Analysis
-
max time kernel
122s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10-06-2024 11:47
General
-
Target
VirusShare_8736b31e13bcd6e154dd6ad39b839f8c.exe
-
Size
384KB
-
MD5
8736b31e13bcd6e154dd6ad39b839f8c
-
SHA1
9135b9746cb37636cd26cbcc73ffd0451a34b426
-
SHA256
5207a70e0e818741279d7c25c0d9cb6be136a4fc8ca8fe6f48112c4d0572d64f
-
SHA512
1f8a4ca3b1d33e6208e45c8f42fa1650dd1b97162b499053cc45c034dc87f4d03448a4289d9efbc64bd0e135b7cb597036311dd0f5c763dd6ced6f36ac6a01bf
-
SSDEEP
6144:SeVGON09XRWtlggcMOEqmgWqvANwxcLSgL8J4bAvtqjPtW6wU25vB8ynNd98UW:gON09XotWgOfmgLA8cNYQAojtwU2xnv9
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+iqbsr.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/C741841C63B4E915
http://tes543berda73i48fsdfsd.keratadze.at/C741841C63B4E915
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/C741841C63B4E915
http://xlowfznrg4wf7dli.ONION/C741841C63B4E915
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (420) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_8736b31e13bcd6e154dd6ad39b839f8c.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_8736b31e13bcd6e154dd6ad39b839f8c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_8736b31e13bcd6e154dd6ad39b839f8c.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_8736b31e13bcd6e154dd6ad39b839f8c.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\nxiwcsktuxob.exeC:\Windows\nxiwcsktuxob.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\nxiwcsktuxob.exeC:\Windows\nxiwcsktuxob.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2408 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\NXIWCS~1.EXE5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE3⤵
- Deletes itself
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD53028c9ca832fedb89174439b2681fae6
SHA156a4266d92f9250e8bb96b9389760bdc142c8644
SHA25678f8b243691996f77c98c753c862e7630cfa334f38e5ad36147e9b04a9022159
SHA5122130b59b6e07d688c651337bd0d4c1186f63dde49f419322c185d44bc0887e7493d2dce6432d2b100ae37391c18eed77a8ba2cae4206f6af4bd69754b7a3871b
-
Filesize
63KB
MD5ae360914e68b77eeb2c49e03ed9899c9
SHA152ad1fbb476eea71672adf7524ac36642d46ec9f
SHA256176cb41127379216a16c5cdcf30e6fa15822f048e398b02e432bc32a8053513b
SHA5124b5f9de08f8ce58cb522c6b2a263ec53de4a81ecc8d96435a8e949259e3b5a6afce2b5da1f642066926e3a6a08a39e5547a132684514f06987c114d896aecb06
-
Filesize
1KB
MD57f9b9011c52ec4fa56657a65c24fa691
SHA140d74d879fb520cd54070166ba5f24185db36fb6
SHA25668736869bbf9dc852ca492404c24d283e7a388b83ca160d99351fc4bf0df6bc2
SHA512bba32ccf155b43452b2bdbefa2d369a0e2f57488f7b147abcaeceb1bec06e91515e092887c645ccc5ff3e7c470c70d7422acd252abb647b83df008abf735bc9c
-
Filesize
11KB
MD57526944cb58a6af72c553f2b8734698c
SHA130fa9d1709037acdfded054eb0a4bcf27361efb1
SHA256adb6ffeb10ce327d4374c2b8f629176c885894afd93e9089555cceb4928662ac
SHA512b9d9be2d9813ce1b23148e060e458ed9efe6d20388408db7db262fde183f9cbac1fa0851e81f9863e26fdb743e481a350c5e5a4edf497d12a3187ab07d32669b
-
Filesize
109KB
MD5607164d078d9eaf9d4b67c62fbb5c6d1
SHA1fa121b6e3966b865abee5f3704413bc9d4a43c3c
SHA25633addfc56538eecdf5361758c392c7448c6da73c80c7c5d0beef93001173a292
SHA512359cf96bfd0f0b23b90fe0350b7465d9d01fd5af14f56846f3534bcc76057a007b97bfcd2133360d0a98cc937a29937b568d7b83f48c4107de72113c184d1fe0
-
Filesize
173KB
MD5951d112787a65121fc22a6faf3141ed2
SHA11833cc853743faf2cde1e9db397505f282ba63b3
SHA256d69e85f1929b986de76749f37e755b842a55e5cc5eba9c56ff15bf8751536851
SHA512dd0a9860eb3803c3e9ad68c57d98462dcc12094c974b37ed922748523aab678c1c0d7850f70b04318a29d5ae822a4698a4a1748bc8830d9fbc2d26bb4e731bc4
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
Filesize
252B
MD5c892a0d23d1d875da102cfc54c12c34e
SHA195b56b7549ec807d70a8beb941fd46eda068c049
SHA256a3490c43b362eed53f4baa8770fc97a3c806984a4d0a8d223b616b9678691f19
SHA512842f8bec3c4aaf74d2ac75aab77558a5c021676c71a6a322e92dac4d7996c2f48cc23ee36fa9690b2cdc493da264c21993f64a6c24ff92207e9dcf9b1ceafec0
-
Filesize
342B
MD50a89f39e68b55ea324b78974f26f0ed0
SHA148dd3e88add5a436728183aba70decf5d39de8d1
SHA256fe3e01bdbe94b8946b7a2bb9aba1c03b89f746e213cc0a18b156dc470fdfa4ae
SHA51299d35b254a686c7eb97f7159c9bc6b5a29d3648fb6fcaad872fac95670d8ae7efd1b35a7e5fbf87cd9cf4e2c9abc2817e6de92cb1ed3b15d9ec2bd7fafa4a745
-
Filesize
342B
MD5c47840d589317fdb577b684ad075c1d9
SHA10df2fddbaf446716791118e28781c609c0d50033
SHA256411051355b273ce50a2f4d5ced0d5cda2ed416ecb8df9c0862d91238b6cc49a8
SHA512c7339f8515f6a06d8ea0f6137d99bf4ac213bde7dc07765e3019716b514554383cdb4084f43bf9cc08009625e18917861766f5de89dab02b84ae1a00e9dd8e34
-
Filesize
342B
MD5718267e21670615eac192f97e3bf2fba
SHA147e4e853a54e6a9b0fa5b75abb0d950054e953f7
SHA256e1623a999aa14694f113686e839e2affed6193e56c23eaad7b0ae271a949fa55
SHA512ba115796a3f0a4802b7b320b50c274c5f826a75915889c8f74028ac5ce4dbfc5cbc1608dff7f205b01cdc34366b8a44de34e3352322eb3f2b3a431a47b612dbb
-
Filesize
342B
MD550a303429e533d8722112aaacc0a522e
SHA13a296cdfb4a30cf33ccad215e0a61b921356c95b
SHA256dbd6d3fb4f6920ec2690e304132ff798bb048897579a2d1e3dcd37e63d35bf62
SHA512368f6031ba7dc70bda82a94295bc3195ac30121bbff54802e30ea959322f1414abaa74dd1a2e3d917512e1048de4f26cf08a6381698275c03d5a2684978963e5
-
Filesize
342B
MD560b7283e7ffa5e22ec7439d3dcd1caf8
SHA12355543d0b3b1df013b919c5efd2d7f6a5032403
SHA256c0d2a8a475b60ab2311ec5b80f87a8a5698fe011f885994d26bbb991bb0c52f7
SHA5126d85431ded2aa6b9690d58c4e6ac99f2f50d0e50d128eea67f9a75f549cb9432c7616a04641cf41473b46654fefcc88b4995411c042491df2c837b076f959df4
-
Filesize
342B
MD5dcb562aaa65e9ec19cd9ef412c285fe4
SHA1a986d3d422f926a0f60fb4b3503aca2452408fb2
SHA2560368fb542cb0cee6831cd4b05634e561412f4dd1ba8cdfd60600d6802d612793
SHA512f48675d03d7d5322aec3e7d1e937509d98453b980c3340b30d36fcfc2e78565c8531311837dcc1ac3fcece8dd481664e6cdaab1105def05dfbf59afb366839b8
-
Filesize
342B
MD5fc98dfebbb7eb49dea602a828ae9bdde
SHA1ef046ca83ab2291aa79164c18197f3a31a6c5426
SHA25672902b33db484f7a35c8299032d2ff40d0de45fee319e7e95fcbaab3cc26d566
SHA512fbefeb7ce014936542fe7394f081f1b32f81d12f1328589e315bc3fd13ef24882e6cf8b1795799fa13e93d33f3ad3e08fcc6db0163738b2b8b5f3f6f3f68b512
-
Filesize
342B
MD542ea93f4ecf4e7cc0d1f85276a0b2b15
SHA1b2a83e3c4393ffeaab1e2dcbae0004f5e0a01771
SHA2560eb3a1388d9850a9e775da69a1a1fd41f6884785977b2d5688c5d6b5db7929a4
SHA5122000cae53e20830a6d0b69f4bc36dcf179a23e6ff9ca97bce238aa78792a9ba8a32e601674feb2cb7d37d98c96e930f54dfa2f7e42f683c806941f918172f095
-
Filesize
342B
MD543a7ba3433011707df2a98af9be3b5c0
SHA18746973a3ac0a5c2fac3c3967489dcd9fbd42c7a
SHA256db10055dae40fa7d27285f29dd40e03d4184c5ce84ae0c444d9c3a5c7b97bc49
SHA5120ceb0a97713bd54c710126e59dd713d7f03405489507ec45ce850ebbe035011617da8a597e2cfe3976495e0c1a9ad275d4c2e8cdd07e655788c06d9880c8d4cf
-
Filesize
342B
MD5e603df0a52206781ffde26a79415f902
SHA178bf80e9dae044d9448189dc339446d758862d03
SHA256109de35e0e1c78b52594e52884ac9ec04923bade45e06e65ad6da4830ddc3a07
SHA512bdca799906e0dd68bb277edbd7c3327184a4e154404bb0f886c851a1fe787fc913b5d1a7163302e306caa32f459dcd001f216814e9874434d40de87445cac661
-
Filesize
342B
MD52cd6437535847eefce2462d0321da8f9
SHA1b0a0724c637907bc263b0a054e9b72dd5eaf984a
SHA256007201eaa00bfb3e98e335d10e013ac5a6a508d4860793d6c09efc47a5ca4a39
SHA5128c7817ec5121146bac3e27a49c3c603cccb02c62052ff8e551bb799a5ad6fb14234dd31f9305c56dfd8c50141311e0a5bc38b94ca7b291cee76b75930767f916
-
Filesize
242B
MD531263a15c3105cf1f229ea5b8456655a
SHA169cf0b7124e62471563a2779dfb4b7abf9b6a3b8
SHA256f40ec02520ede447bff9cbd572f021167daf517cacd2d37485dd1535f5f885da
SHA512344fee3876dbd7cebdddafdb1084767c8db23f3d68824eb501be9d62916e5ec1d14934a3f12207d0c2eac93cdcdeeb0b238c197ef654c5c60a3db843717975ac
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
384KB
MD58736b31e13bcd6e154dd6ad39b839f8c
SHA19135b9746cb37636cd26cbcc73ffd0451a34b426
SHA2565207a70e0e818741279d7c25c0d9cb6be136a4fc8ca8fe6f48112c4d0572d64f
SHA5121f8a4ca3b1d33e6208e45c8f42fa1650dd1b97162b499053cc45c034dc87f4d03448a4289d9efbc64bd0e135b7cb597036311dd0f5c763dd6ced6f36ac6a01bf
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
8KB
