Analysis
-
max time kernel
138s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
06-02-2024 19:28
General
-
Target
VirusShare_b774e9f49d4aa8a2a009d06a6cdb6f8a.exe
-
Size
396KB
-
MD5
b774e9f49d4aa8a2a009d06a6cdb6f8a
-
SHA1
5eaf1e24c495634ecbf7c81b640d10de8a3399d2
-
SHA256
d3aef7ccd94c55c75a19d3ac6e31ac4af1cfcdd64e77be9afc4e5c8de9301686
-
SHA512
b1cdb65dd44aefae7933944a824faac70b1fe68267e245a3a1181deda7b8cb9016e502550cd73974b3fd85756602193d4db8a23e9f3622d0ed5c59a780b1aecf
-
SSDEEP
6144:CT3WR0F1lDPR+bJnm/jtowhxZWVrfQwBcTMMG26uw6fyQ7Q:CT3MA+bJmy4ZKfQRMh6
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+wdmwa.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/205D39C1472B285
http://kkd47eh4hdjshb5t.angortra.at/205D39C1472B285
http://ytrest84y5i456hghadefdsd.pontogrot.com/205D39C1472B285
http://xlowfznrg4wf7dli.ONION/205D39C1472B285
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (401) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 28 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_b774e9f49d4aa8a2a009d06a6cdb6f8a.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_b774e9f49d4aa8a2a009d06a6cdb6f8a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_b774e9f49d4aa8a2a009d06a6cdb6f8a.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_b774e9f49d4aa8a2a009d06a6cdb6f8a.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\cnwbjiwpcuut.exeC:\Windows\cnwbjiwpcuut.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\cnwbjiwpcuut.exeC:\Windows\cnwbjiwpcuut.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2864 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\CNWBJI~1.EXE5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE3⤵
- Deletes itself
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD55db86ea0e194af1f2a4005864a682163
SHA1c5c10cfbe7cc8a5cc29222ff9d4eefe59281d1e7
SHA2568805615e35ffbd8a3c25a03044d287d9838e33fabd9458de016d50707ef7b306
SHA51233f236ec82645ed799d5b7ae55bcb8f2b4ea37842d4bdb8ab21ad6d32fb898b07a23d82ea2b7ea96083d840a756fb28d9de0ae4b1988219e886a7acc5198b9e4
-
Filesize
63KB
MD53588933a6bd664e0b827c9238394a717
SHA1c8689b98b4c42ebf45d1f12e5058c326b9f58a49
SHA256c9b13c62ca3bc4d01b446b00c6746d5da3beec57563a16db58c89b46750b2da9
SHA51239a6f9210670d1b9f64d3a13e9de9e1a1d348be3e82ad2ab7cc5dac842ae4d829b6a2a74564e224f24740b44dd01555b25e6907de4bd7945b07d0ddd1c584254
-
Filesize
1KB
MD549d7369d31fce28b80b4f5d24ee92c75
SHA1bd1d90d72715dc8040fb91b0b9cf5f729d4cc040
SHA256ff8cf5da4006cbf7a6922be8a5f1f97f91e3ab5920a881f5ce166b375d624491
SHA5120c01e8ba08ac63e9d136bf7a47310769494170266961fe243a18f896317b68ae5ecca74a20c94cc932eb9bdfa9b001197ff23b62aaacc834bc69f55785fdf9f0
-
Filesize
11KB
MD519736ca492d199e22d2c796ff3686144
SHA11837d2dd00619a308e7fe92abb9e34e36e7f3ec0
SHA256407db642d37a2810c4ed5e93508147c5009a0170747851174f24de9c375968e4
SHA512e6ce75369f75c195602fa61a8f43580a521ee3c67bbc70ec4a724f0d1bd1c0c42d97f7c20d348f21bdbef92b7d74009d5926c9eb5e9f9e256480d134b56dbc6b
-
Filesize
109KB
MD54baedabf423ca1a51c82578e2faf9d7b
SHA142760fb68896ce6d7a7e5f9a56b4a58258f73bbe
SHA2563123be77afe36676097aba1bb13828c5e8400eaae37ba269677ea2e5e4f43650
SHA5127bfc0a277c73327cbf6dbc29c227ed16c50b93e886b9e66a94311514d4f7a71d7e3e40d72da1a01723e8faf24b6d81ec8ef65eb1290ab3606c5b711731e5cc0f
-
Filesize
173KB
MD59e92b5b3e84a33825d261fef6bd95a06
SHA1ce2c40ebf0b72dafeb1a2c0e02d916cf8c31b552
SHA256daf9c5cdb92f14d2396b103f0dceeb93b7c9c1f6dbc156fe5fff6538639373cf
SHA51232f2a874819a053cbdcc94b3a688e483940508769eb61a495f22e7738bb6c159e3818df3f93ae12d1db63ef04122e345e187f31226aadfcb22c5bf483e925961
-
Filesize
344B
MD5dbed7b3f37d6ed64a974ed30d7e98f71
SHA19a54aff18d5423f10b5a3b3a3fb57ffaca266fee
SHA2561871b79f76d3178b4a4afbc7cd08b96f022bc166653665e3c5e9ca6d19aa4fb6
SHA5127286feca7a37eac19170674bcd161efb4fe5ff1607f58196a48f10c7ddf06b1f9917c0ccae8dda7bc5c6effb5547b6528e7cef37ff842e1bfb44844df22b08ef
-
Filesize
344B
MD5ca9b816d2b6661d5d77d77f4ed2665bc
SHA19e68dca4222ad9fa9011beb5afe8a2b30b9c06a9
SHA256716bba105e27c50525c87aa6f3e83c6413cbc0f874d0292194a0477752f844ce
SHA51263ba241fb132a3b66822fe7f7f8170014ea200736960086971aa0f5c7e7c8d2b22b55a5bf096629843038961d9cbd896e5a2e48ea6cb289b21ff3b986fc65c66
-
Filesize
344B
MD5d3549974942eae2f8ce0ffe3d86d9d41
SHA1cfa5693e803d35da64395754007f2b41f77b4282
SHA256833bc9a361e8c853a219acc79dd7791b6893af82e7cf96c1fd8641a4022dea3e
SHA512b29ebfe0feac58b77c68a70fb858222e41742c87187e83ad9bdb2bc2fb5899ae99b392fdcdcec5c1643fc1fab65aa0734af9820a8d59912a9c424e8bf02c5b0c
-
Filesize
344B
MD5d8c51f907c88436c9954713460b72533
SHA18b3245091e5a710330543a7cd2449cb718d8de85
SHA25621e6ee8eba13609278ec449528883da055a8929add0cf96aef24f4a85e98b8e0
SHA512b5e982bed67c1fb26a774a7376c24b797b98712a633078cc164a24d7cd264e372a2aafe3378d4fd7bf8ba960bcc581b39b9fc4fd4c7647d69263d59033219982
-
Filesize
344B
MD561f8de0eb14ad52cc8881678361a5550
SHA1403fdf3ce3bebd2ebe16d47c0b9d8a58b170e111
SHA256811cc43c6b15ef33a26e616f83d6974dc8e711db2880014615e407c9bf23070d
SHA5124613469de15afd7b30efed9f5ca5028a6e1259c7c57d3d0e6b7ac876995ad85f0ce58911a097053e9afe8a6ba0f7d733af7170480e5a01a57bccbde6b8a36941
-
Filesize
344B
MD566b77e856432bb53068dc9643ffe4aaa
SHA1e277e221295c93d82ab1bf3f2530375145e0e3b3
SHA2568ff06b420e0dde38de1ed20b626021c8b4900f6152743186655d74ada1d3a296
SHA51207a698dd714060e3de7b7e1c95a862286d868f478403f511caeda02b48f96032273d88f0d89e8675ac83c85ffee724544a8641942b57341cdcef6f771ab50367
-
Filesize
344B
MD5f6b840a31106e5607f683f3f8a738a8f
SHA1a56ef6d6881d154330492ee222c4fdb45959260e
SHA256e0f64886e18e1d64a8166fe541267a232e5664c88f9e0d5452fb5a25469643ce
SHA51244e7478d5510bc3df9ce287289ac05e4f3b637833a0856eda67c7ee40212a0be287e32324ad47e6a6999b499d0c993ea56b68f75b09f76158148468158252ec8
-
Filesize
344B
MD5dfb898bb82dc60078b91601b28fa29da
SHA17d9c8b73aa1d8be268046c84e6a97ae3de33b0bf
SHA2566e2dba552417100798970488a839ac5e5a97a19e633b5f965127c0779dd8e59d
SHA512e7300521402ad881b9c0f78d6b770aa910cb138bca43bcfe1b058c1295dcb85880e211045ae5c15c6242c0a2a97666fae39412a64404695f90b4dccb892d0edb
-
Filesize
344B
MD548d0d06ef4c5b8e971c087e8d0381271
SHA1f57e1214a895f821dc62a61f67db05f0a0252390
SHA256698d877e57fd69811fe6da3c68e96257f5fafb4cb758519c47c6caf723887bbb
SHA51298ba662f03e29b75a4697427f96b82d9a30c0865ea624aad067a32ce95e7c15f09360567a3e2435a08547c351afd4d73ad9971c6a0e31a351708ab3f2764ef0e
-
Filesize
344B
MD51df3c5c7691806dff931627bc211caa2
SHA1b704ea888738e577e7df17099f1b49855e5083fe
SHA256997f0e86acedeedf239cb36c34e0b77b1fb7f974d349dfc2c9fa9e56fe80ffd8
SHA5122b28a64856216f3871c7eb80af8abd791990e14ebe62afef29d8e20f0a905ef200f2331450b14d0461ac0a4f89bd8a07bed8af7b8f4d91e1e1e30ae5caff1be6
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
140KB
MD560265c93fc3e3c4c1d55d1a65d2f0d97
SHA1983826601c3f8a4d4cc5b83fb7766dc643cd7a90
SHA256c2e56edb58d8e8515b2bf2482636b49bcf9f00870f6ad25bec7eb49580434ac1
SHA5125371013ab4db0df133b5ea9e455faa5fe3569484d6d852d76ad59f07783dd6a4d89858e99c199340fce93a8995abdff2200b623e06b15aa5773ed56fc6716fcd
-
Filesize
82KB
MD57f65dd43c9b9fcdbf8e64425e66ca01b
SHA14c8e8d30879770f8405a95439684332c9c22f4ae
SHA256e175f44e2525c105f0907949628dd81c69b66846f820ccdb33dcc1bc34f38b90
SHA5129f779ddd57a2abaf9233f2b256d9a5871ac72e9abcaf64758243353155f75554721c570d25c1226caa6f2afcd802d5ceea8c9708bce3432bf4df95479ae5032f
-
Filesize
396KB
MD5b774e9f49d4aa8a2a009d06a6cdb6f8a
SHA15eaf1e24c495634ecbf7c81b640d10de8a3399d2
SHA256d3aef7ccd94c55c75a19d3ac6e31ac4af1cfcdd64e77be9afc4e5c8de9301686
SHA512b1cdb65dd44aefae7933944a824faac70b1fe68267e245a3a1181deda7b8cb9016e502550cd73974b3fd85756602193d4db8a23e9f3622d0ed5c59a780b1aecf
-
Filesize
536KB
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
