teslacrypt | 87feca94fc02b098be787060da09fc6f6473221ddf4aaa2f19321db3de256c0d

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08-04-2023 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-04-07_cb28c211ca8292894f3eef43ce5a6cd4_teslacrypt.exe
Size

692KB
MD5

cb28c211ca8292894f3eef43ce5a6cd4
SHA1

70e0bc5fce5534e6dbe5200d9c965c925b596ee3
SHA256

87feca94fc02b098be787060da09fc6f6473221ddf4aaa2f19321db3de256c0d
SHA512

b56c612e389f7b58218a2e66a66bddea55425ed5f99a22921e2a16b2a65ca415f0dc39fbe7c88fffe082ab4bc27923dcea652396cc922d06fd82baea76b356bd
SSDEEP

3072:UkmGgnjAYn2Fj5ohpzBovjtALLXOixtjOQ0hV09ZIR5YkHk7wELOhr1DwTTRpAe:g6mLD1OQW094YkHk7wsO7wPXAe

Score

10^/10

teslacrypt persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECoVERY_+cldyi.txt

Family

teslacrypt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/98A14FEFBC432DA5 2. http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/98A14FEFBC432DA5 3. http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/98A14FEFBC432DA5 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/98A14FEFBC432DA5 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/98A14FEFBC432DA5 http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/98A14FEFBC432DA5 http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/98A14FEFBC432DA5 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/98A14FEFBC432DA5

URLs

http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/98A14FEFBC432DA5

http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/98A14FEFBC432DA5

http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/98A14FEFBC432DA5

http://xlowfznrg4wf7dli.ONION/98A14FEFBC432DA5

Signatures

TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
ransomware teslacrypt
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

armppqjmmuqd.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\BackupInitialize.png => C:\Users\Admin\Pictures\BackupInitialize.png.mp3	armppqjmmuqd.exe
File renamed	C:\Users\Admin\Pictures\MountSuspend.png => C:\Users\Admin\Pictures\MountSuspend.png.mp3	armppqjmmuqd.exe
File renamed	C:\Users\Admin\Pictures\PushLock.png => C:\Users\Admin\Pictures\PushLock.png.mp3	armppqjmmuqd.exe
File renamed	C:\Users\Admin\Pictures\StopPublish.png => C:\Users\Admin\Pictures\StopPublish.png.mp3	armppqjmmuqd.exe
File renamed	C:\Users\Admin\Pictures\UnprotectMeasure.raw => C:\Users\Admin\Pictures\UnprotectMeasure.raw.mp3	armppqjmmuqd.exe
File renamed	C:\Users\Admin\Pictures\WaitRedo.png => C:\Users\Admin\Pictures\WaitRedo.png.mp3	armppqjmmuqd.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1860 cmd.exe

pid	process
1860	cmd.exe

Drops startup file 3 IoCs

Processes:

armppqjmmuqd.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECoVERY_+cldyi.png	armppqjmmuqd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECoVERY_+cldyi.txt	armppqjmmuqd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_RECoVERY_+cldyi.html	armppqjmmuqd.exe

Executes dropped EXE 1 IoCs

Processes:

armppqjmmuqd.exe

pid process

1140 armppqjmmuqd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

armppqjmmuqd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run	armppqjmmuqd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\othckxwdfrrd = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\armppqjmmuqd.exe\""	armppqjmmuqd.exe

Drops file in Program Files directory 64 IoCs

Processes:

armppqjmmuqd.exe

description	ioc	process
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-disable.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\_RECoVERY_+cldyi.html	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_over.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Microsoft Games\More Games\ja-JP\_RECoVERY_+cldyi.html	armppqjmmuqd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_RECoVERY_+cldyi.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\_RECoVERY_+cldyi.txt	armppqjmmuqd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zu\_RECoVERY_+cldyi.txt	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\_RECoVERY_+cldyi.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hr\_RECoVERY_+cldyi.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\wa\_RECoVERY_+cldyi.txt	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\es-ES\_RECoVERY_+cldyi.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\_RECoVERY_+cldyi.html	armppqjmmuqd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\my\_RECoVERY_+cldyi.html	armppqjmmuqd.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ach\_RECoVERY_+cldyi.txt	armppqjmmuqd.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\_RECoVERY_+cldyi.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\_RECoVERY_+cldyi.txt	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-gibbous.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\_RECoVERY_+cldyi.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\it-IT\_RECoVERY_+cldyi.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\_RECoVERY_+cldyi.txt	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\_RECoVERY_+cldyi.html	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\settings.js	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_few-showers.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\_RECoVERY_+cldyi.html	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\de-DE\_RECoVERY_+cldyi.txt	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_down.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\_RECoVERY_+cldyi.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\settings.js	armppqjmmuqd.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\_RECoVERY_+cldyi.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Windows Media Player\en-US\_RECoVERY_+cldyi.txt	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_h.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\_RECoVERY_+cldyi.html	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\_RECoVERY_+cldyi.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\_RECoVERY_+cldyi.txt	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg	armppqjmmuqd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluTSFrame.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\RSSFeeds.js	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\_RECoVERY_+cldyi.txt	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\_RECoVERY_+cldyi.txt	armppqjmmuqd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ca\_RECoVERY_+cldyi.txt	armppqjmmuqd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\_RECoVERY_+cldyi.html	armppqjmmuqd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\br\_RECoVERY_+cldyi.html	armppqjmmuqd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sr\_RECoVERY_+cldyi.txt	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\_RECoVERY_+cldyi.txt	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\_RECoVERY_+cldyi.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt	armppqjmmuqd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\gui\_RECoVERY_+cldyi.html	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\library.js	armppqjmmuqd.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\_RECoVERY_+cldyi.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_RECoVERY_+cldyi.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\extensions\_RECoVERY_+cldyi.html	armppqjmmuqd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Common Files\System\it-IT\_RECoVERY_+cldyi.png	armppqjmmuqd.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\_RECoVERY_+cldyi.png	armppqjmmuqd.exe

Drops file in Windows directory 2 IoCs

Processes:

2023-04-07_cb28c211ca8292894f3eef43ce5a6cd4_teslacrypt.exe

description	ioc	process
File created	C:\Windows\armppqjmmuqd.exe	2023-04-07_cb28c211ca8292894f3eef43ce5a6cd4_teslacrypt.exe
File opened for modification	C:\Windows\armppqjmmuqd.exe	2023-04-07_cb28c211ca8292894f3eef43ce5a6cd4_teslacrypt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

1196 NOTEPAD.EXE

pid	process
1196	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

armppqjmmuqd.exe

pid	process
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe
1140	armppqjmmuqd.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

Processes:

2023-04-07_cb28c211ca8292894f3eef43ce5a6cd4_teslacrypt.exearmppqjmmuqd.exeWMIC.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1412	2023-04-07_cb28c211ca8292894f3eef43ce5a6cd4_teslacrypt.exe
Token: SeDebugPrivilege	1140	armppqjmmuqd.exe
Token: SeIncreaseQuotaPrivilege	1588	WMIC.exe
Token: SeSecurityPrivilege	1588	WMIC.exe
Token: SeTakeOwnershipPrivilege	1588	WMIC.exe
Token: SeLoadDriverPrivilege	1588	WMIC.exe
Token: SeSystemProfilePrivilege	1588	WMIC.exe
Token: SeSystemtimePrivilege	1588	WMIC.exe
Token: SeProfSingleProcessPrivilege	1588	WMIC.exe
Token: SeIncBasePriorityPrivilege	1588	WMIC.exe
Token: SeCreatePagefilePrivilege	1588	WMIC.exe
Token: SeBackupPrivilege	1588	WMIC.exe
Token: SeRestorePrivilege	1588	WMIC.exe
Token: SeShutdownPrivilege	1588	WMIC.exe
Token: SeDebugPrivilege	1588	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1588	WMIC.exe
Token: SeRemoteShutdownPrivilege	1588	WMIC.exe
Token: SeUndockPrivilege	1588	WMIC.exe
Token: SeManageVolumePrivilege	1588	WMIC.exe
Token: 33	1588	WMIC.exe
Token: 34	1588	WMIC.exe
Token: 35	1588	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1588	WMIC.exe
Token: SeSecurityPrivilege	1588	WMIC.exe
Token: SeTakeOwnershipPrivilege	1588	WMIC.exe
Token: SeLoadDriverPrivilege	1588	WMIC.exe
Token: SeSystemProfilePrivilege	1588	WMIC.exe
Token: SeSystemtimePrivilege	1588	WMIC.exe
Token: SeProfSingleProcessPrivilege	1588	WMIC.exe
Token: SeIncBasePriorityPrivilege	1588	WMIC.exe
Token: SeCreatePagefilePrivilege	1588	WMIC.exe
Token: SeBackupPrivilege	1588	WMIC.exe
Token: SeRestorePrivilege	1588	WMIC.exe
Token: SeShutdownPrivilege	1588	WMIC.exe
Token: SeDebugPrivilege	1588	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1588	WMIC.exe
Token: SeRemoteShutdownPrivilege	1588	WMIC.exe
Token: SeUndockPrivilege	1588	WMIC.exe
Token: SeManageVolumePrivilege	1588	WMIC.exe
Token: 33	1588	WMIC.exe
Token: 34	1588	WMIC.exe
Token: 35	1588	WMIC.exe
Token: SeBackupPrivilege	1032	vssvc.exe
Token: SeRestorePrivilege	1032	vssvc.exe
Token: SeAuditPrivilege	1032	vssvc.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

2023-04-07_cb28c211ca8292894f3eef43ce5a6cd4_teslacrypt.exearmppqjmmuqd.exe

description	pid	process	target process
PID 1412 wrote to memory of 1140	1412	2023-04-07_cb28c211ca8292894f3eef43ce5a6cd4_teslacrypt.exe	armppqjmmuqd.exe
PID 1412 wrote to memory of 1140	1412	2023-04-07_cb28c211ca8292894f3eef43ce5a6cd4_teslacrypt.exe	armppqjmmuqd.exe
PID 1412 wrote to memory of 1140	1412	2023-04-07_cb28c211ca8292894f3eef43ce5a6cd4_teslacrypt.exe	armppqjmmuqd.exe
PID 1412 wrote to memory of 1140	1412	2023-04-07_cb28c211ca8292894f3eef43ce5a6cd4_teslacrypt.exe	armppqjmmuqd.exe
PID 1412 wrote to memory of 1860	1412	2023-04-07_cb28c211ca8292894f3eef43ce5a6cd4_teslacrypt.exe	cmd.exe
PID 1412 wrote to memory of 1860	1412	2023-04-07_cb28c211ca8292894f3eef43ce5a6cd4_teslacrypt.exe	cmd.exe
PID 1412 wrote to memory of 1860	1412	2023-04-07_cb28c211ca8292894f3eef43ce5a6cd4_teslacrypt.exe	cmd.exe
PID 1412 wrote to memory of 1860	1412	2023-04-07_cb28c211ca8292894f3eef43ce5a6cd4_teslacrypt.exe	cmd.exe
PID 1140 wrote to memory of 1588	1140	armppqjmmuqd.exe	WMIC.exe
PID 1140 wrote to memory of 1588	1140	armppqjmmuqd.exe	WMIC.exe
PID 1140 wrote to memory of 1588	1140	armppqjmmuqd.exe	WMIC.exe
PID 1140 wrote to memory of 1588	1140	armppqjmmuqd.exe	WMIC.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

armppqjmmuqd.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	armppqjmmuqd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	armppqjmmuqd.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2023-04-07_cb28c211ca8292894f3eef43ce5a6cd4_teslacrypt.exe
"C:\Users\Admin\AppData\Local\Temp\2023-04-07_cb28c211ca8292894f3eef43ce5a6cd4_teslacrypt.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\armppqjmmuqd.exe
  C:\Windows\armppqjmmuqd.exe
  2⤵
  - Modifies extensions of user files
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1140
- - C:\Windows\System32\wbem\WMIC.exe
    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1588
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:1196
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\2023-0~1.EXE
  2⤵
  - Deletes itself
  PID:1860

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECoVERY_+cldyi.html

Filesize
11KB

MD5
14747eae5e94814a4be9d85621c8bbf1

SHA1
5fac360c490de25b654e1ad1b5e015aec30c7ce8

SHA256
9bcd9f446ffbd18e00c7d4d65d41e21708d5a59196afd0556ae36e0762bd9582

SHA512
0790530158ad45ae5a14427cbf03c41d1ba938b5149b2f529e851fb8641553d3298fe4dbbc2a5c3eba23b1601f1329d875201042d0027cca668051504706251d

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECoVERY_+cldyi.png

Filesize
65KB

MD5
881a74502cf4497d329df56b10d9e71b

SHA1
323a7f2d5bde2eba4284aba4662dc33a4a9f1d88

SHA256
b6f33f5f7a9e80589ecaf5c4b13698c25e92159246f8a5f418e3ce9a0728673d

SHA512
12afdb6c07e6620dd549b00b25ba0c812ce09c6129a1f02cd6716c2562389c91e5850f58defbe60234482673bbb36a13d093b57bd2325b6c11927057f967648c

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECoVERY_+cldyi.txt

Filesize
1KB

MD5
cfc88d8882a80efa7373d19dbefd5977

SHA1
9ea1d01de4f024c3341b6d66a8b4dd3d828a45a9

SHA256
89f69c7557fcdd983b766c89715356e31e99628dbce5285e779cb2e6d0596b5f

SHA512
96907559c7e7a5ad8799e182ff2a57fb77e24a85e742142b39ad30ffa2712e73e4cb1906a8a88a17e4e6738f1cd0da40b2e59cebc2854a8745f35b3c9cfc4c1a

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
6861cb35c645b9138937388cd79afe6e

SHA1
b97c8e14bc8ee6427a176e631681809952c7446a

SHA256
bb40c87899c695028d818fa0e6ade9e64934e3a46ea49c5e7a3f5d75562ac785

SHA512
4e91fcb45389fe31ca793a14ee9a9955acc32823321152aad1528998670abc683c9ce90d886d4253c41fa49f78b71d39fbb42b4ce3ba37fb4078137dc1c39448

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
87e519a88e95c0be64aa315ce9398d27

SHA1
d53dc8c80627abb68c57fe867c30ef81b656407c

SHA256
11c6a9433ad3aba724d6a2281a43201a84fdaa44f252235ad80fb1a5b1510dce

SHA512
584b474d0a4de8cccf4b661a301b70edadfd09f84825f51d5ddb06a9c2ad65a0faf400662c2eb01bb60992ca56c79f1658318c939c8850d7934287943af68496

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
173KB

MD5
ee45307ef46ab2b1512f86b0efd26c81

SHA1
ab4f6fcd1e90d5f420349574d52c935efcbff433

SHA256
508d83b8bc59a831a29dfa08e016ce393b8ca47bdf547d583628ef5be6d3bb68

SHA512
f964669df5f00d229605e54f7b24e379c83935d94588f1072dbb789c4dc28ec213b976509e67a31fdac6b93e0cd21fc9c62d25d6d722e4381f16e50863857e9c

Download Submit
C:\Windows\armppqjmmuqd.exe

Filesize
692KB

MD5
cb28c211ca8292894f3eef43ce5a6cd4

SHA1
70e0bc5fce5534e6dbe5200d9c965c925b596ee3

SHA256
87feca94fc02b098be787060da09fc6f6473221ddf4aaa2f19321db3de256c0d

SHA512
b56c612e389f7b58218a2e66a66bddea55425ed5f99a22921e2a16b2a65ca415f0dc39fbe7c88fffe082ab4bc27923dcea652396cc922d06fd82baea76b356bd

Download Submit
C:\Windows\armppqjmmuqd.exe

Filesize
692KB

MD5
cb28c211ca8292894f3eef43ce5a6cd4

SHA1
70e0bc5fce5534e6dbe5200d9c965c925b596ee3

SHA256
87feca94fc02b098be787060da09fc6f6473221ddf4aaa2f19321db3de256c0d

SHA512
b56c612e389f7b58218a2e66a66bddea55425ed5f99a22921e2a16b2a65ca415f0dc39fbe7c88fffe082ab4bc27923dcea652396cc922d06fd82baea76b356bd

Download Submit
C:\Windows\armppqjmmuqd.exe

Filesize
692KB

MD5
cb28c211ca8292894f3eef43ce5a6cd4

SHA1
70e0bc5fce5534e6dbe5200d9c965c925b596ee3

SHA256
87feca94fc02b098be787060da09fc6f6473221ddf4aaa2f19321db3de256c0d

SHA512
b56c612e389f7b58218a2e66a66bddea55425ed5f99a22921e2a16b2a65ca415f0dc39fbe7c88fffe082ab4bc27923dcea652396cc922d06fd82baea76b356bd

Download Submit