Overview

overview

10

Static

static

3

VirusShare...81.exe

windows7-x64

10

VirusShare...81.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    07/06/2024, 18:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VirusShare_e5e83d8209a8e06089d70e65901b7481.exe
  • Size 328KB
  • Sample240607-w4cs6abh2x
  • SHA256 e37b974823a5def88d1b8857cbe4262ed60d59a7ef7b6854e407d6a2dc8cdc68
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
teslacryptdefense_evasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+jbtjh.txt

  • teslacrypt

Ransom Note
  • NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA4096 More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA4096 Key , both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1 - http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/3E254CDD9DBDE6E 2 - http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/3E254CDD9DBDE6E 3 - http://yyre45dbvn2nhbefbmh.begumvelic.at/3E254CDD9DBDE6E If for some reasons the addresses are not available, follow these steps: 1 - Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2 - After a successful installation, run the browser 3 - Type in the address bar: xlowfznrg4wf7dli.onion/3E254CDD9DBDE6E 4 - Follow the instructions on the site IMPORTANT INFORMATION Your personal pages http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/3E254CDD9DBDE6E http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/3E254CDD9DBDE6E http://yyre45dbvn2nhbefbmh.begumvelic.at/3E254CDD9DBDE6E Your personal page Tor-Browser xlowfznrg4wf7dli.ONION/3E254CDD9DBDE6E
URLs

  • http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/3E254CDD9DBDE6E

  • http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/3E254CDD9DBDE6E

  • http://yyre45dbvn2nhbefbmh.begumvelic.at/3E254CDD9DBDE6E

  • http://xlowfznrg4wf7dli.ONION/3E254CDD9DBDE6E

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (434) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
    adwarespyware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusShare_e5e83d8209a8e06089d70e65901b7481.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare_e5e83d8209a8e06089d70e65901b7481.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1924
    • C:\Windows\rivmolkcfbru.exe
      C:\Windows\rivmolkcfbru.exe
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2616
      • C:\Windows\System32\wbem\WMIC.exe
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2372
      • C:\Windows\SysWOW64\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_ReCoVeRy_.TXT
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:2456
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\_ReCoVeRy_.HTM
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3028
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1876
      • C:\Windows\System32\wbem\WMIC.exe
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2084
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\RIVMOL~1.EXE
        3⤵
          PID:2856
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE
        2⤵
        • Deletes itself
        PID:2740
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2156
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
      1⤵
      • Suspicious use of FindShellTrayWindow
      PID:1844

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          _ReCoVeRy_+jbtjh.html
          • Path C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+jbtjh.html
          • Size 12KB
          • SHA256 719acf2b0eac5adf148c616bf18eadcd791e92eece1afe35d380c4da87acf61d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ReCoVeRy_+jbtjh.png
          • Path C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+jbtjh.png
          • Size 64KB
          • SHA256 b4d242dc9ff8144260cde31bff2abd3f00c469c4ab9a40c22a68943b6c10cf44
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ReCoVeRy_+jbtjh.txt
          • Path C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+jbtjh.txt
          • Size 1KB
          • SHA256 c4dba8888e6a65063bb5da764884165bda042c0615723195ce2d24d0b3ba872e
          • MD5 SHA1 SHA512
          Submit Download

          asl-v20.txt
          • Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
          • Size 11KB
          • SHA256 00781f955e37f6651c8eb833914f07b93319d1e67b441ccabbc9707bde6e76a0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          THIRDPARTYLICENSEREADME-JAVAFX.txt
          • Path C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
          • Size 109KB
          • SHA256 c016f62137923bb2c440241860cd61918ce6bf2ae05c9dbd7f6c60bb97425837
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          THIRDPARTYLICENSEREADME.txt
          • Path C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
          • Size 173KB
          • SHA256 6cf8fab53fd146679271542eca0499d9954f70a524742c7fcf849a1a7a1931ee
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 e75d34b9e5f8552077bcf3d1a0101821267f2bf3e50c762dc7b2f18d59d2df84
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 f514f7198c66af0771981d37534671730c3d7c502796322ba35453d5f98d189a
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 f22690be7be399110269d696882a12448a3fc7fccf858b79c87547d65b82d324
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 53e10694ca3d4ecc0b605ff470ba85019cb0f4306f6133a1bf08c85cb5b61059
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 9bfb345eb4cdf1ce664cb76f84369666f434e9e7016dea37906b441ee86bccff
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 acac88a2137e068b2950cc5159d361df02bb928718d9ee0c8e9783df46e7bc8a
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 db08b535655af5a97581fbf5ef6c872541fba76243e88f136e7366db06e5c5aa
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 199b924609af48acdca53aaef1bd5ab7df8d19cb543df5b9a4c9aa87990aa36f
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 484eff34ffefd2a7cca89fc70cbc6c3c569ff27f4cf2f56798ee7dccb3d8082b
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 72fcf5f081c7687ae7bc0189db4f56d2f54afb20be6051ff3997b38032d66d56
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 f7db570eaf5c68fac326ba478f908d0393986a36c30bdec6b18633f0da3f4816
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 fc77a80e6947d1a017a0e58800b0c490658a8985ee8cdecb8b0f42d4035743ec
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 851138d664c9b90dda21e6bdf7ce55669fc9899f8c794106314f3afe24bd0a63
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 9c5ecf44478b0d045d6309f926a6ea3ddc776abe1a6bf85794beb400d879c1ec
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 355ae1cdcd8280d09ff9fc9c753a56d3e8f89ff2d40f4e7f3cd0eb03cdb244fe
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 c5f5311dfb5e43f4f04039a3939a034c26c8d5a637f141bd90c6f4812d2bba4a
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 873b9fc5ac389ce6e045b0775e3d0531a4421f28f1488ef5e52ee423ab7148eb
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 9878a24eb1fde9de0e6f78e3d4af19725c61f36cdea4d99f6dca62a9df853de4
          • MD5 SHA1 SHA512
          Submit Download

          94308059B57B3142E455B38A6EB92015
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          • Size 342B
          • SHA256 97cf18759f7a0cfca2a590f8ff304c1940da5ebd382c55016a2dfae6cc231905
          • MD5 SHA1 SHA512
          Submit Download

          Cab8F18.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\Cab8F18.tmp
          • Size 68KB
          • SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Cab8FA7.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\Cab8FA7.tmp
          • Size 70KB
          • SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Tar8FBD.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\Tar8FBD.tmp
          • Size 181KB
          • SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          rivmolkcfbru.exe
          • Path C:\Windows\rivmolkcfbru.exe
          • Size 328KB
          • SHA256 e37b974823a5def88d1b8857cbe4262ed60d59a7ef7b6854e407d6a2dc8cdc68
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/1844-6057-0x00000000001E0000-0x00000000001E2000-memory.dmp
          Download

          memory/1924-11-0x0000000000400000-0x0000000000495000-memory.dmp
          Download

          memory/1924-12-0x0000000002260000-0x00000000022E6000-memory.dmp
          Download

          memory/1924-1-0x0000000000400000-0x0000000000495000-memory.dmp
          Download

          memory/1924-0-0x0000000002260000-0x00000000022E6000-memory.dmp
          Download

          memory/2616-13-0x0000000000400000-0x0000000000495000-memory.dmp
          Download

          memory/2616-16-0x00000000004A0000-0x0000000000526000-memory.dmp
          Download

          memory/2616-6060-0x0000000000400000-0x0000000000495000-memory.dmp
          Download

          memory/2616-2747-0x0000000000400000-0x0000000000495000-memory.dmp
          Download

          memory/2616-5953-0x0000000000400000-0x0000000000495000-memory.dmp
          Download

          memory/2616-6056-0x0000000002AA0000-0x0000000002AA2000-memory.dmp
          Download