Analysis
-
max time kernel
152s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
08-11-2022 13:29
Static task
static1
Behavioral task
behavioral1
Sample
a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185.exe
Resource
win10v2004-20220812-en
General
-
Target
a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185.exe
-
Size
384KB
-
MD5
6eb1c8fb571684bd3d219b963fad3d6f
-
SHA1
b9205cd714e320fbac5f8c22171d40cc005a26ab
-
SHA256
a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185
-
SHA512
c65072e68066bf503ffae0605c56ecc86142c0d72cd14367a3c9237725ef2705b58d14f78abc31795d6fec691737a9562c8c48075ca6e3e614824be8b1278cde
-
SSDEEP
6144:5NcjGIJMerRAOEYIAZ6enYlFXENKtamXUIecJw+y9Mn8c8O0lb4oI:w1JfVaT7JlF00Rex9M13oI
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\Recovery+xstrf.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/F663808E1B65445
http://tes543berda73i48fsdfsd.keratadze.at/F663808E1B65445
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/F663808E1B65445
http://xlowfznrg4wf7dli.ONION/F663808E1B65445
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
pid Process 944 laejuvtmcuia.exe -
Deletes itself 1 IoCs
pid Process 1200 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run laejuvtmcuia.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\eccujsxbskou = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\laejuvtmcuia.exe\"" laejuvtmcuia.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\cs.txt laejuvtmcuia.exe File opened for modification C:\Program Files\Common Files\System\msadc\Recovery+xstrf.html laejuvtmcuia.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png laejuvtmcuia.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\Recovery+xstrf.png laejuvtmcuia.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv laejuvtmcuia.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png laejuvtmcuia.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\Recovery+xstrf.html laejuvtmcuia.exe File opened for modification C:\Program Files\Internet Explorer\images\Recovery+xstrf.html laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Recovery+xstrf.png laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\Recovery+xstrf.html laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\Recovery+xstrf.html laejuvtmcuia.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt laejuvtmcuia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\Recovery+xstrf.png laejuvtmcuia.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv laejuvtmcuia.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Recovery+xstrf.png laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\Recovery+xstrf.png laejuvtmcuia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi laejuvtmcuia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\Recovery+xstrf.html laejuvtmcuia.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Recovery+xstrf.txt laejuvtmcuia.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Recovery+xstrf.html laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\Recovery+xstrf.txt laejuvtmcuia.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Recovery+xstrf.txt laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Recovery+xstrf.html laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\Recovery+xstrf.txt laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\Recovery+xstrf.txt laejuvtmcuia.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt laejuvtmcuia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\Recovery+xstrf.txt laejuvtmcuia.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png laejuvtmcuia.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png laejuvtmcuia.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\Recovery+xstrf.png laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Recovery+xstrf.txt laejuvtmcuia.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt laejuvtmcuia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\Recovery+xstrf.html laejuvtmcuia.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\Recovery+xstrf.txt laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\Recovery+xstrf.html laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\Recovery+xstrf.png laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\Recovery+xstrf.txt laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\Recovery+xstrf.png laejuvtmcuia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\Recovery+xstrf.txt laejuvtmcuia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\Recovery+xstrf.txt laejuvtmcuia.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\Recovery+xstrf.html laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\Recovery+xstrf.txt laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\Recovery+xstrf.png laejuvtmcuia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\Recovery+xstrf.html laejuvtmcuia.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv laejuvtmcuia.exe File opened for modification C:\Program Files\Google\Chrome\Recovery+xstrf.txt laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\Recovery+xstrf.html laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Recovery+xstrf.txt laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\Recovery+xstrf.html laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\Recovery+xstrf.html laejuvtmcuia.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png laejuvtmcuia.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png laejuvtmcuia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\Recovery+xstrf.html laejuvtmcuia.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\Recovery+xstrf.txt laejuvtmcuia.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\Recovery+xstrf.html laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\Recovery+xstrf.txt laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\Recovery+xstrf.html laejuvtmcuia.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\Recovery+xstrf.html laejuvtmcuia.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt laejuvtmcuia.exe File opened for modification C:\Program Files\Common Files\System\ado\Recovery+xstrf.html laejuvtmcuia.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\laejuvtmcuia.exe a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185.exe File opened for modification C:\Windows\laejuvtmcuia.exe a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe 944 laejuvtmcuia.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 2004 a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185.exe Token: SeDebugPrivilege 944 laejuvtmcuia.exe Token: SeIncreaseQuotaPrivilege 584 WMIC.exe Token: SeSecurityPrivilege 584 WMIC.exe Token: SeTakeOwnershipPrivilege 584 WMIC.exe Token: SeLoadDriverPrivilege 584 WMIC.exe Token: SeSystemProfilePrivilege 584 WMIC.exe Token: SeSystemtimePrivilege 584 WMIC.exe Token: SeProfSingleProcessPrivilege 584 WMIC.exe Token: SeIncBasePriorityPrivilege 584 WMIC.exe Token: SeCreatePagefilePrivilege 584 WMIC.exe Token: SeBackupPrivilege 584 WMIC.exe Token: SeRestorePrivilege 584 WMIC.exe Token: SeShutdownPrivilege 584 WMIC.exe Token: SeDebugPrivilege 584 WMIC.exe Token: SeSystemEnvironmentPrivilege 584 WMIC.exe Token: SeRemoteShutdownPrivilege 584 WMIC.exe Token: SeUndockPrivilege 584 WMIC.exe Token: SeManageVolumePrivilege 584 WMIC.exe Token: 33 584 WMIC.exe Token: 34 584 WMIC.exe Token: 35 584 WMIC.exe Token: SeIncreaseQuotaPrivilege 584 WMIC.exe Token: SeSecurityPrivilege 584 WMIC.exe Token: SeTakeOwnershipPrivilege 584 WMIC.exe Token: SeLoadDriverPrivilege 584 WMIC.exe Token: SeSystemProfilePrivilege 584 WMIC.exe Token: SeSystemtimePrivilege 584 WMIC.exe Token: SeProfSingleProcessPrivilege 584 WMIC.exe Token: SeIncBasePriorityPrivilege 584 WMIC.exe Token: SeCreatePagefilePrivilege 584 WMIC.exe Token: SeBackupPrivilege 584 WMIC.exe Token: SeRestorePrivilege 584 WMIC.exe Token: SeShutdownPrivilege 584 WMIC.exe Token: SeDebugPrivilege 584 WMIC.exe Token: SeSystemEnvironmentPrivilege 584 WMIC.exe Token: SeRemoteShutdownPrivilege 584 WMIC.exe Token: SeUndockPrivilege 584 WMIC.exe Token: SeManageVolumePrivilege 584 WMIC.exe Token: 33 584 WMIC.exe Token: 34 584 WMIC.exe Token: 35 584 WMIC.exe Token: SeBackupPrivilege 856 vssvc.exe Token: SeRestorePrivilege 856 vssvc.exe Token: SeAuditPrivilege 856 vssvc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2004 wrote to memory of 944 2004 a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185.exe 28 PID 2004 wrote to memory of 944 2004 a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185.exe 28 PID 2004 wrote to memory of 944 2004 a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185.exe 28 PID 2004 wrote to memory of 944 2004 a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185.exe 28 PID 2004 wrote to memory of 1200 2004 a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185.exe 29 PID 2004 wrote to memory of 1200 2004 a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185.exe 29 PID 2004 wrote to memory of 1200 2004 a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185.exe 29 PID 2004 wrote to memory of 1200 2004 a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185.exe 29 PID 944 wrote to memory of 584 944 laejuvtmcuia.exe 31 PID 944 wrote to memory of 584 944 laejuvtmcuia.exe 31 PID 944 wrote to memory of 584 944 laejuvtmcuia.exe 31 PID 944 wrote to memory of 584 944 laejuvtmcuia.exe 31 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System laejuvtmcuia.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" laejuvtmcuia.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185.exe"C:\Users\Admin\AppData\Local\Temp\a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\laejuvtmcuia.exeC:\Windows\laejuvtmcuia.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:944 -
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
PID:584
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\A9401D~1.EXE2⤵
- Deletes itself
PID:1200
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:856
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384KB
MD56eb1c8fb571684bd3d219b963fad3d6f
SHA1b9205cd714e320fbac5f8c22171d40cc005a26ab
SHA256a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185
SHA512c65072e68066bf503ffae0605c56ecc86142c0d72cd14367a3c9237725ef2705b58d14f78abc31795d6fec691737a9562c8c48075ca6e3e614824be8b1278cde
-
Filesize
384KB
MD56eb1c8fb571684bd3d219b963fad3d6f
SHA1b9205cd714e320fbac5f8c22171d40cc005a26ab
SHA256a9401d52ba62b218245100c6343448040eac43934476fd1fc7c14dbc8f5a6185
SHA512c65072e68066bf503ffae0605c56ecc86142c0d72cd14367a3c9237725ef2705b58d14f78abc31795d6fec691737a9562c8c48075ca6e3e614824be8b1278cde