Analysis
-
max time kernel
120s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
10-06-2024 11:48
General
-
Target
VirusShare_97020660b63757de9c0e8ad51eed9acf.exe
-
Size
376KB
-
MD5
97020660b63757de9c0e8ad51eed9acf
-
SHA1
bc75b2b04ec8591829a69a7634698c2d7ff406b5
-
SHA256
9c5feadf74c3a5ce0b40d5402f0f1ded6aea80b517c016a179b02f38a22aa489
-
SHA512
a6cc6b7c7c8d16419b826affc813ea5cff9501133c5bc386217fa686c35906404a937630bdbcdee193273e5c22872f891e1a40d332393480c8d684ea8bec0f67
-
SSDEEP
6144:ie3rNhMeYq4CGRTs4kadSoKVStcmTVn57CpSCwsUbg62oXd:iY5hMfqwTsTKcmTV5kINEx+d
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+nlkxs.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/397FDA7DA7EFEA97
http://kkd47eh4hdjshb5t.angortra.at/397FDA7DA7EFEA97
http://ytrest84y5i456hghadefdsd.pontogrot.com/397FDA7DA7EFEA97
http://xlowfznrg4wf7dli.ONION/397FDA7DA7EFEA97
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (418) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 36 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_97020660b63757de9c0e8ad51eed9acf.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_97020660b63757de9c0e8ad51eed9acf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_97020660b63757de9c0e8ad51eed9acf.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_97020660b63757de9c0e8ad51eed9acf.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\wmoviexxcubq.exeC:\Windows\wmoviexxcubq.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\wmoviexxcubq.exeC:\Windows\wmoviexxcubq.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\WMOVIE~1.EXE5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE3⤵
- Deletes itself
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5de9346bb50a387425f0d1b03786e22b9
SHA1fc503b5296aa0509a4e83d73a3164ac16a5a7f72
SHA256a2c2f107896b76dd8081c64054cff95755b3de2fcce7a078bf9cb5a5c8f3897d
SHA5121f86ca6c794da715035df75e27e7e54e11bbc125c8d0d50331a11ae213690c4ae97c9a5ce4e7ed1beb84b387ca0186af81e88e2130b5220233e066960ab7d2b8
-
Filesize
62KB
MD5d2ef4a99e39abf91574056e006feaba1
SHA15096f1a679904741669460fdd96f9020a1ce71e5
SHA256b118af92b73797c5dae52533e67b53693752b3dd5ca967955799225ed27cd1ce
SHA512c78951af8a0676747195db735236c6e9223176b91989b3af0cc6cdb1c556b2afb947a1b8b66ee6870ed7ffc7c3b9e2ba3881d3369baedcda78958ae83af337dd
-
Filesize
1KB
MD5509498c81e202efc796ff0a73b185402
SHA1bb29958aa97b6dd2d31bb1f77843a27d9006f9f2
SHA256553cb8c37ae0f1330ac5c986b02d4883d1ce0d20177ab4aeff0ad7b9661c3299
SHA512cfc9c0419b59ea170c4e2b79c54981c50e78738a4a34e2e93c458808c6614af124897078d74700f37edb8c416fa8b314cece3fe06003b68bcebd8a2f174a69d5
-
Filesize
11KB
MD59eef7a1dda0316544caf4ab18a9aa210
SHA1b9ea4f5c2411a43977e339790b0f616323ea1470
SHA25674348277853f1d16ced7c9e77460fc3fa8c72fa940bd5106493adfc0ba554509
SHA5120dbc88a399ed7dba64cd3579810c63dde1786f6525f325b234f1fc377405a9d2b09c52d5e32428f0c9c8f32181d2aac758503decd5ea6f8d1224c05fafe69434
-
Filesize
109KB
MD5c5311da517b9af0331b8b933b7ccc54a
SHA1b6cadbe63da86f1fa64518d839b9eab8d4482b00
SHA256667239e40feb7db92f11a59713d50a8f19cd646b097521952f2843e093abafda
SHA51202a09ace950fb303773ef3dab7e27d611ec64d92c0e2a1abf4b13dee6908591aa89c187571b376a965695e460926b4aad1fe570e8b22957f08da88f80284c2a9
-
Filesize
173KB
MD5d8c85131dd50fa422404a2466367f913
SHA173a7f0f686a42c3c796724f3f63a313c84c73653
SHA256d10cc0bca7859ddfa40f0fe575153a1cdd31afbf7aaf463f137a1b5f5cd66c00
SHA5120e41981cdd18a762748fd0da3016dfe4d0f36929569ab124030d7bbb778c2e7b3890aec0873e8fabf242c6d94b8830a993220fb8cf301c9c7844212730626025
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
Filesize
252B
MD5edb46377dfd4d5d41cb001789e31e5c5
SHA152499b5e6ae72c46762b58f61cbe7fe17c8228be
SHA256e16d521b5ce60d675086d1ea3bfc98c754c17c400c667036e6c8a084e7a38a4b
SHA5125975678fe5d4b4201ef4b43cbb607d719287fc1cc0fbc31410d9a340ef8230aa997af6002904072c3f839356a9f41b2edbd8b2b33f7b7f2e46e13bb988790bc2
-
Filesize
342B
MD53e9b0da38e76bdc223bb182bcfc1ff7b
SHA141c319ba204a3e58b7328ba21335c3e75fbc8388
SHA256115d122f95c280d9505a7392cb280976894f21e08a9a6abc2e66e681b6082efb
SHA5127003b724b4760a1765e9b3cd65ea95ef0c4982d634b86e3fe25bacb547a82a9bf637b7a4479500b3236b87f6ccdde66cf113dda8f73e2fc351752de22a357937
-
Filesize
342B
MD5654c6fa0ffad705153641e5fa5ee15cf
SHA1bb1575204901bec95395c9b0a6da072b208dee08
SHA25672294c04adc8820212cb9ccaef149d4ef16716f2201a0e9b67835c180a681654
SHA512772aeee342176cb27d46b8c1e340e33ddccbc52ca352c7bf051ddc44f89a41564408397787077dbcc67d5d888b9c3c7883cf9ee10518b12154f4283a148f534e
-
Filesize
342B
MD5eae2b29d4c4818e4f83c1c65bd1f4830
SHA1baca9729a6a2868ba373471f0c592b80913de3db
SHA2568754e23f3570eb0c4f4a194c3c5c2da68d7396f7009a3ee40f6ac77fcd2e24dc
SHA512d7c25343b4f3f47714cea7c1350c30695aadf15e3ad91cad727b2ce209bf582cbda89edb4945b702008698119f5a596028378563acd46054971f1995749ca511
-
Filesize
342B
MD5e0ae6df89b7458b21544c7c91256e205
SHA13bb8a00c973e1e5588d0fa1f9b0c43f5a291e54b
SHA256da3fa20903fa82e83b33e5cd7d3b83c3a81e5bdf6a62075b0e024dcf4949a3c7
SHA5123e8b10d0417f4ec34ba44f656cde38092010e7ce49ccdd13c2580fc3d366b1af1d168154c9ffa92a811d7c44c747134d835faa90231be7ce9fc85388f396f1ad
-
Filesize
342B
MD59efe21b6fdd0c541b600e0f1988c17ee
SHA175246afb32233b72ae53cfbefe7dafbb29a42855
SHA25632be168e3d9e1874d9b2a4a12a7f10d0eae5f7d2c36ca155771d618d13cac3af
SHA512508c2e187df19faf612d4fd8a4fd618ee13761ea9287f19b2de7516c81f6cb7b92543e4fbe5fb4f4a1544fc9809ac417c3b3ce9c3a24073dcd47c8abddd3c3ba
-
Filesize
342B
MD503f22c94aa4270851f71611bb129af77
SHA15a44e4efc22fa7580cecf63e6472212faede07ee
SHA256ba197bcee2ae53cc682fc279dfe6d45b6aca4111d9ad7a1530cf4c4dd9b14ca8
SHA5122d3c12f33e673ed28a6f0014dfeb33d122f15e2373c25b9a2756ded9525fb1f94e6ca77dedf58f20d81e5a0661ce07cb5dee7e45fa7545b0fa7c8df2d06838d3
-
Filesize
342B
MD55d9c688353f0618042a41f4ddbef3fc1
SHA1473234bf19a3fb4e7ad0b9e266438d2d092826e7
SHA25621ee0f00f06c55b24db80a1cd2d05d9e22a7c8f999907318f617fb7e84bfd233
SHA512756ce57123176efbf525a018543e06e28a51bddc671606a48b3fa4a1e307376c03ebdf204c00fe0f330dbb2a9b449fe13b7770cbf1cd06f511eae6898f944463
-
Filesize
342B
MD5cfc528d923ddcccbd998334663c1d2f7
SHA164ed07be326abdc8b35c66fef0d1d47e73265061
SHA256d0796d1e28f96f5f625d32d6f1a068e65581d6e2f6a8899bbfc0e43fa95fe13c
SHA512d8ffc3eb6b53caf7f50a6a8c243415644c26688c05b9e0987a12edaf226b92022c315b0fd73adc22f0cfbf2514142abdaf42025937a1d96ea9c4fcc90df88dff
-
Filesize
342B
MD502d93654c07b26130d1b1b7b7ef2e80e
SHA172d215c8a92e90141511e1dd89db6a6848e0b79b
SHA2560ab39ec02b02c4035e5d978dd422c53eca9eb12cdac7702db5062fc2efa1aae6
SHA51215bbea3f3b1f3ae1f0c06b18756abf586fa78a13bae65512f74d9cf921d5d318c20c0802a585ed9777ffb87374cb5fb64d59186372c66f1d3030879cf9050cb0
-
Filesize
242B
MD5c1dab38b94e646ce8197e60262472790
SHA1e31a451a7acf7a8b0b546d3e88611dca7e16c3c4
SHA25614e98014be6f5f33c2896e5d75b1e75a134d222d148622fd96cee54ccb4e0836
SHA5121f7376b2cd37ad24a7fca595927906046448b2fd0f698f1e98f4f9a078f960a25c37609b49e4bfc299a4a216817aab419d710f80e2cb24944add05c3cd57dd2c
-
Filesize
4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
376KB
MD597020660b63757de9c0e8ad51eed9acf
SHA1bc75b2b04ec8591829a69a7634698c2d7ff406b5
SHA2569c5feadf74c3a5ce0b40d5402f0f1ded6aea80b517c016a179b02f38a22aa489
SHA512a6cc6b7c7c8d16419b826affc813ea5cff9501133c5bc386217fa686c35906404a937630bdbcdee193273e5c22872f891e1a40d332393480c8d684ea8bec0f67
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
8KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
8KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
1.9MB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
4KB
-
Filesize
532KB
