Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
23-05-2024 13:54
General
-
Target
0a2d0acdc0543f253985adf481e5d5003e20038b568e07e5292775c13cfb3812.exe
-
Size
575KB
-
MD5
6d73b7e3967ec42f90bae88b410a8351
-
SHA1
2ff8579cc1102be946eaa8e8b6704463965fea74
-
SHA256
1d42b72a61bdfdb6aecc1df67f1705ebeadef1bc48aaa011b97c85de2f932e06
-
SHA512
34c5b26d2839c9617f42b2b125ecd8569f16b2654c55673d19ba3e646b2c1c1757c76082abd3b9970bf1b1db39fbabf25270d2999ab45cd629f3f87736ee5117
-
SSDEEP
12288:Hz+YmJJuGZYbzz2IgfFblCJxfS6ysoraDfqf1b/gjP2A9Ps6:dsJJYaICOR1FZDfqf1b/gjP2QP7
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECoVERY_+yadqx.txt
teslacrypt
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/8A8B18845B177EA7
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/8A8B18845B177EA7
http://uiredn4njfsa4234bafb32ygjdawfvs.frascuft.com/8A8B18845B177EA7
http://xlowfznrg4wf7dli.ONION/8A8B18845B177EA7
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (378) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 32 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a2d0acdc0543f253985adf481e5d5003e20038b568e07e5292775c13cfb3812.exe"C:\Users\Admin\AppData\Local\Temp\0a2d0acdc0543f253985adf481e5d5003e20038b568e07e5292775c13cfb3812.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\oweqsyjejblv.exeC:\Windows\oweqsyjejblv.exe2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:968 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\OWEQSY~1.EXE3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\0A2D0A~1.EXE2⤵
- Deletes itself
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD569b6a21a16b86661dc4b083f89484326
SHA1caa548104665283ac31dc534674cf6fbecd34060
SHA256f22b414a42eaf9fb4091a0b3c01680c27d7a01a65f5d5f68f3d61ca761bd095a
SHA5123528d0ce631878c603af506ef16227f729a9ac98fde62e70e797f0492ec8492ea50558de757f2140a6ae17f0640f87d8625ca8164bf326d8299b14a2337aa929
-
Filesize
64KB
MD5ab33e74e67b70b4338fbb7d7e2209b80
SHA1172c6dbf3667077c0f7f3c0c0991f00c18102c5b
SHA25662e3039c93e5caa0a0a413ff2e43cdff9dfc5c10a33749113894ca5f2fb3d9b7
SHA512dd72da6883b4d20ad229847074dcd21bfdd4c6c635071c8d1202fa27b803a31448296be64307a567fe6f1894bea71ebfff3cc693f5a3696fcabc4acb2ae6b1dd
-
Filesize
1KB
MD5937e27b4571210cfbb9160f8cad5d8ff
SHA1cfb1744aee3246034a14db8c8f047490036ae504
SHA256446dbcd6522ebf0a28069593c5aa99b91a07d5c7fa9cf4103bd6d65f266bc43d
SHA5127b4c29a5fe71f085481cf0a5e7816869917e36455e2633a5f68199b61b625e267cb3bee0329316fed8ef1d1ba8cf2a2ae3d3580db3c51066303a97cea6bdd3a1
-
Filesize
11KB
MD557bdc539c9e7d017d366aec88430eeee
SHA12cdb5a7d026ed291be179b58947c6e716a19f9e6
SHA256e85388b7f2ef2fa43c858574164950bba3a88c5ca7cf8e97cd9c40121f174305
SHA51202c6465146427de90430be1af1abaaf62459947af0dfef6066d076ee83517742d7f0e676f5b0fb7fd3d0bc79c554134e187ea427bc73a836de7f37e744869cb1
-
Filesize
109KB
MD56c6924445effe91147cc646b2c882a29
SHA1845b906051d330c2ae775c7c26b10ad0b82c4aa7
SHA256dcca810435290092fb4b3c2c0e3770326901dca2645e0fe157e498c6d73b299c
SHA512c504291ddfd08e56243927d2ffe4077778efe6d7574425fbde07cc362c3c9dda37b80884edfe774346427e82c78d3a0811493f92766a57257be83317f7e0bdf7
-
Filesize
173KB
MD5d7072c0c261da428bd0d3351fca55df5
SHA1961ae3cee217a10676fb098c34c91fa2e9692fe5
SHA2565651f33e4bade2dc7ba97c4d6164c84c9463a4369e71aa913bf4bdbea548a12a
SHA512e48a4e4a72b01cdc6453f582840b9402ac3e0b29fbe243d8db443029c4e5f02901b809a762522fbbebc8c353f74c153054492272d25533ac5bb472860bcfd43e
-
Filesize
344B
MD554c381d8675e5752b99ca748e448d6ba
SHA119cfb2687d3f61ade8b5fc28a607e1f18a4d2daa
SHA25684e7dfe5f977d66ee605acc683c48f4b7252e62a5ab4b46988b8bdb9ca606882
SHA5123b3594e6c518a3a41f0f551108acf6d1ffd21f6c4a7b066b03e97bd79146f6b50a4e6200fbf8db0b5a2ead5cc757414b33150723d2a0e89a23a31bf7c7367b9b
-
Filesize
344B
MD5ecf29d2086b192d32e6888a3e5365a37
SHA11603df827aa8c096c5b8c2c3e0553ca490603822
SHA2562c87054f21c1f714aa9b947dfbbcc5afb731c09879f2c7cf6f7a4999bf84fe39
SHA51223b1689d7b85578c55670fdac52c7e91625dc338e1978e7ca14dcebc10c2fc2f43d09d24ce7c40f5bbb129987c2be9931226f57547172a8ff6d41d71c2dc4719
-
Filesize
344B
MD5f1a26778a809dd7b2fba8dbd30c10772
SHA1ee1cc82ed97c9daf3d31a3d5f80263a9ced6e938
SHA2566a179d172ae6c0b717c4eac417333d42ba3e58881880f7de82bd8a612cf030af
SHA5120981fb35cb5e54d4d632e37771edf73a1d651d51040ae73687c273f03077205638a2f5e41a477f0e562379889912a9f4e3869a26b075b415de076cdf7165a3ca
-
Filesize
344B
MD571e3999f9bb141cc12e89f904b0a496e
SHA13051aa959cfcddeb42a7c15d84d884412a7751e6
SHA256525dbc882762ec806bb294aefa8030dcc77c7399b90f606e2fa2834d827552e1
SHA512cb95fa2e16ca0423c6c4c2e06391e358f2ea749a287ff73850e527338d482fb284043dc320338bad3bc343d9f56dd7d3d36ed567e272258d4f0da2cc33548bb9
-
Filesize
344B
MD51b9ba473cfae5ca33fd84602066127ac
SHA1dc5903f6bd5be705a85250ba4a0109bfc081373d
SHA256e5d840cb46c8b02629d8c5d946ff26676fe624a80af01122d9d54645d2b4b875
SHA51229a53109cbe8eb7ca3f5e7fcfc373dd9fa43dc8460d3b420dde31b058c914f4c3b34d5e0e4ec24a84e542794a2815c53ad2184a6b01aff9a5bb7206374d508a3
-
Filesize
344B
MD5d4d726de42b77ab976e0e426c5ed31af
SHA1f289866a3a1bea663a48825647a2f94500769ad2
SHA2560340015ee1ff016e25eea4e220fc2db499baf5ad21cba6e1dca2f1746793a3e5
SHA5127f26b169efeb8c1ff8e15b99e8143bbc95337ce2a62cc054342e971fa99de9afe5d3428898f535bcf51363b4ece806fec76abe604ceb1b858b2a242305d9ab52
-
Filesize
344B
MD5e44db0b9520a02369e7402e1af518d93
SHA19ce53e6fa1eb8cf4f4d897caa78d27c7d18ffc6f
SHA256bcd9379940680f3b5fb901fcf3ad78a967002d1cc6060e472ad89df9e15e1223
SHA512fb2f3d8a84800ad1bfbd334c755b5727bf9b83d3f8ed69cff013ac1e255c14ab3818c39c2bc384390a463c13f5c4aa2ccb73e723dceb4f9f8c1cb37e66a8b430
-
Filesize
344B
MD5a3ba639184e4ab4f4e434945a0395189
SHA1dcc9220821ed615d153663ef5c27d6afeb163342
SHA2567d2380376ddc67201a48624ce90cd3a3896950d8f804377283bbdf3c0182ca27
SHA51262e8accb234c34b5e0c326870fc39f488ac527c90d50f41aebc9d2ca9326e69d8a3fd56f88326fe86f7043ff16e771f52d202ea6ca22778bfa240f74034afb73
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
575KB
MD56d73b7e3967ec42f90bae88b410a8351
SHA12ff8579cc1102be946eaa8e8b6704463965fea74
SHA2561d42b72a61bdfdb6aecc1df67f1705ebeadef1bc48aaa011b97c85de2f932e06
SHA51234c5b26d2839c9617f42b2b125ecd8569f16b2654c55673d19ba3e646b2c1c1757c76082abd3b9970bf1b1db39fbabf25270d2999ab45cd629f3f87736ee5117
-
Filesize
8KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
8KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
532KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
532KB
-
Filesize
700KB
-
Filesize
532KB
-
Filesize
700KB
-
Filesize
532KB
-
Filesize
700KB
