Overview

overview

10

Static

static

3

VirusShare...61.exe

windows7-x64

10

VirusShare...61.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10-06-2024 11:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VirusShare_7bc8e9eb9f3d874764d2658b546abb61.exe

  • Size

    356KB

  • MD5

    7bc8e9eb9f3d874764d2658b546abb61

  • SHA1

    40b7e79add5449ac8b11b20ddeb338437a0d17bb

  • SHA256

    d7a54e392cc051e8fae6d26431351d405fe9836e9467bde07187a8586e0e4fbb

  • SHA512

    2f633cfd7194a11aaa68b7d42a31e95700d908a5af4c40616427d78afd5bebf56f0a9233bcde1cd500540bf5d553e5320aed1876a42dc934d74e1de3f7a7439d

  • SSDEEP

    6144:NOWcl+ocAAe1EAnT43osv0pnzKK+PDncAuLELquaWVzsHA93Wo8nswPm22fwh:NFeq0F+PzcOLyWRsHA93/oswe

Score
10/10
teslacryptdefense_evasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+drktp.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA4096 More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA4096 Key , both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1 - http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/2721871E9DAF9F3B 2 - http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/2721871E9DAF9F3B 3 - http://yyre45dbvn2nhbefbmh.begumvelic.at/2721871E9DAF9F3B If for some reasons the addresses are not available, follow these steps: 1 - Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2 - After a successful installation, run the browser 3 - Type in the address bar: xlowfznrg4wf7dli.onion/2721871E9DAF9F3B 4 - Follow the instructions on the site IMPORTANT INFORMATION Your personal pages http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/2721871E9DAF9F3B http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/2721871E9DAF9F3B http://yyre45dbvn2nhbefbmh.begumvelic.at/2721871E9DAF9F3B Your personal page Tor-Browser xlowfznrg4wf7dli.ONION/2721871E9DAF9F3B
URLs

http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/2721871E9DAF9F3B

http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/2721871E9DAF9F3B

http://yyre45dbvn2nhbefbmh.begumvelic.at/2721871E9DAF9F3B

http://xlowfznrg4wf7dli.ONION/2721871E9DAF9F3B

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (374) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Drops startup file 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusShare_7bc8e9eb9f3d874764d2658b546abb61.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare_7bc8e9eb9f3d874764d2658b546abb61.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:856
    • C:\Users\Admin\AppData\Local\Temp\VirusShare_7bc8e9eb9f3d874764d2658b546abb61.exe
      "C:\Users\Admin\AppData\Local\Temp\VirusShare_7bc8e9eb9f3d874764d2658b546abb61.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2664
      • C:\Windows\mnuhiljpctap.exe
        C:\Windows\mnuhiljpctap.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2072
        • C:\Windows\mnuhiljpctap.exe
          C:\Windows\mnuhiljpctap.exe
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1732
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2036
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_ReCoVeRy_.TXT
            5⤵
            • Opens file in notepad (likely ransom note)
            PID:2676
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\_ReCoVeRy_.HTM
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1804
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1804 CREDAT:275457 /prefetch:2
              6⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2176
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2084
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\MNUHIL~1.EXE
            5⤵
              PID:2512
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE
          3⤵
          • Deletes itself
          PID:2444
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:808
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
      1⤵
        PID:2096

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+drktp.html
        Filesize

        12KB

        MD5

        399228815bfaca67f985f4e46614c0a1

        SHA1

        9256494e98de6d7857796d530b5e66290b5f65ce

        SHA256

        bf187bd8023250b364c362761a21271433224d839b6e84fd7e033bcb97f1a5cf

        SHA512

        1515df5cdac4b7e481dcb8ad36e852957bbc8c56898816ed6a82daf3bf2d98697d20272eaa5c2abc8cd726960cf34e872575e66fecff7afd681213a707029e5e

        Download Submit

      • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+drktp.png
        Filesize

        64KB

        MD5

        a2e4aba0ee9eb09364a5009e9a237ccc

        SHA1

        2fdd60827a4da1859c64717a6cc002bcb593cbe2

        SHA256

        a9d34c8ea70e1b2e6949a734b7b67628d6f91355a1cd38b6a68a2395f7549e9c

        SHA512

        ca436075d8a05b8d4df0c0d5b6c5bedaeb203de8ea81dd8eb93ab50891c049fa5738da23e20de87a52f081540b31955c92ff478927460edffab2ca46c8dd2183

        Download Submit

      • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+drktp.txt
        Filesize

        1KB

        MD5

        675184fce783f30e10aa5f1c02f86737

        SHA1

        96ddd532e4ef8798e9241fd60b2b561e13843dc7

        SHA256

        1b320954d45a60b31e20bfb48b140fea996d1434447f190505e2fb65cfc92ea4

        SHA512

        e7bf336c669661da017aea1a4c583f5601b45b1ce44a66b0dac606320f6a0cedb8ce855b50ddf3f7378d444afe592468627c42ec593f793e400d5ec132058970

        Download Submit

      • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
        Filesize

        11KB

        MD5

        4a035a796af123cf39388d731a0b6315

        SHA1

        9baa736b64f630fe0efc26c31753461c2bff2ba4

        SHA256

        c4e0e17ebf5b57f11204bc7f43e70a740d8f5700a644e2dd9268547007f28ac2

        SHA512

        d8e2c3d3c0a13956b66e77facd97437f9dffbdba377813eb798a20efa6aa139e67db67ad0b29ae7d880bbb17de8b8a823746852baf75b8cda9048b0a233c52c4

        Download Submit

      • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
        Filesize

        109KB

        MD5

        ac69bbf0dfeacfe418fadf4712c65462

        SHA1

        bb8720e247c1f11ddd93a39353f26b4ce7b87f30

        SHA256

        52ad88d3bb855cd0e94a81f5623e75eaae0e1a9437ddc8932b13f6aa8fa390ba

        SHA512

        39e6a1db16ac369b5e7101d77632337ba598f273ec75af688e13fb6eea2bda52bf58f8bb680dcae2c0e0b9c8f3f6480adf134d74608259dfdb40d9d822602379

        Download Submit

      • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
        Filesize

        173KB

        MD5

        60ec9819b47ec9f6fe088a0f06268359

        SHA1

        cbafc113ea834bd110530fa6f879a1eb6d5e7202

        SHA256

        6d6b7befcc1372e1994c6961986d7ae1c0cc06c47f9dd7f940d414d5162d27b6

        SHA512

        876fccc4c52f26e35bee6822fef3895b33db3335942869898743141bfd2107720da7fb2d97a0f9cb29373a10e4e3d11c693e3ee71580d790e6cfc12e56195670

        Download Submit

      • C:\Windows\mnuhiljpctap.exe
        Filesize

        356KB

        MD5

        7bc8e9eb9f3d874764d2658b546abb61

        SHA1

        40b7e79add5449ac8b11b20ddeb338437a0d17bb

        SHA256

        d7a54e392cc051e8fae6d26431351d405fe9836e9467bde07187a8586e0e4fbb

        SHA512

        2f633cfd7194a11aaa68b7d42a31e95700d908a5af4c40616427d78afd5bebf56f0a9233bcde1cd500540bf5d553e5320aed1876a42dc934d74e1de3f7a7439d

        Download Submit

      • memory/856-1-0x0000000000220000-0x0000000000224000-memory.dmp

        Filesize

        16KB

        Download

      • memory/856-17-0x0000000000220000-0x0000000000224000-memory.dmp

        Filesize

        16KB

        Download

      • memory/856-0-0x0000000000220000-0x0000000000224000-memory.dmp

        Filesize

        16KB

        Download

      • memory/1732-55-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/1732-373-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/1732-5852-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/1732-5855-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/1732-5846-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/1732-5847-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/1732-49-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/1732-50-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/1732-51-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/1732-53-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/1732-5843-0x0000000002770000-0x0000000002772000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1732-5837-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/1732-5365-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/1732-4383-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/1732-292-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/1732-3210-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/1732-768-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/1732-2154-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/1732-1285-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/2072-28-0x0000000000400000-0x00000000004DF000-memory.dmp

        Filesize

        892KB

        Download

      • memory/2096-5844-0x00000000001A0000-0x00000000001A2000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2664-12-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/2664-4-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/2664-16-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/2664-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2664-19-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/2664-20-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/2664-8-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/2664-29-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/2664-2-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/2664-6-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download

      • memory/2664-10-0x0000000000400000-0x0000000000486000-memory.dmp

        Filesize

        536KB

        Download