Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10-06-2024 11:23
General
-
Target
VirusShare_5092d1d7abb882028147df297432ca49.exe
-
Size
381KB
-
MD5
5092d1d7abb882028147df297432ca49
-
SHA1
101d56d520a89ac973099959a317a790d7b75130
-
SHA256
3fb80b937831aca246d838a129d4e094b8de7fc513fe14f311e1bbaf67cb8a99
-
SHA512
aec9a4a561978251bc537675fad16818522c6cd6b8f6e5700f96ded4d0c2ba4bd50c5efc8ec5e2ab30fe56f5209e21f1af16f4fb7b599db8184266e474b7a898
-
SSDEEP
6144:bU+DRYgAOEYI146+ziWRKrY7350PeR21AG+KpAy:l9YgaTl+ziTrY7pAxdpAy
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECOVERY_+utaqn.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/6AA7C2BEEF34AD47
http://tes543berda73i48fsdfsd.keratadze.at/6AA7C2BEEF34AD47
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/6AA7C2BEEF34AD47
http://xlowfznrg4wf7dli.ONION/6AA7C2BEEF34AD47
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (386) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 32 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_5092d1d7abb882028147df297432ca49.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_5092d1d7abb882028147df297432ca49.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\xpkcnkuwfvsg.exeC:\Windows\xpkcnkuwfvsg.exe2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1756 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\XPKCNK~1.EXE3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE2⤵
- Deletes itself
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD531f644301123115dab19c74bbe31e293
SHA1536a5f3f37e211f80ba69692ae61b7e2d58d6ac6
SHA2565f2d97c2509acaa584fc16176d5353f39365bc4c5df9fe4e18eb72f1b75c7229
SHA512f184135b0b6dac755c3d7abd570f6e94dc9d7180109d44b24842fe5db0ba10c74381ec5018b94c1ec6f489cc6f82134e390befce23631eb130d4682a2446bcaa
-
Filesize
62KB
MD54a74971f244b2f65f5ab29d47aea41ff
SHA18f3da3da5d24ce53c75dc8274f4fedd6dfeaea43
SHA256ce52b47230488754b91a8a6537d5458f175941629929502a37d520814cd1d089
SHA5123454bebf9d7cdbc1f8cdfd35399768677cc620215866c9dd173c3360880f3c21bd129aed3981adb72c0202314aeda4fe70d77f9343d06d4dc0682fccd9ff14ff
-
Filesize
1KB
MD544d4f08b21dee0603391723b45f14a6c
SHA12d334728f53c653b5573a13e190182aed17ba912
SHA256f68694440cc35cba7368aef86edab6d0476297e1e510d7c9aa86031210f7af68
SHA512737ad3443d362e1dd1c5547a7510c9b266ce0c64daa1b61655b869fdb5ae59635adb004ff3b13134dbf5ecd3b93f30e51ba293f28dfb7d11185c473682335a34
-
Filesize
11KB
MD5dc5348c9d16278dd5e70eed64eb2ca62
SHA18b29809c03784aa825992a3958ec85608a4ca5ec
SHA2564a767f3c763bb10b6c0184f2989b6f621c473068be1955d978c1b933da509fe5
SHA5121e149ea6fdc19253c0d9be637fc531dcfb1e5f67f17624b7b3ce42636a7767a16fe4133ba8144a01edc24f955a230ce4acac1bd85700f041ba87598dc8a0e0cc
-
Filesize
109KB
MD55d137964b1f0a9bcc2e3e31c3a78874c
SHA10cc7083baf0a7a7b6401699c9f548a4db6495acf
SHA2566518bfd93ef383bc335ae6620ddd3c061ef24278a8b79a7ecb77011263a2167c
SHA512c2bd3e8013be68bb79caf97d4c0805be1662556a0b626fb6b6c29293c20928f8013d1fa996d82f253c8d3be7954963b5d3839de8a5738fdaf496e53e19524ca6
-
Filesize
173KB
MD5c02871ed542f3fbe123dac2d4e72571c
SHA1e6d7831af5d7c4abc8424809652ad6611113fc24
SHA25602bb81ef6f6786b40c017f2df36bdac1f38ca03618536a376424817730c639d0
SHA512030b8256154638857c1a42414c0e500a104f524579c0cf7a9596f903a5e4018575f04affd0bcf87a1294119ce452302fd1c710b3d7e85a206bcbc35f0a9df514
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
342B
MD53379c25a53ea0a48d11dab4b5d1d9182
SHA122294af80d02358823c5bff108176e6c876daa95
SHA256474c8f03342568cb27ef88a617cebea5eb923259061a53e82629ba2234685985
SHA51241b2bf22e165d25e4ad3b878f97ce30f22972c22db2de4bdaaaaf9770f657bc36432f58d2063ecf398f554f1b3794bbc8cb2e720cf2fe4f4c636714747fb148c
-
Filesize
342B
MD51ee3eb9489a36be12fc5ec31d331e5fd
SHA1c1620c6d94008cc21d5e8d7486a9a31cc8e2aecd
SHA256589de6b7610d9ee372b76f5609efd4a6cedfb9f1393e5ae4deb938c9a672693b
SHA51204ea97e34c40595a254c7ee5acad90fe83089687fc970976fb7757451ca8922ae84563129c3208b9dee80586ea9d3942ff9fb05eaf17e657343f4e77f39c467f
-
Filesize
342B
MD56428da4d5a8f54b12a4f2ccb3cc439cf
SHA14590604cd83e10d4539d76adff8232db6555b4b4
SHA2561fd65731d6ffa64acad233aaee773efb9307ed2eccc98925caa125e64ee0265f
SHA512adda9bced17c589607cdfbb3667f2de47c8c03c35043b12abb864f2ee225e9fd682e7370512b260acbe41d0708494b47607f07940432ca85604a7725e5a74600
-
Filesize
342B
MD585a816c147076baa3e266c95015007c4
SHA1b79978fc09af7ea2c9a0f44b98516771e9127269
SHA256f2e1bcf9802c6d1ccc0610b3ac7fe739a0a21d9544a18febbc117345f6eaf7d0
SHA512b468ed42faee1adf4db7db4780d95dc6c9681b72639337921fa9cc269eaef329f5927c93995bcfebf9cf7c9ad1f4cb76f582d74d315ab055640a91716292e665
-
Filesize
342B
MD51ecd8e91dcc12a729eafda2f8fde99c3
SHA1c24948e7dee5182698a94fa0c86fe1ed5968c182
SHA25646131b856694e4eb80e4af69cf01bc4879a02a100e846409c3f5f3bc02963dda
SHA5125d92bb7bce77f423c546c04a1196a589e3d57ce66e32df0ffb94e896bddef7963c12c0ae8d1389d89fd39b6487c83b784aed996f180804accd88a3a1aefdd8d0
-
Filesize
342B
MD5fd918ac568515097f2321d018ff07351
SHA1c4440dacb76ad02deae1cc8dfa81d212b6a8efec
SHA256a04116f38a495964955c340380c6e9f5745ebf6716db8916fd4bb614b67f34ad
SHA512f4dd73f3e6059685dbaafa25ad7ca4de82ea2a6b414d840bf09f46512e6389dc20a9a40e11e381796c7103e512b9361ad00fad5e97391e6886bf361db7848310
-
Filesize
342B
MD58a3e7b26ca64473bc3cb9a063326e35e
SHA144b8b444157b0af5ae804e820370acd3f14a9f7d
SHA25682f058c0e70dab30ca5c63b96c9eb71eb3e076487198a323e8172ca5b4280aa6
SHA512c7de6edc65bafce2c900b7c04a98c23280699dc0b577b339c03d59c3ffbc4c6f3de134cabce5a0ec15eecd354fe79a8c42055d213d6b7bdd4e046cf8823194c3
-
Filesize
342B
MD5212e3375ad299b1880211d2bf7ce6d10
SHA1cedde9891910931fa7f2299d3cce424f264f87e3
SHA256f789611b599858cad34b57029e716256f4b23224f6480fc0d1f10cc269f065b7
SHA512c1ecc7ae3c3a58201af67004601f7bf387c68e1bcae852fe4e929d32c4dca914374f690296f9da43d9b74929b41f78cc945df46765d2359bc958c04a613ba382
-
Filesize
342B
MD5a2b49b75a6e343938cd291f10b97be17
SHA10d3ef4d135c822db01de7596421f9b6ab57ac51e
SHA256aafc40d0e2851ab0ed0761b26524a0820089421863bfd29b9835d1cb51ea7360
SHA512bcbb40a941e98e6799bb992c72ebf5c1be85fdc6b7a7a33615610c4923feccdf34f561f16afceae84e4d75bd1778cc175131df23dcc8effc417e3ba76c4a9214
-
Filesize
342B
MD5fa944a91656feccbe57f83b668080aff
SHA1612ff51728e3470a1eb3e5aa5c336c823ed57d65
SHA256ce7efeb2490be7f429ab6980a360aeecc585b00f3ab7ccf7080d1752fb137367
SHA5126a09104292b9f2040b64e46ffe45bd8aa882e237920cd351562da8c306ffb7a60eea3518e6d9dc164060d1482f3dd418ec6fae042e2f74dc9abc597851a4b6d6
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
381KB
MD55092d1d7abb882028147df297432ca49
SHA1101d56d520a89ac973099959a317a790d7b75130
SHA2563fb80b937831aca246d838a129d4e094b8de7fc513fe14f311e1bbaf67cb8a99
SHA512aec9a4a561978251bc537675fad16818522c6cd6b8f6e5700f96ded4d0c2ba4bd50c5efc8ec5e2ab30fe56f5209e21f1af16f4fb7b599db8184266e474b7a898
-
Filesize
724KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
184KB
-
Filesize
4KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
8KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
8KB
