Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
10-06-2024 11:18
General
-
Target
VirusShare_40550e4313decb096d6300d7bc0e006f.exe
-
Size
332KB
-
MD5
40550e4313decb096d6300d7bc0e006f
-
SHA1
2d7154c146ba334d7f6862df6df9cebd89863ff2
-
SHA256
0e73a69cb50ed4cc7e45c5b5913b7ed3b0b2ecb5ac946e0be78f026622bde396
-
SHA512
1a3a903d4949a19acb2ca9adb09ce83432f5c28d017655a4a9f30bce111f293c78a38c920e81272f26577999d3dc099d8bcbfc78fd0c0ee6cd80c6bb0913ce2e
-
SSDEEP
6144:7cMG0Cmis0NH8A3/1uz7uodnIm5KJHLqreJDckzrYk/:AMZas0NcAvAzyQnR5KJHWreJRrY
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+akrmf.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/895FC520A028F94
http://tes543berda73i48fsdfsd.keratadze.at/895FC520A028F94
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/895FC520A028F94
http://xlowfznrg4wf7dli.ONION/895FC520A028F94
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (430) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 52 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_40550e4313decb096d6300d7bc0e006f.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_40550e4313decb096d6300d7bc0e006f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_40550e4313decb096d6300d7bc0e006f.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_40550e4313decb096d6300d7bc0e006f.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\dmwmgoxfccsv.exeC:\Windows\dmwmgoxfccsv.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\dmwmgoxfccsv.exeC:\Windows\dmwmgoxfccsv.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1696 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\DMWMGO~1.EXE5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE3⤵
- Deletes itself
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD56e11e2d92e559455f9ae67343af5a28e
SHA19d6cb88e2eac9e670fd3a79eeb4c4492d29ecaa0
SHA2566954de1cdc53304c9231e21666c461bd28955438cdd65bf01187537d1cc4a432
SHA512882f5d4a860554f1b7137ba66aa2f988d29e0b0aeb9fdcad47cd78b83abd346b6d65d7b234cc93d2e66cb7c5df800746d408b3e73768119253c18857740e146a
-
Filesize
62KB
MD5b5c65f28a4c3d6ec6e8cfdc712fd0542
SHA1aee0792a7ffd77087819392ff5aa38afff2e3bcf
SHA2560c98d0a4ea8aca4e45e13d2748b24274f52a40aac245c6839f0c3f4b1f9c36fe
SHA512a94b07910e5c49642b0c696087e7e2f63aa5c638b07bd7b5b2d7235655509e117385b79c53d35e74f86d0904dea0ef78395f1fd325a31dfc13e91c68ae6b3470
-
Filesize
1KB
MD553b065a8cfec163e97a792f3efa93be8
SHA1fa51d5855488fe076f7f7c5c2f103abf0bed0871
SHA25651b926716eeaec66a4b4ce73d1fdea69ae589ccd2e95a6ac31455ab6d6ea1b65
SHA512827ca94b605991065e669018ee9fcff1ef2ace70eebffdf09f8f5351e03d257390292597616946b50b6dd521cde2c5d2b259c8e2810b07f2c7e66c9818182511
-
Filesize
11KB
MD57b08530de29aa7bd60a5fe6cc867eb4a
SHA178db2b864151d375957e061d97dec098ccab61d4
SHA2565c89d835a059e647c514f6518542e1f942d94f73f43655b21ca85640bf80ea38
SHA51246fc62fd173e282c848af08c0bfbd207106b3edf443b86ed302af02b327793a4b72f22ac674b6299229a56dfa929ec0e72a5f269ce3a5b51dd39f40bb09636a8
-
Filesize
109KB
MD54674f3e7cc2b7a28c651d0d5dd0c2c94
SHA1e758e209147c3f656c54940f436892888cf9adf2
SHA25655482482aec5c250ec6008af73d4aec68b64bb5722f79b528144b9a32a1d20a5
SHA51276984d15edda2eceb2bc971864b66b93614ef3540d0aff895df2a1c3e8df9c7d1452e060e786185d2f39de3d74dfffb49bdb2a61b89badb03067083406b04312
-
Filesize
173KB
MD5dba8ae23d2d2dcbe5affbb01c3129875
SHA13049c503731accc95f69fc8dac3e5a3d78812d78
SHA2563e9486013d2215847a4972281aabfbb5122bbfd484004179bf2fcd49ad6e400f
SHA512227cac28a5ff7ad23c4407c7e01995eed2162e4c117e509be5143cc1203ec82ca7bda33282e1c96afaf075893956191f055bf4e90211b69693137734be2660ba
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
342B
MD5c13b18f4985d360fc1eb156503c65f31
SHA1e34b6052c14a8e390787e62ccf5fa587be6f3c08
SHA256db613293d8596374257d7af239a3c36bbf1ee63be23e14806cc04949802f3b79
SHA5126da7d1b78aca27a38a11807ed188a446c17abbdf99c90b869e78538ba068d5b2c83363e9d6085979f4666b7626459101d2aa485f5f2a10836c1480990027f656
-
Filesize
342B
MD55546ec3240a759dc236ff0ae06e750fd
SHA1dccdf832650720070795204b02918ceb883f9fc6
SHA2564bbd219f75a905ea0aa3ba53d2af402abd3e167ca58b780178277871f133d825
SHA512ceaaede5c6a7211ba17cf9dbf35d1b1864e9e82471ff7217e99c47f0fba84f855aa3dcd76e625c713afe97b0f1d0151ac56db0ed43ef3d11ed3c125749ac0195
-
Filesize
342B
MD5ce7e6e88a6c334d3e702dd685737767a
SHA1e51f39eff6a1d2c6d44dc238425135d670aafa01
SHA25653b9b7b1c036ad6c969b086f6f5d2c2bcacb07f1ad93020df3cc87864b358727
SHA51249ce2a5f37b33d9e2ef755457b01e198cacdb5daab74546903a98127c464625e0f579a5bb412613a41a964797f00863e99620773bb019bbdd9282c49467ec687
-
Filesize
342B
MD5f1efd00720441b00593e987eec666c1f
SHA1a38a728edb13dfb641a06deed8bd27a4dfbc1d7f
SHA25692416d31468afa51dcd36b17545304171f002a000ca67a8f89ec0d85e986862d
SHA51285ca491f1ff033b78e30c97ab434115d02a6753acf301f1b32a58b41695fd1159a992847b498e634c91834bfc3e93460b72ccbb1945ceb30a12412d0131ef5e3
-
Filesize
342B
MD50a67b56acecbc61a9e715d0fe7a6cd7a
SHA1e5eb5f7c3d6b27a91667761f4924a81ad5c95c7d
SHA2569a9d549462c8b91fac40484c8db202c38f9e7e301ac9e0ec09561776ec822fbe
SHA51297a82fca6c42e2165d78da33a14a460e3924d8fb918aaec842e03087fb747fa56134e38b7d5485cbbf9f6377e66a35f8d211759f10a6c76492a88d85e7c83596
-
Filesize
342B
MD54331fb523eb7392defc7765ebbfd4ce3
SHA18b313d7dcf9c997f3d2472e62b5b742a01070391
SHA2562d5b2d355bd763a59d8b4ca00bf1320c77fac786f0645f9338d726394e20b631
SHA51245d61747cf5158271fb36b1ea6b7c9916ce868385cfd3d88dea42c88632cf0ab8d9ec1109a808af1c106e896e554573df7dbbc2e45a2ee3738e3052fcfd55e6b
-
Filesize
342B
MD5284e5dae31e08bb0ea94d2878ac989ce
SHA1fbf1a77cc5348c19898d799b0434ad55cf8ba734
SHA2566129da2535a3829cad81eeac151c8d2849a01062ccf3db253eda6b160cab1d25
SHA5124343b8f7adae7f45b8ae8739659c04de72cf5145ffa996db6186a84a845dbc7e6400025b40749c7f0f80c8cc6003e60e3bc7bab0cb9d6c0cb0a4e8e7b800ddb8
-
Filesize
342B
MD514b1db428127301a23c5e8db83bb5e3a
SHA1ab96f3e690ddad743ab507a8c8fe0bd2d988da35
SHA256705db3d4b9bca1955f45332b33db9ad990623d526837a184bd27104d36f84423
SHA5124bbbd3936425713de9e752cb898d2d467c52b2ffe6d42597e3d10aff7dfdbed60f146523c67b60b19262c021c349380ab2848e4a6251da3a522ceb21a919af6a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
332KB
MD540550e4313decb096d6300d7bc0e006f
SHA12d7154c146ba334d7f6862df6df9cebd89863ff2
SHA2560e73a69cb50ed4cc7e45c5b5913b7ed3b0b2ecb5ac946e0be78f026622bde396
SHA5121a3a903d4949a19acb2ca9adb09ce83432f5c28d017655a4a9f30bce111f293c78a38c920e81272f26577999d3dc099d8bcbfc78fd0c0ee6cd80c6bb0913ce2e
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
4KB
-
Filesize
532KB
-
Filesize
2.2MB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
8KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
8KB
