Analysis
-
max time kernel
128s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
24-04-2024 14:46
General
-
Target
342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe
-
Size
384KB
-
MD5
88716ed91614ba43691f1204a8e1936c
-
SHA1
d8b3411ae843a5f1d4b506eccec26077fd2f29f2
-
SHA256
342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0
-
SHA512
e64af6563e672408ebefc089a02dc6c99082c7a1d4b0a67258c50da88add8bf8c58045041968e22d1a9924f95d62cf2245ed253ac41473c1d28c8d8c62f88bad
-
SSDEEP
6144:zBeJdbHCHcRlJUdarnrIM+PbeEnvutw2cVMuXrvEnODd0cpMLnJV6Xlxq+:zBCdG4l2rM+PFgYM+rcOd0l/elxz
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+nfuwn.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/17AC1A8991D1E10
http://tes543berda73i48fsdfsd.keratadze.at/17AC1A8991D1E10
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/17AC1A8991D1E10
http://xlowfznrg4wf7dli.ONION/17AC1A8991D1E10
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (425) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 52 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe"C:\Users\Admin\AppData\Local\Temp\342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe"C:\Users\Admin\AppData\Local\Temp\342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\jtoweqsyjejb.exeC:\Windows\jtoweqsyjejb.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\jtoweqsyjejb.exeC:\Windows\jtoweqsyjejb.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:832 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\JTOWEQ~1.EXE5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\342A08~1.EXE3⤵
- Deletes itself
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5f0dd1cfae884b5d71393af95e3f378af
SHA106a4271a422df5fee314cbeb710d2df0f3453c9f
SHA256262a812563130ac14ce048b5d9af485638983174dd7b801811cfa729effbb726
SHA512dc3cb216cb3ca6911dbca208f2c5ad3f1f04d4603fe6917889c2dd1080a38030e2a448ff8fee70504679ae91b08b8fc094be44108d485943b07e148c6e3d133b
-
Filesize
62KB
MD500845e283c109113304820ff5033843f
SHA12c739798b63ba6dcc09516c9b313070d4e075d37
SHA256118ca694d2bad231b14de154e4c6a13a1651a41b4be8b9fd10dec4c0cc1dc052
SHA51262d5cc6d12237b0247822b0536148fa71c407a2a9b2d6daa6d68acb56518ad1bdc2487aab55bd2491318040f4b53bd4d3b85ca7dd281f00e8bf5f4999cf43df5
-
Filesize
1KB
MD504d0fa47736f32bd264c42559a70b31c
SHA137890a29dea4dd2682f000a673701308c9fba41b
SHA25607f273424d9671e76924797d66d5ce347684a21d1544af002e4b5592a79bc4d2
SHA5128eca46efb88470c0bd33edf8e823f699da74b8f1d6a5f3648804a16acb1c7a3de31abaf4063ab0f93cc77f46a32620d7d390af6fc4ec9ca6bd82d955370f441a
-
Filesize
11KB
MD5b2bb92771fe588b85ab11773fa57e2f0
SHA160644877ffd1cc1b904e87ce1bcc1f2c0ed2ca78
SHA25645cc6180da58fb81e028aadb026fd5d14282b7904dabd5dcc813a370096f2452
SHA512d23969bdd46e3de9060c2643096d277f6954fd1324b0203c523d371d83dd9fc439732b77bcf0d764e61166ea22e41086679f40028d3d0b7df4583b15b48f968a
-
Filesize
109KB
MD5b23f8fe1e5f5116d37518494da41034f
SHA13b982a0366cf3dac3955c1b39f27711d46c0b720
SHA25631438ae8705ca6859c5dae73b62ba1f2e2ad110f0876a215f7db287978b98d3e
SHA51212a0772b7846cf56511cd357c18775d3d4120f128c844aa1530beedd8bcd2e5f11391f38b455d504c432df5c691522ca71a40135afdae223bf0da6d3f7c961e9
-
Filesize
173KB
MD51b8428569870ba40c955e2e3aad11656
SHA1443bd1df9f3a46192f5aa60e25d75b8a41a1d8d9
SHA25630462f4daf22fe12a7cba9a8394a4fd7c78463a18f5ba0d9d504f5257dec1969
SHA5126f341e31975fb45be1f9162309153537b2c3f54c84a9068146d3c57459e4a0a94053affb4996c2559fc1a86689685d39a6284e389ee1b53d23a9d918dc9120b2
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
344B
MD538d432672d022b24833cf95440a2c5e2
SHA156dd665069f529bae9a457ec67bc8a9d4485d0ab
SHA2563173f1c238ce49b821194156115f83e037da236fd652779e6d5a8638fbe45dbe
SHA512a21dbfbf5f3071524c55c69c1fc5f7d45dd594b58aaca5afeed2c9b7bb98ef7b12443ce150e499c612499648ea2d31f883bea9c0bcdf0ee03108413acfcf7508
-
Filesize
344B
MD5c985d2a2d9b347105b037065c30788b0
SHA174ca731d3cae661f0ba8275207be35456f3d18f5
SHA2565c9cc47621bd2800d6528684d49ba2def4955992f12dbc9aebf191c2887ea6a4
SHA512efbfadd189919a1687087fbcd78400df742f917fd6a4337ac22b683fded2e86980299c754e4024246cca413c4cd8ef039ad5e133a6dd7ab86f519e9bf78b9f3c
-
Filesize
344B
MD541925ea041e59ac381f5886355dc3f98
SHA1443b0f61e4aa17e0e365611240b9e50779afd34c
SHA256b68a00898ccb6afcbb9db7885492a7c7cd08065a20db642889553b3fb3f58b33
SHA51206fa584d1767fe0e951a5a9f9399d096b3b268ac1176a1cf3f42b2b3a58e85749dbed2653bdd2ed9ec1bf68722568ea5b116105b6e7f1c28020f174e728328a1
-
Filesize
344B
MD586293e671b2f0e00edecab2859240193
SHA10b302db44eb7c8ea2b921d55b468ac03f2632ac4
SHA256daabd2de1547d01b080dbffe298e8ca6895f0a6eaed69f5168479097955a30c9
SHA5120df195811d9b5361e1f11c832b6217f1536d38ac1ded5050595caa846e7f6144fa4b792139844e392f564cd4df189c1605e248568e017539a7b93b8780c7a72b
-
Filesize
344B
MD5a332e5905efa167ef483aa8ea195ef9d
SHA1d7dac7ad045487563539a8ade58cc62cde9a2ff8
SHA25683bdf7efbd06fa6d65c945f9c8cf5a1b11b4b5d59c154f63ab27958b28bacc8f
SHA512af86445086302af5844e9ce1b74bb83580997b53fed3b59515864ab1b1f6e4dfbfbc4ac0e8463782ad507e6ffb4b5d30ed0a034d68fcc18eb1a4af749fd28e9d
-
Filesize
344B
MD50acef6ff641c32e15e0c734289d72f94
SHA181ea2afb7541030e619e50e35ad5d6b4d11e87cf
SHA2564f0a2db07185214d0ea56d906f52d06011a82a7fe603543ff4fdfd639302fc73
SHA512393bd18e8e9837177a842a78faf6cc0fa9c8e397493ad5e683502c2445d5895b0a2397a155b7b70190911ec4344cd3051ea3f6f472afbb0b221c7b6a37471eb8
-
Filesize
344B
MD511a8c090945628d641e385104af302bc
SHA1932f16b48f64a766591a0ee0de78989a3df47a94
SHA2565e2a1574baf4620dcaed55371c451a50e113edf532323cdf15f643a4c332ff84
SHA512274e2184d612d5d9e471060baa4b94930de554c303112f7a96ed4775a0aa5cd6a22d5b34c34431730f4dd523d3f388a5fcfe8335818eb60c1a97d7137aaf5599
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
384KB
MD588716ed91614ba43691f1204a8e1936c
SHA1d8b3411ae843a5f1d4b506eccec26077fd2f29f2
SHA256342a08c1e2c325f96fcc2361f66c4f8e00e35e6613143bda7aab679ce52d6dd0
SHA512e64af6563e672408ebefc089a02dc6c99082c7a1d4b0a67258c50da88add8bf8c58045041968e22d1a9924f95d62cf2245ed253ac41473c1d28c8d8c62f88bad
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
3.0MB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
8KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
3.0MB
-
Filesize
4KB
-
Filesize
3.0MB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
