Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
10-06-2024 10:47
General
-
Target
VirusShare_27e887aa14f3890a72f06ec5d0759f20.exe
-
Size
388KB
-
MD5
27e887aa14f3890a72f06ec5d0759f20
-
SHA1
8bacf22533725fd98c254c8eb6852edbe225a0ef
-
SHA256
91a23ebd232c1d96458e3b0870ec5507e547e6763bf99c5c7ca69a89e2a51267
-
SHA512
56f420069c68e971069ef6d25a5944d50901d8c9de84f57a1bdb49371cfca117855afd4a6aecf1c6df96369ca3d19fe655c5a939a8b66d6fff6341de97259089
-
SSDEEP
12288:LhTjRwlkwFrnAEryLFcG3yBrZTRDgZ8zOhG6:F4DRw7325gPh
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+ujerx.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/4E38C8C18A7A6CBA
http://kkd47eh4hdjshb5t.angortra.at/4E38C8C18A7A6CBA
http://ytrest84y5i456hghadefdsd.pontogrot.com/4E38C8C18A7A6CBA
http://xlowfznrg4wf7dli.ONION/4E38C8C18A7A6CBA
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (405) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_27e887aa14f3890a72f06ec5d0759f20.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_27e887aa14f3890a72f06ec5d0759f20.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_27e887aa14f3890a72f06ec5d0759f20.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_27e887aa14f3890a72f06ec5d0759f20.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\fbkuecfutijw.exeC:\Windows\fbkuecfutijw.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\fbkuecfutijw.exeC:\Windows\fbkuecfutijw.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2920 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\FBKUEC~1.EXE5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE3⤵
- Deletes itself
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5a8abcbf1452dffb8d6fef7bffab2c4b3
SHA1151c85f15ae2c1e8124831151034100319999d62
SHA2569c149e8b479e99a8be9bd08e6da78e2a09ad009973d8a9edab13630063a50c61
SHA512b073c74b82bf0810f221daad6b6c8213dcab4c21e3a73e53affc16d8b4e9e64143cf2d3e6c3f8ffd2b0a9c3cc4a7d8ee148ca9ec69d11d590f985478ee732297
-
Filesize
63KB
MD59c748dc8f448b28fecc1123a6b32fec5
SHA129a5a04f5aec8106f21259c7e7847e1c7c552349
SHA256324f134a49a37ed6d2dc701d6c69420a878f07be7d74645138c5f1024fdd24fa
SHA512e8973f9347a0035cf3c7d0c39d693b60238d98052c0b84449a4968bb9d1cedba54acd35d938b275955cb02afa5d5aa9316b2575dc716f28326b8eb0ce34c420c
-
Filesize
1KB
MD5be21b0983fd2805729707c551b9404fd
SHA18a0a4431e3eee4e81863e0e6fb0016ab8f6a2fbb
SHA2560330f2dc94f8d52cc22a4a656e00f32eb37ef85f71286c8ef736668c73098434
SHA51298a9458032502962d3884ebbac6124347cbda213e5bd6f79c746e921af774df20138fc3260fbc72849e77b39fd3508f57d958ed2d128ecda8fa41a3920363bb3
-
Filesize
11KB
MD58d1dbb2e1d7d07010d7122628178b8f3
SHA1e3eb047c7150b65393611299ae836979f2b63240
SHA25601cd8c739b1065e43f07aff48ecb4c35d7d98030eaa47a910e8a8b6037a3137d
SHA51253171e81ef09f5172131a7d51f655288ca218e83d77fc72f3c60651d44744d809e20a5c2ea41bef758a41755b71f9e10d6b70acbcc380a7c9a9c814ca3c2ebb4
-
Filesize
109KB
MD5e7271363d98166842e943908e524f8de
SHA1cb645e444248e3636be2cce66afc52df2227212d
SHA256d53363d2684f863e6ac0ac3a20ffda41f60e27545cd2bac63ff815494bb27bd2
SHA5128c4732da0c9fc57e4cad79bd0910c8a12f68f7029d5ff51f8e07c2efda6d99dec8fe52c4fd9ba3d382519a0a095071daaf8c18c34de027543fa7e3ee2414b3e4
-
Filesize
173KB
MD50105a0271e31fe9abc2581ead0e03535
SHA138918e42490cd43729b8633689c22325e0fd1563
SHA256067ae23e1ff4e71d9eb6f64183601816c47a3820a692b4ce88b7d01f8cd4ffda
SHA5129bd11ee8611a141977679f03555c0cfe724fe80eed173d79dc1baabbcd5ad48f73704f32049651827c4733ec1eeb1133028bd90582005f86f5431b0a308ca203
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
304B
MD5212f4204dbb1aea4f82b280ca1b5840d
SHA1300ff57dbdf5ff1b2c803c4683f76822d143a892
SHA2561653566069b394d7631faeb57aab65e912c1f88948092d2d1e3db201cd742230
SHA5126cc87db2aa0444bf137cf5f5e126aa7e8411d178bbf724f862ecba786546f198ce84f2d19a619e181e967de94606fc36466a8d71e82b094c37567d7acfe8be16
-
Filesize
304B
MD53bf5cd0bf795d36137c6e6af359189b3
SHA115d5ad089a6c801e10e2bcddbefcd5e53074be22
SHA256203c2cedda26107d6f1c05e83c9be2f409b25444bfae5b5f7020c44c45b59fa8
SHA512b31ad2d43c245c5c7ffbcbc7fc06f55a8bc3eb6518c16776c862a60154b8adaf7e3e4e7c4f7ec4cb1670ad3eba190192785c21e04712effbd109ba424583ce59
-
Filesize
304B
MD5ed61eef8e39de8c1ee9a11620af6876f
SHA1c863b5efa82dba8e38c1fc8c9bfae1d1b3049283
SHA25603ea0aed8cb0336b791b33fa96ee991ecee80a261abb44f1991324654e963e3e
SHA5124942cd5abc66546de0775f5851af593656561728dafbe5c5f02c70cf02b6ad583b3c1bbb085486b81ad1825915db1e6f778c7eed535eea9d693005f369a1850b
-
Filesize
304B
MD5fe8817880b2f56cae90f304fe49dfa92
SHA17fb35385d96011301c682b25047c1821db276150
SHA256b9d6442fc44ec2c1dcc408ccc954d2cd82f58c0414e977508bd60bf8b8f16ebb
SHA512bf81b657261fab2a68588738d96684a2b8591260079feed4665f339a5a71b43f063c29aa0d395c748e39eb539ff116ae657ce4322ad71d270f54a1f5f58bdb72
-
Filesize
304B
MD5c8bee551d4444aa8cb4c10f72c446b8d
SHA16a5e73162fcaff8582b3ae8f01b9bd98a593d538
SHA256dc5fa6ae85b7ed4e0b2eeb5d6abdd7b8a7dfee896c7e246c76897a26e850e9fd
SHA512a1e50cff973ded3eaee795078a68995beec9fb6131bd3d6f4609333472eedc3b8eccede8c81fb7c7bfe24be56f27e6c7799db81ab85c9d59ff66c2f0b7dcf82e
-
Filesize
304B
MD517d793ec7df377dff0c6d3a38a80d1bb
SHA15263c5c149973c6e0fabaf800a334b05732c3c27
SHA2568cf7b93a5fa133fd6bf7cd61e4a2a5ab026b81d6d243b52cf510fb4f16be98cb
SHA5129699554d5a567ecd9e917b45586328d462734dc827a27b7bf1e0272015d0c194be72b7979def44844e3bbfd2d138e4e1fe62c7d12c95041f0f24d7ec96319bdf
-
Filesize
304B
MD5e9e633dbcb71c269f18b4ae7c042edf1
SHA143255b01c56910fc3d06600d3e9b18f703e691e6
SHA256e761ce190adc8857dc7c5f1ce268c669e0eaaf3c333ddfc2292bf420d7098ce1
SHA512b2550b7263f2dc5e12d330701399fde8c427eabeb37e5af34a58926c41fc3c039ae35c4262a7f8ad1e6a6094492b4aebe2c3ba1a82e0b28c2935361272fc8fc9
-
Filesize
304B
MD5eadd917efcf522fd1ffa89508df53449
SHA1a1f7c301856f6d3061b1a0a1acad1a156c11032c
SHA2566d74c3af6697eb90319340ca659391dd8c178f99a4e6e2091122b673348b256a
SHA5127049058267a7d2c57d92b33503b9ff7f3e360537b334519533b0b4cb53f0456e3f4d1a2afa5694ad848f1d536a7e476face091e52d3bf988eca191d17dcf05a5
-
Filesize
304B
MD5794bc4f6e128b6a1b10e18ca1eef972c
SHA12ec3498c8a7335111782171fdfa20891d3433840
SHA2569e81b174e3bba8a55c33c781c42f1cada141cde83845857c720b4278147fcd1c
SHA5126bb68cc5f47a31c5c148aae4a0dd65a897bd62910816abe6741c2576c35b7ce46723dcf67dda0f32f0905b6a6c09d14561b55dad9fad4b5e2f99fc8bbbd2ca12
-
Filesize
304B
MD5435eac012454098448f2012bdd2771c3
SHA1c72373907ac674f83bb3ce31153eb6dbf75eea97
SHA2561005bbf5ec3b63bc328caa9c7a6ad52fda314ba43ad56935b0e54ef678b7a820
SHA5120c6928b000e26dbb2108c72a37393d332731fa47ae7e9a50977dce7b023c24d4a2b2a4b27c3484cd417bed90631c64cafe3198a56b392f2e5475f30b3ff07db2
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
388KB
MD527e887aa14f3890a72f06ec5d0759f20
SHA18bacf22533725fd98c254c8eb6852edbe225a0ef
SHA25691a23ebd232c1d96458e3b0870ec5507e547e6763bf99c5c7ca69a89e2a51267
SHA51256f420069c68e971069ef6d25a5944d50901d8c9de84f57a1bdb49371cfca117855afd4a6aecf1c6df96369ca3d19fe655c5a939a8b66d6fff6341de97259089
-
Filesize
8KB
-
Filesize
2.2MB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
