Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
10-06-2024 10:45
General
-
Target
VirusShare_1fe6fdfb7796bf1ec5bdf80f86fa9dc5.exe
-
Size
388KB
-
MD5
1fe6fdfb7796bf1ec5bdf80f86fa9dc5
-
SHA1
c4f86755ca60567fedc3a05ce88c4a342219c8b4
-
SHA256
a878058e1c857a46a565cd950a6e26c2b6d30fca17ef97efb7488625c326aaba
-
SHA512
22cfa91dfb8f8a885932b269202b4e68da7b94316213f47729b3fc2a10050e7629abe310ffa583ca1211b54dbbc37b040f76442c1c2e774a6dfd79e3fd80d9b6
-
SSDEEP
6144:nYMk7V7PQkaYO0iNq/PimTBQNEETJYOo0DldfrvwmjcMVW5OouUI5KtrQ8POyU:nnSdO0iNEPn+TGOoYzwscMSOXUIJ
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+qkllx.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/95ED5414483264D5
http://kkd47eh4hdjshb5t.angortra.at/95ED5414483264D5
http://ytrest84y5i456hghadefdsd.pontogrot.com/95ED5414483264D5
http://xlowfznrg4wf7dli.ONION/95ED5414483264D5
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (416) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_1fe6fdfb7796bf1ec5bdf80f86fa9dc5.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_1fe6fdfb7796bf1ec5bdf80f86fa9dc5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_1fe6fdfb7796bf1ec5bdf80f86fa9dc5.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_1fe6fdfb7796bf1ec5bdf80f86fa9dc5.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\gklqnrhxswjo.exeC:\Windows\gklqnrhxswjo.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\gklqnrhxswjo.exeC:\Windows\gklqnrhxswjo.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2260 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\GKLQNR~1.EXE5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE3⤵
- Deletes itself
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD56129ae96f979304ab0341d23dfcfde56
SHA1cec3c06530e1469acef0d98151aad7f0377c645e
SHA25620ce895248bb9d1c1f35b3a020e9fe84b0a72f347abfb8535b8b64db060248e0
SHA512a66c72cc772cc42a48c5741dc6b00ecc931e992a104cf98c661e0471e070c1eb0e6f07d25cd200b1689d723eb85ed489b2950a422b4c8c8c2365a67cf57a5249
-
Filesize
63KB
MD5e305c7d1715ec35dce0b94960fc0f463
SHA17e68a6202d200ef6e364695bdf275dc26f1f9cb0
SHA256040a538170011e639ab5b8242398ec6d8d47ccd34049001f91b95da48258d599
SHA5126d21800ef04cfc4856890ca652bb77b626c422d62003e225c1518d243001f585866ff17938b39bb9bdbf3b7514b436102dde5860fea42d1248b33d61459ec84d
-
Filesize
1KB
MD5cd28220ec8269ee9e7e59dbe78ed2dff
SHA1d1ec2e36b7ee32a5af337d3de1f712169313b595
SHA2560e80017a5bb713809fa18fd6330ac0c511225441169f62a1b925b4dcfdb2164c
SHA5126e9b31102e814fc711c815aa2cf8dabd972ea47a28b649b49ce820a5a68665acd729f4b276872aad7dc3ac1c5ee336917bc317bee054ddd15d1345414d5935b8
-
Filesize
11KB
MD5281a1eb1ccb8f27bbefb8d01b5067bee
SHA1c3ffb822fd1d62d6016db8f9a4bbd5900bdb8865
SHA2565e32921eafe165260fa412e834cad7997a40eab33a6022eb91c89830135d188b
SHA5127ab541fe761228a8715300de612f0cf14609df1a74fa7e3b1f507c3c2d4bc98bebd4cddb48fa78e0454cff28ac2a110127e2c751309a4dd6b4fbb9b90092601c
-
Filesize
109KB
MD5886b63d926d683669ed9aa3fd2b85432
SHA14ae9778aaac0027e2c2e1fb4a2f445c6bf17afcb
SHA25699c8aea8bccc95132a7feee29b7175347cd36fb0bcf3fa8b00bd6102892762d2
SHA51214d67367bbd5aa4f2dbca6c58ee4e7694ed238b713a8d9e1add61b282dd634e8a11fac84a6f2620b7e692df07848e97cedfb9bb16a9d774c13963083f6b6ddbb
-
Filesize
173KB
MD539fc102a6fde87a0492c68c14498e3f4
SHA17dcd9e75d91d38c5ae95815720cd702d19cf7590
SHA2561d154f5857ce7db2689de0de32dc8b8320e9651199f8bd122f15fa3e06b5f838
SHA5129d803019de7702036ffefaf8850829e0a598ad0018c86505006b9ff8a7a2b4d4a589be0ffbcbc4cdd5980f5002995698eda32faa42152dcdddee1d86d72e58b8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
342B
MD5036c5d952cdece5272a50024daa1a804
SHA1f40a0e93cfcb3c7d4cb82eedf78f93c268013814
SHA256a172bf3d05cf7960c09a21dce880fe5dc87667b273ea1bd0433642e0fce61efd
SHA512a13c2e6dbe8ddf7654e1f3572c1f3022c10d3be9d79467204a9925496c66f60a7fb9b3c215208f0eb5d176fd45b31a65eaed50942b662090dd00de5a819df541
-
Filesize
342B
MD548a4487d213d90dc46083fb7ff5c0b42
SHA1dc96b634031d36a5ed01164832ac6c39af0acff5
SHA256f336ff19727a99475fd7de9d0551159edbe6e4e60ba71dd2e71b0e79458dbc4c
SHA512f0eef8293da19880400a7c981a66e42e38c3c804217b3c847dff7b7b7bf1b01f688835ec3a3f27cdd55b4e663564e4e569a9ad75e9d87a3afaa64851cce00d2f
-
Filesize
342B
MD55c407799fa4e7bc8b9e401abfda40531
SHA1e824d08e00d636354f2c41283c0cb4066dfeb7bb
SHA25673a5b08698656acffc31b4bb005cac830fdfc6795f74cf16f5bdab0e00b6736f
SHA5127d33b58bda3e5674191f8646a6dd1f08431ab8e34031bc95a936235552177925b36672c7785f298bdde6cd77562369a4de4d6d2cbe229b1edf729a7896bd97e2
-
Filesize
342B
MD5445b3e9c89ef43f6d8969dbc44f0afdb
SHA11856d3fee3cca11151c49e20a694fb9dccc566f9
SHA256fde95a17c7319c356697be3f15a1197dcba6b56f3038f94e7f5c146614bc0177
SHA512f385a0c60057c2103256296644eb4f77a261e648baa28745e654772e150127f27e32e3bcdc77adc82795efcc37616adcf6a7f92fd681cae20c14bfcea9b09fa8
-
Filesize
342B
MD5ae88eb3a20c25abbc1425cd5589d051d
SHA10341a85892a2584dfc6f602c7b02b1b95689637e
SHA256d0034e9cccc5fdc6e8cf816a7a7b7f9ab2d621d47c961d2d00eaf11ae68f6f13
SHA512943c2da8c9f0b4f214557180991adfc4f349c5bc3ba681747720a6b2e526251deab0b10e62969254f9b8ceae8311955395f2ef1f6d37bcb34244fb11eac69609
-
Filesize
342B
MD5cd8053c6a455c79bedda1c37f023f7eb
SHA1464b5c3202dac980cb36ff330da0cd3c025623a9
SHA256285b0bec2034a408c4007da3656a13f94bc3eb8f2f27c3b4b1dd1535684151c5
SHA5126bac156f876bf911ccc290ca6b94b6ba3d5e42859884c4a4273d36c77289f0896539707e61c25078da2ca843b229a07e97d439b1a64db13234b4ec0c2109a4f8
-
Filesize
342B
MD51c15e8722a9994954132c181260c2106
SHA1e7c460fcaee2c73bbb39d872d0c44072754f7c0a
SHA256a7cc73c8d3e2374a8ea07af594de63190823b3dad5dbf5ca9c8da65d56a76c96
SHA512af28d7ad66eaff3c5f43e3c33485f95323971a6763b3ae26ed9150187b65f901889e1bcd3c5e8159a7fd941a8e1242b86b4bdc5a41818d568452cef1d978e80f
-
Filesize
342B
MD552736f826b89f43b96f3573525573e96
SHA1aa4d5fb9663ad63c2b45cf24f5608a1666620856
SHA256845d227ec089f0336e661950c2261ad93db2d039d8c066e7cf4ecce2842ca064
SHA512c981830182210d4107c0f18d0d46c956bae8eb35e2281a1eb7873d98fd60dc6e61d63beff0f97f99023c4cc868ed2318ddc6509fdcf500a6761aee0157747ba1
-
Filesize
342B
MD5eadb0370cf6c22204e95db948481b636
SHA12f6b7d1d1f93c82c4273027c793be3ddd251a8a1
SHA256a14bd06156a6e9bf4a7fda1ed9936c15bacfaaf1268424d1184f16b653843a08
SHA512f1b35bbe4edb04d03cf1fee1b807836b0314b42de3cd2e1ebfd8be4541a569d715abdd6569e4b6525beacfc334e6b2f7c8dd7b613c05ec2a15cdd432673dc76a
-
Filesize
342B
MD548b6dfc0516391036fc1819bb6945ae5
SHA1ceaeace74f190de4d19d5fb1b22eee8d0da38fed
SHA2567e2089b145ad7d0c5c013db52b2daaaadffe540f4162257ab22f862ffb3ab249
SHA5120fbc48f45ce8c7374575376947208491487da90555c92c2a3acad386cf27f38882cdfa0a7b384a4f7493ad2bc460f3c71b758e289873042c2d366668de559059
-
Filesize
342B
MD515b8c0458391f36d26b89cc6d5194938
SHA13a8bdc8fbf89ed98fa705ddd74e9511992929ed9
SHA2569e3d68f5efc88bc948f42f772fd0dd072281e5b3e9fd931c3ab052f6a4bd24d7
SHA5128031ae58a71720d2236b766dc3e8d2fdd42ed23837bb18fa6b32713c6bdda1606e0e41b1d2b6779acce0ce6e0a0588b1d754095e95e4e2c7dbb1aaa82a81beca
-
Filesize
342B
MD5642442e6f1c8bdb7f25c813e50334741
SHA186cffdbee9fe3b1991e1927a1eba8a7f6b9c30b7
SHA2567cfffc94731161076c4b10473abdce7e37b243dd02ca8f642edae8497af62474
SHA5129a71186546f02e76374896f4737a7e55efbbfa21eaddfe53558f79fcb4a80836441981c0e1398197134ff08e66157a0fca2e418bbae3f5fe72ba478d737d934c
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
388KB
MD51fe6fdfb7796bf1ec5bdf80f86fa9dc5
SHA1c4f86755ca60567fedc3a05ce88c4a342219c8b4
SHA256a878058e1c857a46a565cd950a6e26c2b6d30fca17ef97efb7488625c326aaba
SHA51222cfa91dfb8f8a885932b269202b4e68da7b94316213f47729b3fc2a10050e7629abe310ffa583ca1211b54dbbc37b040f76442c1c2e774a6dfd79e3fd80d9b6
-
Filesize
8KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4.4MB
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
