Overview

overview

10

Static

static

1

2023-04-07...pt.exe

windows7-x64

10

2023-04-07...pt.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-04-2023 18:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2023-04-07_cb28c211ca8292894f3eef43ce5a6cd4_teslacrypt.exe

  • Size

    692KB

  • MD5

    cb28c211ca8292894f3eef43ce5a6cd4

  • SHA1

    70e0bc5fce5534e6dbe5200d9c965c925b596ee3

  • SHA256

    87feca94fc02b098be787060da09fc6f6473221ddf4aaa2f19321db3de256c0d

  • SHA512

    b56c612e389f7b58218a2e66a66bddea55425ed5f99a22921e2a16b2a65ca415f0dc39fbe7c88fffe082ab4bc27923dcea652396cc922d06fd82baea76b356bd

  • SSDEEP

    3072:UkmGgnjAYn2Fj5ohpzBovjtALLXOixtjOQ0hV09ZIR5YkHk7wELOhr1DwTTRpAe:g6mLD1OQW094YkHk7wsO7wPXAe

Score
10/10
teslacryptpersistenceransomware

Malware Config

Extracted

Path

C:\PerfLogs\_RECoVERY_+xcdby.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with AES More information about the encryption keys using AES can be found here: http://en.wikipedia.org/wiki/AES How did this happen ? !!! Specially for your PC was generated personal AES KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/E04AB970D8936378 2. http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/E04AB970D8936378 3. http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/E04AB970D8936378 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/E04AB970D8936378 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/E04AB970D8936378 http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/E04AB970D8936378 http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/E04AB970D8936378 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/E04AB970D8936378
URLs

http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/E04AB970D8936378

http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/E04AB970D8936378

http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/E04AB970D8936378

http://xlowfznrg4wf7dli.ONION/E04AB970D8936378

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-04-07_cb28c211ca8292894f3eef43ce5a6cd4_teslacrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-04-07_cb28c211ca8292894f3eef43ce5a6cd4_teslacrypt.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:544
    • C:\Windows\aefwgnypnqcg.exe
      C:\Windows\aefwgnypnqcg.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1556
      • C:\Windows\System32\wbem\WMIC.exe
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4424
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\2023-0~1.EXE
      2⤵
        PID:396
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3444

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\PerfLogs\_RECoVERY_+xcdby.html
      Filesize

      11KB

      MD5

      f2d25772c460d01feda13233ea12fc04

      SHA1

      6d70d2ea12a6e7707d558f8a4a2c798b1e0b6218

      SHA256

      aab3f1fb3960c17498f6483b2562a661882f09fdc61be8f97218fe7f3571cd77

      SHA512

      55fe4d0cddb2e305adbb63cb4c90c40437ebb4f5d4bee13dbbf8f40412a67d043166835134858b94672b190598b0ac69115ccd73f5e047a3c6c73c7a73fceedc

      Download Submit

    • C:\PerfLogs\_RECoVERY_+xcdby.png
      Filesize

      65KB

      MD5

      f53b237b6417f7e9d6fb55022f80ce89

      SHA1

      432f646eb5d1b233f64bd31209b72e84b8a2aefb

      SHA256

      d1d21b1aa69430edadefde8798521258b85282fefa4546f83d42331b1f57e2d7

      SHA512

      cc91e82cbaac18ea004de4b9a5c2a0ca02f668a4fb96a44d41f5e09e8cca7650d988be31d2f5e627fb4ae819cb6cf485da70ef41038c1d166950954c6f56a04f

      Download Submit

    • C:\PerfLogs\_RECoVERY_+xcdby.txt
      Filesize

      1KB

      MD5

      cb067cb841d8885869529c54219d92e3

      SHA1

      03a3f05ab8cbe612a1237f783bdd6f866240b7e7

      SHA256

      79052a300a4442f244209c82ff6e5a1f09c9d595d11e0a843aa7dea099850783

      SHA512

      47d81739f722a1abab4cc8b0154b9bca3706d0cb08c8f448ae688c16d735bc97f443e44f4dbc74a3c003d2efdebffb0f7c47ece7fc8b9875168efcc50dfa94c8

      Download Submit

    • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
      Filesize

      11KB

      MD5

      984dc97a629f49afd69acadf944f5af1

      SHA1

      f133ef2e7d7486b312ed38e24c1759217fe93df2

      SHA256

      bd8ecc210f14a135e84254ff7536f5151805bfa8cf608f4d07020979c498defd

      SHA512

      f209abecb609b1f364a56951699e2195cbf80b46f99ecb66d65650a6c86df66820d24769ef1c84f717bb15b01e6c1ac916c7df7ffa704cea64871359bc5e21cb

      Download Submit

    • C:\Program Files\Java\jre1.8.0_66\THIRDPARTYLICENSEREADME-JAVAFX.txt
      Filesize

      107KB

      MD5

      0905a974b6e66645002c46aafd5638dd

      SHA1

      3a19f730f1bf7928289d8350585e23b11ad2c3c4

      SHA256

      78fd1948d908ded9633adf36fffe8316c07f91e3e4612eeb3bde43234d5aeea2

      SHA512

      0d59b2fbf4c2f4af8f9fd80faf1071b62368076b96d91c01840b4c08e534dabe172bbdf0128f42962d547d54e90bf5f382f46c0bb635f2cbe2074d5bdc9cd700

      Download Submit

    • C:\Program Files\Java\jre1.8.0_66\THIRDPARTYLICENSEREADME.txt
      Filesize

      173KB

      MD5

      035dfaeba9e40507d6908dc8bb242517

      SHA1

      0ce7e77522161f418e8fe019508024334749fadd

      SHA256

      cb4329470648ed04f0758e7211e5c31383bb58d1c05e46888d6866c4d210ac7f

      SHA512

      5f5bc8e6504b0bda2e638fca3746ed9b92a6b1c95c2d814461f969ab245ec26bb29e3ba4ac3a16a3c0738cf3599df91a0bb21cf77271d19ce4cb29ea615bc1db

      Download Submit

    • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
      Filesize

      416B

      MD5

      784361a804e945580cd6b3abad49c2ec

      SHA1

      7c9ade01f624063a6c9933bc797db3742e8cdaed

      SHA256

      1643683227f9a725b7a4fb0a6c6435014e353cdf14d01b79d983b8574717a49f

      SHA512

      9fea876fd9def6b763e94aa05d30446b834a469d966ec6925fe0b26fe6b1423d5bff96c34ce19c2b439ae2aef541723e99162649be9ec07aebccbc2a49820af2

      Download Submit

    • C:\Windows\aefwgnypnqcg.exe
      Filesize

      692KB

      MD5

      cb28c211ca8292894f3eef43ce5a6cd4

      SHA1

      70e0bc5fce5534e6dbe5200d9c965c925b596ee3

      SHA256

      87feca94fc02b098be787060da09fc6f6473221ddf4aaa2f19321db3de256c0d

      SHA512

      b56c612e389f7b58218a2e66a66bddea55425ed5f99a22921e2a16b2a65ca415f0dc39fbe7c88fffe082ab4bc27923dcea652396cc922d06fd82baea76b356bd

      Download Submit

    • C:\Windows\aefwgnypnqcg.exe
      Filesize

      692KB

      MD5

      cb28c211ca8292894f3eef43ce5a6cd4

      SHA1

      70e0bc5fce5534e6dbe5200d9c965c925b596ee3

      SHA256

      87feca94fc02b098be787060da09fc6f6473221ddf4aaa2f19321db3de256c0d

      SHA512

      b56c612e389f7b58218a2e66a66bddea55425ed5f99a22921e2a16b2a65ca415f0dc39fbe7c88fffe082ab4bc27923dcea652396cc922d06fd82baea76b356bd

      Download Submit