Analysis
-
max time kernel
120s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
10/06/2024, 10:48
General
-
Target
VirusShare_2b5c64d0ae335be2b30de30ed5cf9b71.exe
-
Size
364KB
-
MD5
2b5c64d0ae335be2b30de30ed5cf9b71
-
SHA1
57a809107f1810a3ed01d4baf09f89a1fb562757
-
SHA256
33e6272f8a84de06327c40ad72efd8537c82d5f9d86b082ef1f6cfe7031f7c3b
-
SHA512
96ebf2562a60ef245aea06decf83298979368e4c4dabaa107068e430d7fe86af5f996cfffba95e7f1c5ef411e7d1265d24a84716be63eaedfd48ad3aac4dc4e8
-
SSDEEP
6144:REAU1eeD624pGSoJDZ2sqIrU5AsZBbgyg4s43yirHwlzKPm:RvU1eeD6282JtOI2D3bzsEHrQBKP
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+hpslc.txt
teslacrypt
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/8C73A62A47D5FA47
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/8C73A62A47D5FA47
http://yyre45dbvn2nhbefbmh.begumvelic.at/8C73A62A47D5FA47
http://xlowfznrg4wf7dli.ONION/8C73A62A47D5FA47
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (410) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 36 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_2b5c64d0ae335be2b30de30ed5cf9b71.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_2b5c64d0ae335be2b30de30ed5cf9b71.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_2b5c64d0ae335be2b30de30ed5cf9b71.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_2b5c64d0ae335be2b30de30ed5cf9b71.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\sirjnfbkuecf.exeC:\Windows\sirjnfbkuecf.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\sirjnfbkuecf.exeC:\Windows\sirjnfbkuecf.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_ReCoVeRy_.TXT5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\_ReCoVeRy_.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\SIRJNF~1.EXE5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE3⤵
- Deletes itself
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5e2c7e923c9e43008172337ed9ae15e67
SHA111bc9171dc2450d2d08f65ab8ef07eca7dbae7f8
SHA256bfdd39f63c0fa124081d694f45e408c7d37cd5ddfc5ab3837b2bb6671b9f8d6c
SHA512c07cb267caeea04dfedbae47266b4c3f06027e1102d127791e5a5c5d71e089c17a900e77426893485b1889c199a2190228b2491f5de3de3fbfe3678d20f0e0bd
-
Filesize
64KB
MD5a31f25846dfb57896d8be2471b4c7ad7
SHA111c5ad6e175f23c3314b7183bd4105f1e12ded4f
SHA2569c010e5523943c7cd761319996fc509d84e05a976c9e151fb1d237d179620c22
SHA512bb37eca7344da45d7d3eca8a3febd5bd5b4bfa110533583725a9c5ee9f265f56a9c6e92909d7d1c5b40662fca37317c558d5647aa15f3d185dc5d4006b0fb98a
-
Filesize
1KB
MD5e470e556e0bfc4f9e707d2f34846d2eb
SHA1fd3316cfdca8aa58b3909acbdc0a1476b034404b
SHA2568222ae5fc123462d7e9e933ca3a66f5f8a2f85a8b4bacc47dfb5d8ff55f80c71
SHA512368313a7cb052bbe8350b36b6f473b7efb703b6bcf7f2004d746b297495695b520be968abaa35d3cf683ab9396e172009c6229313da43abb97e05ba1e656a54d
-
Filesize
11KB
MD597fd3e44947c08f219bffe7a1390c3cc
SHA19f1e8b468fd877ffb286ec7300acd4623c0fdd91
SHA25669274614963682e96ce9fdaf7a92a1257449a07393bcee660f907b4bfad58c91
SHA51220f831aa0c8e191bbc2cb50069c78c6e87f19be821c7407b4ff801a7a31b81c0ddc5d9673238487ae76d7d97da0ca08c218bbe3fd8d0f8ca6924d2b700d945a1
-
Filesize
109KB
MD5a5b241ffbd2ee699207cb5d3163b08e5
SHA1804b1cbee50d5c70c7cb3c1414b31c315c907056
SHA256ca40a843985cc3954324c3e19e01386f3b23095d4cd9ad56755da8ff26d02654
SHA51212b91cce288c11d9c3642a1ecdbdaa6fc284982f68def664c447cab2a8e1c588cbecc9be28d6147f6463ac84af56934fd80da82b8a8eb4767be9b9d2922512b8
-
Filesize
173KB
MD56699d859e3e71e491fc8213e9118d573
SHA1a3f6fc485d454e3701a5a58d155340633c7974b2
SHA25645ae573f77aecba7b2c54c8b2dc2b91223d32d0377beed1b551f42c45854b6c1
SHA5124fe46a46a7d474655e464cb80ee29b8280b814e5fc25054ebe2b900c65bc1f8bf5c042e524711c64a01e70656be6498b26a39e0c98e02566724786d00d2c1db5
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
Filesize
252B
MD58bb489286b47526ce91147440b4a1283
SHA1a955e09e72d45aef7c2307b0c78380a370c2d36f
SHA256022c4eb754f4b08aed5f2f1466604ab4bd30bc6147f445fb05af99dedbd5fbc9
SHA512b613f2f6deba344504676e0a44ee15a80d7c659e075e677fe32397d9cc8de946b93df3ff08c7e13f0ca514e25f8620cdc50c5f593c4481faca79aa4072a803ee
-
Filesize
342B
MD5d3cc2fcbebf4fa11a7834527e6eee03c
SHA14bc96a3dd0185f0f99739a9bf4caa06800e6f210
SHA256bd5a23c18900d8e6b2384e8bc62fdee2bd452ae79ea9e0a52fab8b9d0bf4cf3c
SHA51258d2d4db03359889212b4ab80c15ea5a003d6cd3bb76a2356fd37c51d7bec7e7ca1b2f081d4918ed48ba364ef2556a33247cfc7a1bb053fe6946c1afac7ee1b2
-
Filesize
342B
MD5a85cdf821b259879e311b3550bfc0ae1
SHA1502459cfdd7f118ab40dc11a20ac48c6dd558c0b
SHA25643b9ef5b0c6cdcb3ce0b3fdf60041ae5cd0bebc0f948a69ea6ed3543c059704f
SHA512d621e1473d5b6eb4d88bf38905357806901cf243772474e1f6b0378682980f448e238a25a468ae7f0ce813fdda365e6408cc1b365055ac0df4671aea30947c6f
-
Filesize
342B
MD5b2f747cb22ff1a2a37bda7880f69d5d6
SHA154d7cb2e9211ef0a55e86eed88203e8944f28b12
SHA256323a682c9b073fa06e4b75d51d70c577fd85ad6c23969972d186004dc33c3ebc
SHA5126c9bb39557d235c35627c60379d08fc7d87b020f36b599fa1ed2adb071de0d3ed09e4702a5cc15a08f61f574eeb09660b5076ecbd9a5791fba68a5a94c1937b8
-
Filesize
342B
MD545933ea0e0c873901c6f0b24d00d65ec
SHA168d0cc7839af91a44f28865599f0a3d8bdbe2bcc
SHA256c789ce306776e1ce677d70f54c7e99d7e5a641b0e93ebb586ecd7527879ca240
SHA5121d229072f1116751d2c983a7e8f53b4bd89a8c2f0fec6d68a532a4a571c0b0b668ebc1747c5d8998d0a46b476c02926e0e9122afd9db34bf8419c7c7750bbbb9
-
Filesize
342B
MD5d9991b705d1ba97b024e408c2c8ecdf6
SHA15d7592d114708d4d039421b5d2809375aa193a99
SHA25631cfcdfbaad56f4d40f26c32c255902d54ef7a42e624ce2aeeeb7541559a0ee3
SHA512acf5d48aa98f420f109370acda06368f5c1f01905f0dd62d257a79f37f5c21cf4acbf6d2522389fe9745b5875516f47e174fd11708c3866936587e2d053c7deb
-
Filesize
342B
MD5eccbbeacec15126cf76b9054130527da
SHA1e10b0b2a65f25246683bcf86b00048d5c196100a
SHA2569325dae34d3cc6f971b23d8a661b3b806f8e05890e01133d1935987d1cb7b02b
SHA5120b42b8244a86b422b5c241ebaf54ef9f2d72b1e83259305a8484f2688064b0644047354eed743ae5e8b9e198de2ba12ea62009641bc3556f0d57f1de988686aa
-
Filesize
342B
MD5a6ccdf35ecf9e267307d300462f9a357
SHA172748e52ac6f27cba8ec944f229c4cab9990b765
SHA2565204f647a46b4d3ccc6590ddd7790a8a83e66672aff94fd0fc0cce406b288ef4
SHA512b534025194a66794d459244d20532623c8b4ee32beecff461b247b18056644ee7fffe9fc4e375734994d4df12f2ff495cab5f8b79b757892914306843fe50330
-
Filesize
342B
MD5fd3131a18b5f4f812466fa53b25db6e1
SHA19148c77a83657dc5d5aea470a000351a16f4035d
SHA25621d41f379dcd29efb03012a124f02a952eff51c084a1e1c8a819c16de1dd43f0
SHA5120ff502c32ca68664ecd2429d0ab86e2995e58732451958ada7dbd83c3d6e9a20adaff0e562a5fe01f3e74824fb9209ecdbed92922fc172462f45abf8ed2436b4
-
Filesize
342B
MD5fb0b7c04ad1fae93583e39e06c0a64a9
SHA1419fe52827ce8e99434dfdf60fdda9c005d7db57
SHA2561a152b9c05bee43560b775556b4a3edabe4128cb602e5d0ad4a7d34b1f224568
SHA5125f29986db40ce7aabb314dcde8bd4ced9c4dc5ee893462126f923f94d2dc3a563919f4ee74a3938b901794d55e1d2059b56448d06aba01fb9aaa9495bc51a608
-
Filesize
242B
MD5e48e927273c4e62b265cc39a84251fa6
SHA18a38fd205446c007484f249825f9377aab65bc05
SHA256e78926283cadba0627646f27c5e17a21a091ccaf04ca65aa8f321146ed595a90
SHA5120273b18b9eaf59fac1965cc09d97970316866a5eef5f80f7991955c9c602167bbc5247aff974759951768e86002f9b39ead4211a888e948ba7beceea91819220
-
Filesize
4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
364KB
MD52b5c64d0ae335be2b30de30ed5cf9b71
SHA157a809107f1810a3ed01d4baf09f89a1fb562757
SHA25633e6272f8a84de06327c40ad72efd8537c82d5f9d86b082ef1f6cfe7031f7c3b
SHA51296ebf2562a60ef245aea06decf83298979368e4c4dabaa107068e430d7fe86af5f996cfffba95e7f1c5ef411e7d1265d24a84716be63eaedfd48ad3aac4dc4e8
-
Filesize
8KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
900KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
