Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
10-06-2024 11:22
General
-
Target
VirusShare_4e826024050255ddf739c2656f2d9a77.exe
-
Size
368KB
-
MD5
4e826024050255ddf739c2656f2d9a77
-
SHA1
856eca0fb51d6994d9d472dfe5358b4c9b5293d7
-
SHA256
56cf195bd7fc140caef4a59132cca2d1499783d473633c0384d1b350606731ab
-
SHA512
fb25c55a9710133214b97bbd9492f39df0f2f43ea9e056cf05f6f4943d9f26031e7832d77df5dd2f69f49c97de92b3d9fbb2d3477215d9f405dcf178488ea8ff
-
SSDEEP
6144:r/VDu6UsyDUOxfDiyQhbw4tRN7eD7Lct/jG2kOREwMunfHAbxwcLNT:hDu6UsibiPbNt370Lcta9OSCnfPuNT
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+lotja.txt
teslacrypt
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/95E3EA678DAB33
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/95E3EA678DAB33
http://yyre45dbvn2nhbefbmh.begumvelic.at/95E3EA678DAB33
http://xlowfznrg4wf7dli.ONION/95E3EA678DAB33
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (418) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_4e826024050255ddf739c2656f2d9a77.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_4e826024050255ddf739c2656f2d9a77.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_4e826024050255ddf739c2656f2d9a77.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_4e826024050255ddf739c2656f2d9a77.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\fuwmoviexxcu.exeC:\Windows\fuwmoviexxcu.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\fuwmoviexxcu.exeC:\Windows\fuwmoviexxcu.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_ReCoVeRy_.TXT5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\_ReCoVeRy_.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1584 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\FUWMOV~1.EXE5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE3⤵
- Deletes itself
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD52640aad7798870cdd44f549c01520df6
SHA137d9317c756d98b745e467f094c12b1cad0770a0
SHA256f004161aaa13891dbf1f3fdab971bf3b15052927fc91a2ceca447366803f89e2
SHA512638579c3cb1056556bc7784f511e0d8cb13d4411482b9a3115c71726d05b24f1193757377874f93871c9b28371429768537951264a1f9f6218e12b52903a84af
-
Filesize
64KB
MD5c940ec4f7c411095ad55291a31457867
SHA10ec105e88116c0a6e156fd866ccc287f6f5ee50d
SHA25610b1b6fb014538db97c5aef0e6327e95418140b18a3f4b84596ee8542db4fdf2
SHA512df2e50fa283ac4a7cfbe464a9069ec062a94d4483a37665c48f09be827ef7ff01fdf02def0a93e1b5c6eea40edbc1076291500c709345b0f9e1f2ba26ef8d6b2
-
Filesize
1KB
MD5fd6b53f050ac649e5e0d593b7883684d
SHA1eda598d9434b39b974333daf7f3438c40c0aa408
SHA256e50f76c0dcf04717129017d8e768cdcde2ea09f0a20b19f911e62667e9e8d5ea
SHA5123bdc0fa7f79ee11410c098d09b296e7011b21258b87fdcf547701c1d6a97e557499914724ef6cb0ed5f3a4a6817d70101dc6f4fef53c692a3ec25f0b299a5d5b
-
Filesize
11KB
MD529a3a787443eebbbe19e446fd066e31f
SHA17a603dd5f5dcea52f8e1453482b8466aece77034
SHA256dc261f069f7d788fa8db9daea48fdfb728e50124b4b9643d6555e709a89d6b26
SHA512dc08e5ec48ece7d99b9b002ded30f2a4cf02124f9f975607590b2d7b704dbb815c0251acffa50291a2fda4eb98e4d920d488a2039cf84d96c8b1a08f6cefeb64
-
Filesize
109KB
MD51d0f8fb096ded7e9768ff31e7fffb900
SHA1b1b5ce9a1bee6e1c4b32a7c3af5d288e3152ff19
SHA256e48a053b590ac11e4c7c091fcc0262caad56d0ca4e5998e2f347efb5b5f1ee95
SHA512f87bee9993086ec064daaafef94cd8b0d82b6f32c07463303d09a65a9214f66562722d12de8bbe3154f1a703b2a4733973374e69d95cfada6466ee099dd8db0f
-
Filesize
173KB
MD5cf90ea76173b6592032a031c2905e7ae
SHA181848aea29b1e8f7abfe7cda2f4d21918192618b
SHA25689a0d2b42882f68095b604adc04b3fa54e10b947adb449384acc4baea768c01a
SHA512d6a722d3be27bdfa1a6105db3b925a3acac8dc3f6ba0cdd492ad0708fc6e26ca4db7cd49e3879d544501412900404c020357bd9cb4369baaaddcaa27bb4a165c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
342B
MD5d3e4e3e66f2807420c96efa51df1c64c
SHA14d224891fd8a335666865399592f5d6ea6398b6a
SHA256f8e7f690bd6d66ad8c4479d136abc25d432968a049411cb6b699a3c6e9bc4f41
SHA512d20adaadb24803109a80a046cbd480efd59480355cddb1c5982e9702ab46d4f24985a59e88a61ae920224d0e4dce70a8647539bf927cfbec5ea738413d044667
-
Filesize
342B
MD5e284d2a82e074e0b1c532b6f62afd381
SHA135c6df4c434b6097f3291b61dbcfc3b20355ff90
SHA2566bc7b80e37e16928585b3316686de35342237caa798cc5ec3015c8806dca8797
SHA5125269fa4a9a408872ca03f94acde07ab5cc82e163db0a9506b44fa4a2d867f391c1db8de566def2ebc836a805e5029b21715fa25590cc1d4b5a9d773cc364a972
-
Filesize
342B
MD5581da62ae1d243c28dd021fcc10072fc
SHA1e2c6c1fd5487c8877b7c50af5b9f4514a458e600
SHA256a82901e0e3059fb3c952ee473eab4c1810bf21506d40d8b3d92ac9d2ec97d5ae
SHA5123208296d9b5930e7f671adaf39f9c251d80e2eba4eda6296855eb0d43f5bbc34acb6b8e3c7c98366887391cdaa8ae0abbed43cdd39f4c86805165b75f6488041
-
Filesize
342B
MD52ef4f199dbe6c9754524b9a17684001d
SHA1bcf1cd5e096d0809fab6fa89b6dc9dc2c9eb698e
SHA256dac000242ef11b6a50dbe0b2c15a22c8b38a88600f942553f53797a2c9823432
SHA5121158f2bbdcb1e047882e2f78f7692c8f1047fe519ec6090c1e9ba7fcd8a9de6b8d869764fbac56f8ad4c11f0aae558be63b0dc9cf79cf7f2e591413d195ed8f6
-
Filesize
342B
MD55678a378b9f42b7e4605a972da37ae9c
SHA1ef5d465e2844680458306cc66beccf06ea39ea0e
SHA2563bae1af67b94fa20e607dbd86c1562162b34c95d9ee7a56167adf4bf22f16b9b
SHA5127a9a674db6e6cd8ffba1501139a80e27fdd67e918267ecb5576d0ab4615b3518da7c03c7e5af54317341002885e0568e198e616c9bc5f41ad983828c67bac957
-
Filesize
342B
MD519b15ba9daff66b2153190b992f9da40
SHA1c5a3b689f2f9342edcba256c5e7b0b15da43006a
SHA256d9518905f10f8433955689e00b11fb6295f26ccdb40abfebc66fe5f4cc6a0762
SHA5128bea4d149b0b7bc9106562064713c04e99b71c1e95bba7d835f011d0e6c363994373aa06c730f89f846f67d2f0f6ce7ca0c377e04abdb9d4529908338fa8ad9e
-
Filesize
342B
MD5e095c00257af0a36eea908f289a5813b
SHA13c6ca98ba63c456cefb7e9aecdde305bfa115d9a
SHA256e40f3fc32dae17af094d3f2ea890de55114fc17c96816f85774045421a98d67a
SHA5125d630690dbda050f268030620eafdafd3f1a5b69064dcb747f42f63c8d856a6cb26965f8e2b8099a2e934e03761057316ad0c82f86226d5166ac835b91f1f3e1
-
Filesize
342B
MD50ed876426042fb5c37170665db60b249
SHA1be348dcedf1832593ef1385ae5259c8a8a9bd146
SHA256c1e5fe29f58df3e693b8d7dcb0ef622f9acb79432d44664e8251f37aa8efd4c8
SHA512a4bbaf297c74367463a798d31b9c8dcabae8451ca3d8ee9a8da0f00cfe4f0d36a6a144045dfc9f0147c71240f0f075db3c4adba5b13bc546c8bce2c0ac141786
-
Filesize
342B
MD541d1711b89d273c13d79c9e582d89634
SHA1995509c4aa43c74905484ed281e1a649b9edc39a
SHA256681d99e5607ade1ce9f8dd98a165c469c6757731caa7768b4fe206d709b8a618
SHA512cd37b9f16cc1fab53ab0f0eef894871a9e79cb89a5a3a07116c04d86a3af2bd51f03941c3479907ff50c962db0a2e808e28273de4ea21c80e59b8b9630d9a737
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
368KB
MD54e826024050255ddf739c2656f2d9a77
SHA1856eca0fb51d6994d9d472dfe5358b4c9b5293d7
SHA25656cf195bd7fc140caef4a59132cca2d1499783d473633c0384d1b350606731ab
SHA512fb25c55a9710133214b97bbd9492f39df0f2f43ea9e056cf05f6f4943d9f26031e7832d77df5dd2f69f49c97de92b3d9fbb2d3477215d9f405dcf178488ea8ff
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
904KB
