Analysis
-
max time kernel
121s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
10-06-2024 11:37
General
-
Target
VirusShare_5ef1fdd422951c153db8c39b87e84e5d.exe
-
Size
356KB
-
MD5
5ef1fdd422951c153db8c39b87e84e5d
-
SHA1
a89966004343653b2d20c06b373b1390ed0450d3
-
SHA256
b5a35f6dc7bc0708cfa5b5fb39472509eb81c22ccd93bdb563305164381a1d3e
-
SHA512
94a775ab67babe692fd6cc6c597453f3607e39627579ec82575025a1c1aa3015a108418852a64d84e4fb8c2a5ef4b5619284b25d52a5790b5e3ef11153c11871
-
SSDEEP
6144:nOWcl+ocAAe1EAnT43osv0pnzKK+PDncAuLELquaWVzsHA93Wo8nswPm22fwh:nFeq0F+PzcOLyWRsHA93/oswe
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+ovqqg.txt
teslacrypt
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/B48242B6AACE1235
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/B48242B6AACE1235
http://yyre45dbvn2nhbefbmh.begumvelic.at/B48242B6AACE1235
http://xlowfznrg4wf7dli.ONION/B48242B6AACE1235
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (434) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_5ef1fdd422951c153db8c39b87e84e5d.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_5ef1fdd422951c153db8c39b87e84e5d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_5ef1fdd422951c153db8c39b87e84e5d.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_5ef1fdd422951c153db8c39b87e84e5d.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\ejblvonofdil.exeC:\Windows\ejblvonofdil.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\ejblvonofdil.exeC:\Windows\ejblvonofdil.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_ReCoVeRy_.TXT5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\_ReCoVeRy_.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\EJBLVO~1.EXE5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE3⤵
- Deletes itself
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5f806104f32ec390c23fbf3ce53dc88f8
SHA1817087513203df1a34726278014e66d2bf56b521
SHA25682286cdbf12f26e3676292d232b24cc1e53c0711c596e753ad0f6fdcf359d683
SHA512ba3c4fe26dee096f6fbdc301c40458f9fa724a3817fb31fbb262fbeca8e7a4ca628e4baf7e4d5290f09107aafd4f759922a96536390f4a89021dea670989147c
-
Filesize
65KB
MD5883e59c5a65ab74d3fbc78b64a09af06
SHA1c1b98e30d75f0837a2f3f03be7a0da8b3e195f82
SHA2567fbecf3ee7c29dec03c83ce6f6fd0080b62e441854c9f62981c2cbcfac75ef1b
SHA5120d0ec219108b9fa910c7c3d598b31b5137813f2b1f26ad2d97990a1de306d4f2a49f3eb068b5692a45c3de20b3f28c475b4ac083b5b28d89a22de12f9911f70d
-
Filesize
1KB
MD5a7278445f71dd0fab0e77eab54b33a9f
SHA1d4aa122611360f19aac37e01f2df6a9524159bbb
SHA256cc6f8450a39a676c01588890b5456c620a7f37f01dd00ae580b90fdea7f8a022
SHA512db002f4494d2d892e1f51a4ca6f5839d3edc19f1ccd912e0abcf2aab0106af8cc36168bc8506681ec3c2084b1b86a0b2a48729a020673a9dc93818b9d74d0593
-
Filesize
11KB
MD586792bab8dfb72dfa9eb6e585d4bdfb3
SHA130ef8dc82d95a1713d5f73ee29e66f5c2d9a882d
SHA256f57ae6d857a58f538d88ffdff0467c9a5a9e05dae32f5ef235c2c94357beccd1
SHA512f02125d1d82e9710ffd5f1e1617215b4c07a01bf44ba06f0552e61de60ab84ea7e754d1a2e0a66ed252ef6115e7c67d9745258a427761d56dc98be5b16ece11c
-
Filesize
109KB
MD5fe5c2904fffa2e9780016c3ad6c97b1d
SHA1bd2f5c64c3fa5ad30131736e45c2623aae0f9487
SHA2566c3f484571e27712fafa03d468d0a41c0661970f06abedfb4f46fdc38351d9b3
SHA512a1867bfed8e436b165fa37207a5fe9fd46dce1d89e7459003f23f0542984030c976ba26d41840bc28a8038a4005ef625561df6f9d38bd92792f970c710afb715
-
Filesize
173KB
MD5e4c4f8fd68065e2b0e603ed6fce3df46
SHA1d8382ad92776cafe5b471c0dfa02bf8ea28c24f9
SHA256d610e8c708e6222ca36065dc160dfe3b55f284c0cb9b03cd2cc9e19d04cdb720
SHA512fc52c778366f52b7352e6ae4c4ab145e98d0c5f6a7b76f8d6387a3982de4ecc76767e6a68d5a770d0cb4d668d862c1a05eaf10b9e39cacadf590b5e07b588d1d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
342B
MD576c63a9681415e9930061b53997a5893
SHA1e8a5ed535055d6fd4f42cf39757a6a6a1bd4b30d
SHA256eaffc78e997d15b685ac2686f9c159cddc9b5f82cd998c60a0d7906266f0311c
SHA51264062105e2527de2e1df1e16971c5dbeaf52a47948b1964fc26b54373bd755a26131b0fd272f10f2e427f2b2a927eb59c079085f25c7e2c649e8add0b5563e6b
-
Filesize
342B
MD592d79134b0fe07a861914dc93ac588e6
SHA1a4ff2b43888c5befaab42911eaa8004b1f047e01
SHA2564f8b1bf23e908ab220ebae3923e7fca967bf0b4f3bdee3934de5a2f593f863dd
SHA512cc14356d9681d2b634b7d0fcc2e315fee5bf9500419ad0e3a793c54aa3c2dc6a714fe62eac2281a799c6c1349fdd8d5ee6d452c01649597c3a84b0f2e7fa13e7
-
Filesize
342B
MD5e6c042dcb1bfc22e6c47ab037a4ebd07
SHA15a8b9ea414bb94ff1d3b81c5cc4a6d28fc198fad
SHA256ae3899fd7cafa2cebd59ac7dce26907183e274dedeb3cd7dd883a657dc4e9794
SHA5121b9b7163df7c36dfb93b2e4a2095ae58239102585dae55b5e432d0ba1e6083610da1ed3c06ea903d772c3eaee9712df95065e70ffc8951966c6fe0d623fcfa80
-
Filesize
342B
MD576074917bec9edaa2d7b028c416d9f6c
SHA10e6f785e437d3876ee719d4598495868bd3398a3
SHA256924aa05db4c2db11c38caf7009c917ef0902cc0f07d87e471a9333775a4eaca2
SHA51214873d681edf6ee987dec8f5432fe2b6f876a51384abdc684fa228305b3ff295912f941382774ddd3f0c93b9197f89399fd4b9f62376dbbf014d7ac74dc93a21
-
Filesize
342B
MD51423c6be00ddcb3ef878f94bf24a9cc9
SHA1d0deed9a369b40eaa408d23ca46e29e6c13b1497
SHA2561dba170819d1873ea48554207948501a0f21cce04960bd6d76cf827d26b10b88
SHA512d1265bc4b91a80e5b5bc743ca3e5a355d352b8c481d08c031ad56d90d94fd8409b4bbb680e2a32243cf581fbff8dd48173814830be8f94e97b96b9250dd445b9
-
Filesize
342B
MD5b823b5739d6b089e7ded4564bcc1c983
SHA1ecacfda07fadca6fb0d3e61754ec3acb19a7eec5
SHA256c1383417db9cf30e9c0ad9a45644c0d4af745265663e870fc7e288106513d1dd
SHA512b2440795f00204e86fd6ff9fb41e1ee4131d1726c3a930ceece11fbe49e515f9f29a8b775e500b79fe9045c09065c10632e5f6d05b17b02942e6b349dba0065a
-
Filesize
342B
MD5d2950f26787f7c8a6418c98d2cde05ee
SHA19e18ae32de0cb2a6b3d5567ebf5ce67399f3b9ef
SHA25663c9ead02680054b049c1755f5939c06aaf80abb6b387dd87cda47ab0511e41f
SHA512c8ef57784159b8ba3e5db992eea190444cabd4b788fcecc6efb90fda2b3d2f08e6d679d3103cfe9d9110af59ee0ddfc3b142b8e29f6062e8e4a7e99c3417f1d3
-
Filesize
342B
MD541bf19b3e600d7ed42b9627c75f30dbe
SHA141c966a801786d6a13d6ca71598a90a1959da5ce
SHA256b02e350b69fe2237a77551dc5d2bd7241bfeca26b03eaf94ab4229056ddd45db
SHA512daf53cf1946bc0333004b2e15ebaddd1bf886b027e547b7a40692dbf3f433286117c922c56ce7a19819b7d9dd799feeb5da77bf97fa308ae98388e9290d29741
-
Filesize
342B
MD580046986a845b27ed993d416f0dfdf9b
SHA134daa4773ac64221fc6e5f11704241ba83f33391
SHA2562d64d00a309fe5dbb45eb29c437cdca923c0cf9930b077bbec910cafb322ffbc
SHA512ec1afbc251d0b4726ad1889ab4f8c06f8aa7341bf985b92ea29b893750bc45dee4efc0fc310408b639d1f54d297c38d66ada5e1f16f2ffafc1c3e4dee6c25dcc
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
356KB
MD55ef1fdd422951c153db8c39b87e84e5d
SHA1a89966004343653b2d20c06b373b1390ed0450d3
SHA256b5a35f6dc7bc0708cfa5b5fb39472509eb81c22ccd93bdb563305164381a1d3e
SHA51294a775ab67babe692fd6cc6c597453f3607e39627579ec82575025a1c1aa3015a108418852a64d84e4fb8c2a5ef4b5619284b25d52a5790b5e3ef11153c11871
-
Filesize
8KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
892KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
