Analysis
-
max time kernel
123s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10-06-2024 11:48
General
-
Target
VirusShare_8c23e7c480280c24c6b34c9c9bafc05d.exe
-
Size
396KB
-
MD5
8c23e7c480280c24c6b34c9c9bafc05d
-
SHA1
de75bf5f2115fb3399d2c94966218f91dd9c2362
-
SHA256
d898a79292edb0059156844e559cf65ab68819786b1d344dec42993851751740
-
SHA512
04a631fbd1a3aca23956e316716375a77328471025f8391971aa33315ad8245419231f3b9b95229b1999c24c240ae97436ba9fcc3216d1a5b63ff75de9e9edf5
-
SSDEEP
6144:4T3WR0F1lDPR+bJnm/jtowhxZWVrfQwBcTMMG26uw6fyQ7Q:4T3MA+bJmy4ZKfQRMh6
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+kihme.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/B5D1AA8260558471
http://kkd47eh4hdjshb5t.angortra.at/B5D1AA8260558471
http://ytrest84y5i456hghadefdsd.pontogrot.com/B5D1AA8260558471
http://xlowfznrg4wf7dli.ONION/B5D1AA8260558471
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (429) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_8c23e7c480280c24c6b34c9c9bafc05d.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_8c23e7c480280c24c6b34c9c9bafc05d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_8c23e7c480280c24c6b34c9c9bafc05d.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_8c23e7c480280c24c6b34c9c9bafc05d.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\hyuernnclsmh.exeC:\Windows\hyuernnclsmh.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\hyuernnclsmh.exeC:\Windows\hyuernnclsmh.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\HYUERN~1.EXE5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE3⤵
- Deletes itself
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5e6f808d818cc3927b5ff279afc7a640c
SHA1fe62cea942c2846203ba4222e67e2b61a96e6f9a
SHA256739aa2789b36a1edb0e19e1674e85e9e7a8937c2b0c0941ca37a0f9630cd5b2f
SHA512c5299e38476aa75623110d1790688914ea1cc26b601e0dd8fe8ac5811177a3f0a9a0b3b6658109978ab2e57435f21a0e77e65660ddbfadf9227f1a8c09e60d98
-
Filesize
63KB
MD5e0d26677e7273696ab7df6171b8869c5
SHA17d577dfcc4b184db16d0876d37d838b079d82641
SHA256ff83a227977e466c191150d9f499e11764bc308793d913fdab3b75ea7166a497
SHA512d162ab5e20534597925e58a0602e6c02094e028fa0a360a5897c81da0cc8c9065f9b5cbfeac6a594ca941432b7cf3f225dbebcec6b4faf92deb00eb6878c9615
-
Filesize
1KB
MD55cf6c35a2c3a017f84c99bb5c0cc4b84
SHA1067e8c269f2e9432ad720b102c624c22de3730ce
SHA2564f710c1053e537885600cd50cf2a11343785ade289f25ea1589719c871b04fe6
SHA512fc30bea06e1c5b8610d3727ef1d9c1deaa4a3330d7a40f48cea0d3fa8412fa2e434aec5f8953417153d59d8b740fd4e22b39593a71d4cc95889fbc7a25613aa8
-
Filesize
11KB
MD5963bdb41646d4a29c162c1ce09325dcd
SHA1224751bd89f41da476bfd8a2afcb9e38a7cb6789
SHA2568f73bfc9216ccd2b41c4a3144ce117a65e95a25c463b6a065ae5c7127b1c2f39
SHA5123ddc869a988c722ae24b994edea15d39050791968d4fff5b96f390bda2ea76eece40fd7f4da38206733e52fa75218dbc20042dff0d69ffa4b7bad2f696246280
-
Filesize
109KB
MD53643e6dad41663769f1c80a4ec4cd93d
SHA1fb49e2eeb3e56b5c24f0f4057aad4db4a7a1fe23
SHA2564ef0993f1abc6739012c5a9eb1e9f2b93fc09c7e430779c8e06c38e29aeb3fdf
SHA512c1b252e999bb20686648c36e208da3f8d1ed79ca52dce6874c6472e1a4c2f718a2e811aa806c359512479a5db79dee2591a7bcc399da03f49514625c1fe64ff6
-
Filesize
173KB
MD5ae9152eed841debdd30226aaff62b5d2
SHA152d0b4aeae548c5a5f607fdb0b1c80c0bd4d55a8
SHA256a51f04208e643da8e346819070dcfc758f63d0541429cfb699aa1045098ccd9b
SHA5129ef9a661add992ec2a931714ae9cab4ba2aac110a8eeed2ee964bcacf9b15c0c1d8c7a4634b53df9c51a637316e1694c6526495aefcab30a6344deb403ee21de
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
Filesize
252B
MD5027e7bc49f9f7bb57f77ccd7eeaf1004
SHA1055b0c72ea17bc918863f8efbe2f2472663da758
SHA2568b4dba42b20de0f49b6e7e51dfd596afd26066793d742e3d1d547a49a0acf387
SHA5129b5619bda7c66c34e855c223e7fa3e307800c68420ac67d201a3f1b7d0bc832b6f6060d648731df2692af6c4d4388565807ae4ecfd9e3f927692bdf12c4e75d5
-
Filesize
342B
MD5b357f4c3c89f9088c67d959858900c93
SHA1d10e4142d9a6421aa9a0cb67326f1d2d25545c12
SHA256d7c8152b723fcaeb84550c2732cf72f20bb9a2c27942fcdd55ae8129830bc821
SHA512d97fb9f8451ae454f411027efbcbceb72497e672ee42d37973937b5324658c85161aac38faed11dfe013d049ff59bd8e843994691ed1c7fd9d8a2e41e07d1469
-
Filesize
342B
MD587e33c75521eee23222c854d4424c6ee
SHA1cf59eb9136696ebf893a307c7be6d405968ec202
SHA25678d1266f63f8ddc1a118e6c916f01a18afdabcfb72fe0f073f953e62909ab594
SHA512296f0218080c8c21265f9a7c57c04724efb086bdcebcc1af527ae4226ad174432170349dea9f03d3deeff248df0c025543f55fad15de8f167f38205fbb03dc87
-
Filesize
342B
MD5e44df39630a9c06472a02a21349a9a18
SHA121dac6687d7f9c4930f68a89ab4d3f89a19b385b
SHA2567f477e1226c6cea5e978548cf7d83cc39f9ffb7f29cda7bf5dbcde1ee9db4839
SHA512b36206fdae94cca802f91aa384cc80bfb6ee1b8fa6f52edd5eb83bfbd173018053fd56c9b35141d13b2b6e3d3f456d4682a32218b6afcc5f7a1c26fc59a2a25c
-
Filesize
342B
MD5007a163f998cf6231f603cc41c0e098d
SHA17ea9c99217446d36a1a89d78e66943bfa7252e0f
SHA25603685fe8c0cb8dc5ee96eed77c7aca66cfd3e2ef0e0ea0bfb0dcbed1aefece4d
SHA512d7fc6906f9359fa421a6944486310e59291b9983654c84a993db7e288a01fb7db560fc9c49c0503aadafa725e8ff364ec3ce84a0be1f06df5ac6ba98bb922300
-
Filesize
342B
MD5ab8075135be5c2555c6c0ef77c293313
SHA16c3fcb3a07f22adf194794a2c4ce807cc23a3955
SHA25628923d6c4ea8697da2202cc51325e787670c445bbb3a2b60bb4c9543075cdfdf
SHA5127ece34c480d9ed8f476339e1331fb6264b39f780ce6fcffc231bb0b3d457fcc63eae71e2a95f7aa03dcc6ab991188071f951d8cbdd1e55230e5bed96344acaee
-
Filesize
342B
MD50e9f5a662b545362babdb162826cc713
SHA158ccf8034e737e7bd27e34816cb8306e95d18385
SHA2561b324a955dbb3f6fb294a4e8e3d0f483682901554740c2f9b90c5d509dbce027
SHA5126463c4532ac7fdfc030c0d467b8f4c9edaa1e774f4cf5465724f307eccd5ca16fc3722e309149a49f55f6610333fe723ead8462135d80b471b1aa13add1cb78e
-
Filesize
342B
MD517751167417fabf4b8cdf69d947ffe7c
SHA1d87d6a4c8ca26c9538856aca137899ed98c5b211
SHA256b27775a9e0180e323aee873c91c1e5eeb9da5a7841dc8867e0ccc13eac13f2be
SHA51295282feb7845538e6b80dc127f6b0f7558b826dd0717e126578f92d2020ce42b9911e2d3389d38d38d0c92feb553e6e358eecc87dba0c7848ca67505270dcf94
-
Filesize
342B
MD592dfe39535ba80dc241ec057ded30e35
SHA13931a51445876c447e8c35d687379540e2a21a0b
SHA2563926057d3917c6abe6b63918f858436768214ea961c0f4f439f1429f266e4182
SHA51203540f91cdea439d52189ea38bfee0f62e3bf36e81af5baa627f86fb463e9de18e3efdf60bd6fd0bb3662488c798ddb675bd8babccea2447c7ebc6634e7ff1b5
-
Filesize
342B
MD5ad00f8d78d9a9678a170441b0d9b8c5c
SHA1003a7fe8f5e5bdb5193d0a214b8e4614d004830c
SHA256768a4f0730484f2939381dcf47855c1bb55358e8016c0e0ab59b539393f1ff42
SHA51244f47de65b141dc099f50c9cc0d628b43dd59b908175d79e5a59896607edffb903e51f1f8724f5e253c638f277a895d332bd899b2b4483147fbc2ea205f5afdb
-
Filesize
342B
MD55ee38354261b84f1efe1e1f636cb2448
SHA1b076080d73e0f1ffc2f6aca85db178aba4e89efd
SHA256309ed1e313baac6cd421a5fdaf4b74af49595f1c061a1c46cb27be4ef2c11df9
SHA51210e48e376d7606fb23f11220defafdd24b3e8b0b63d0d3a3707f113dea537e183c89ebe7c413e74f6acc74453f8ac4cb8939f41005e78fe23d8e6dbf25709c9f
-
Filesize
242B
MD54a32f0ff2845dfdd1f2ebb82083bd4e8
SHA1bc1d6bcd014f02afea5f091d6d10a64f508dc1c4
SHA2562cc4b1147f957ec607b75cacd4c8d5d8c0d539c5a5a9f6a2c736c95666cc9fb2
SHA512357687332d1c51408507c7a391d380d18ec514fdefadcb02193f66837636c5df37102472ded16fb45a0d63f771288653c807fb455a49b9350f2b4d871700ab6f
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
396KB
MD58c23e7c480280c24c6b34c9c9bafc05d
SHA1de75bf5f2115fb3399d2c94966218f91dd9c2362
SHA256d898a79292edb0059156844e559cf65ab68819786b1d344dec42993851751740
SHA51204a631fbd1a3aca23956e316716375a77328471025f8391971aa33315ad8245419231f3b9b95229b1999c24c240ae97436ba9fcc3216d1a5b63ff75de9e9edf5
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
2.1MB
