping.dmp

            Download

          • memory/2124-130-0x0000000000400000-0x000000000049E000-memory.dmp

            Filesize

            632KB

            Download

          • memory/2124-134-0x0000000000A80000-0x0000000000B05000-memory.dmp

            Filesize

            532KB

            Download

          • memory/3592-147-0x0000000000000000-mapping.dmp

            Download

          • memory/4216-148-0x0000000000000000-mapping.dmp

            Download

          • memory/4324-138-0x0000000000000000-mapping.dmp

            Download

          • memory/4664-145-0x0000000000000000-mapping.dmp

            Download