Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
15-03-2024 00:58
General
-
Target
f848b22438735517f13797b61a78b4563ce2166e1d19c7b18c05c4bdff4a8cd2.exe
-
Size
404KB
-
MD5
bdd2a639e52983f0f43258adb81155fb
-
SHA1
2bc75f3f6ef2b5e3b27a2d19147b20419dae9e98
-
SHA256
f848b22438735517f13797b61a78b4563ce2166e1d19c7b18c05c4bdff4a8cd2
-
SHA512
7932fe904ef26310f1751a79de9a6e3c9b994dbea9ff53789ca77ea8f3b5a918789abd77c4e0d02056f05176729ed5129fb92c7e6583134f1309e443b5da25db
-
SSDEEP
12288:0RLMuc1QJZwH2d1QkOOf7RkoBSQBDHtUCxS:0pu1Q9HlOOyUSQgCo
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+iduoy.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/A2AAA0431DE04030
http://kkd47eh4hdjshb5t.angortra.at/A2AAA0431DE04030
http://ytrest84y5i456hghadefdsd.pontogrot.com/A2AAA0431DE04030
http://xlowfznrg4wf7dli.ONION/A2AAA0431DE04030
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (406) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f848b22438735517f13797b61a78b4563ce2166e1d19c7b18c05c4bdff4a8cd2.exe"C:\Users\Admin\AppData\Local\Temp\f848b22438735517f13797b61a78b4563ce2166e1d19c7b18c05c4bdff4a8cd2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f848b22438735517f13797b61a78b4563ce2166e1d19c7b18c05c4bdff4a8cd2.exe"C:\Users\Admin\AppData\Local\Temp\f848b22438735517f13797b61a78b4563ce2166e1d19c7b18c05c4bdff4a8cd2.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\avcbetatljtv.exeC:\Windows\avcbetatljtv.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\avcbetatljtv.exeC:\Windows\avcbetatljtv.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1196 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\AVCBET~1.EXE5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\F848B2~1.EXE3⤵
- Deletes itself
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD537ad9b94715ff38f0f3a91d5829f179f
SHA1cfb8d186de4543c5e7dc549bab553aca42f933a1
SHA256cd2b139914574d5474ba197b4e8599d25507380c54aaf0ff928dcfe7f184f1b8
SHA5128eb3f58a172b5a32647c05b9939f64e6b9482e226a224303c7a4e7499d06177a308f9649732291f181b77b78bf1a99e3f11d4831fb3720027fba4c6870087830
-
Filesize
62KB
MD53a832463d7f708d21d93ad90e61af7b5
SHA11299550d75d813c87a83db1ced76f1fc9d62f3a7
SHA2560179340e9f999479b5902d3d2af042af25eb01f87242ed20ea7ad0b282ca3dc4
SHA512cc4a216b8f0d59d73d553543d4b29b440f5087769ba0b6ea2d91359be9a4dcb25d1bbe43d4d4ea8580dc1bd21a397acae002830f32d4dbab6324b5b51ba33551
-
Filesize
1KB
MD529b4bcbe00a2fe8cc4fc8c46bd235e4e
SHA115c8ffaca904d69aeee45a21916f69bec17a1bc9
SHA256f0c81cbdf7452483694691df7a74fd3e90cfa1b6418adc9bfb80f16af4626c5b
SHA5129e8aa3395f493af61d80bced808a376c1689e4fb87f244544d70ef333141b62a2e8c291b340d34fa42779a83d7960367c92a5ed02c8038c9456860e74adb6ca6
-
Filesize
11KB
MD5ae815303798575a5c7718054eeaf5fc1
SHA1a34e3c335ee993170f6e599158f57425e3c0a274
SHA2568ba175692ab02aa77722886c054f1e8afdc6aecd08a180273cc11d75aaa8809c
SHA512689e10e592825899c5eace583b957983a0765bee104b0295e70bb7d8ace825a05f606c095d49da7489edf69595de42aae282b41352405fea01127a1fa0fb7af0
-
Filesize
109KB
MD549ca06c6d90ad28956c7d1ea7fbe6425
SHA176b4e67dfb01ab299e293cbca8753a6ed47774ba
SHA256469b907aadd69cb7520b151ba1d099b5eedea002a9ef5720172ceabeaae554f7
SHA512aab1f5b4e37352473701757d0287a5302e492589caed80014c44847d83eea7dca972423aa7ee71348a3e8042d280fbf1a18ef6f2730ccc5d2c62c5919ecd2175
-
Filesize
173KB
MD5b637044666587fd4601bc5fb29499f53
SHA1180d9bbff1c2177fb845cb7da7f9b68cc8bc3736
SHA256007e6424c2774660837b77baa1c77c32481ef753e887e1d478fc56d3c5ad315a
SHA512503c41659f642a9591e34debea43bdc4b910386f167604a98266b9bb9dbf60fb10cc606195fab835b80a6f1bd15de155fdb34ee5d12ae3cdecf61b0450308e4a
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
344B
MD5eeedcef7f13f8d196af63b6a9f7cf89f
SHA1acacaead6bf9f6e2432864f4ece465a256f61da8
SHA256797b77f33d93a9f5b5edf504a6f282e22f1837c493411bf97b0a7a8e7fd02e00
SHA5121337f2c15ddec3c3f7a5de594a305c7a4f2a421710b5d513c1b70ce594ca0f84a96b151ac3287f8ba78233b5d010e728ce012a6cba10f6fa8d5af1fd21809d4e
-
Filesize
344B
MD596c4e63d0c043e78b1a02a87d9be2335
SHA1992674fac72344539780d25845e0de5f9d582524
SHA256203564f0fd4ace97781110f45596d727614c11783a05679396072b67ed76225d
SHA5121f802f927f33f24cd01b577d2b76aa6d5532bed0bb15b24bd0f7de30c666da004f7b814bdd288ba367b10efc8453f91b7c5b336e448f6f0ae890742ed25916d3
-
Filesize
344B
MD577d66d23add1c272c21b9b668fd36b00
SHA1db7118c34270c6e19fb30068b570c6aa6fbae97f
SHA256391756e32ea7d11e25604cd47aa7cb3f053160ab5958018ef46cdff23dea1733
SHA512d40ab082176ed93f2aab756d8621be1426297282c67a5eaf309b171b4836cc984f4b6f81b525d8a9c855f7a816a3d169fa1b45903af82a7636cecd142d2b852e
-
Filesize
344B
MD532d0fd1a171f05b626b190148c244ca2
SHA1aa02280e0db946348c0325191fd35eec83704b0d
SHA25678745381c0d8887430f424b2b9b2166c4610590c04b496167a20ac524d3b9a7c
SHA5129f416341103512adf53dbef3ef784a5ad00a7c820422d7507004e6d1ba8907cb49b9cc7d0682e128552f56c7ed9118524316989356b02a9734c39a7e5d3a5e05
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
-
Filesize
404KB
MD5bdd2a639e52983f0f43258adb81155fb
SHA12bc75f3f6ef2b5e3b27a2d19147b20419dae9e98
SHA256f848b22438735517f13797b61a78b4563ce2166e1d19c7b18c05c4bdff4a8cd2
SHA5127932fe904ef26310f1751a79de9a6e3c9b994dbea9ff53789ca77ea8f3b5a918789abd77c4e0d02056f05176729ed5129fb92c7e6583134f1309e443b5da25db
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
12KB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4.6MB
