Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
10-06-2024 11:48
General
-
Target
VirusShare_97ee4e31ab54dd1286221f66882afc62.exe
-
Size
388KB
-
MD5
97ee4e31ab54dd1286221f66882afc62
-
SHA1
ed782ac0c113e6ee1573539927f3374b8c3e859f
-
SHA256
4944771164216ccf6811e327befaa3aea12e9247ff731497a94f3c03d5b1b486
-
SHA512
1e62643409d12493e3e53da846b746496ae55ccd207ae3aebc321744a62717ea8bbe74280ec5d7373a3478ba16bd5763711a002fc8778aaf1a6f068ffd80d1b0
-
SSDEEP
6144:9YMk7V7PQkaYO0iNq/PimTBQNEETJYOo0DldfrvwmjcMVW5OouUI5KtrQ8POyU:9nSdO0iNEPn+TGOoYzwscMSOXUIJ
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+gayhd.txt
teslacrypt
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/B295F9176B0B0D9
http://kkd47eh4hdjshb5t.angortra.at/B295F9176B0B0D9
http://ytrest84y5i456hghadefdsd.pontogrot.com/B295F9176B0B0D9
http://xlowfznrg4wf7dli.ONION/B295F9176B0B0D9
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (433) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_97ee4e31ab54dd1286221f66882afc62.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_97ee4e31ab54dd1286221f66882afc62.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_97ee4e31ab54dd1286221f66882afc62.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_97ee4e31ab54dd1286221f66882afc62.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\vonofdilecbn.exeC:\Windows\vonofdilecbn.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\vonofdilecbn.exeC:\Windows\vonofdilecbn.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\VONOFD~1.EXE5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE3⤵
- Deletes itself
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5edd2d26bbac9de992c40544379824379
SHA15f61f131a1e23c7583bf88080608575b126db410
SHA256c18f4ded22f54765c0d2bcfe1377628b1ade663436fb7e74507cf75756b08e86
SHA5127a1e9e7d7b6b1a6dd0e08331c3b2a0b77f2be96b0eee0a31f2dc8346b7ae59668d24c87e2b561d79e0454eb5d5c176e8e2fd97d007d53da64e14c43bf858ea8c
-
Filesize
62KB
MD5d63b9f9335956ded8e4eb70e7d39b37c
SHA188794c347ca33dd5ea5be632b88ad26e66b2d225
SHA25639f9694d436b999390726589c29ce0100a640f017a11da99bbfa68e155762105
SHA5127570a82e593169dd0574f01b94d98441ac42f18cad7af44fbff34c2f797feda9431ff16b7c40082a9f2ea68ded89068cb159e73ad9c435a4360d62fa080ffdd6
-
Filesize
1KB
MD50b1aa10cf71d35fc3728128ccbbcf99d
SHA1bca39de08f9e78aaf4dea3d4c2e61fb86475f0a0
SHA256729167d1dafd796211c77ebeac11293a8c6a5dbc324abfc0cfb55861e1931101
SHA512d97818228d08e5259013275d263993d30976c171a94fa20e5eaf656d4c9688643c38269c6c6464edb0ab05d66c36ba6156d89451fbce5ae8d83ce3bcd859eab1
-
Filesize
11KB
MD50f3ced2f3cf5b6c009c6beaeee4faca2
SHA1c94cb734a68775f75f2f4a5bb70906a2fffb69f7
SHA2569c74391c05f6a58c1be7c79d75fd21166e11a812dd14c4c3595805aa54c3c483
SHA512e49130dd92e556fd015e2563a714f14ae6aa0dd7f4ac17d9d4b3f05af26dc10ea1025439ea6dacf6fbef6c5dd3c761a03dbdace99cecb677766758b548017e14
-
Filesize
109KB
MD5ae2d1a40e5e54099fff2d100e0829fb0
SHA1fccaf490572cba6dd15d5191d35fff6284d8d2e2
SHA2560c57f0f475db001ad9510efbd90368bba0b8862cbb73967a6497255b5edd01b1
SHA512a7e93fb0dc958d5013ce6cc543e57b1b46ac656019694be38399d73f5c1288b7be15656cc4094c7a021b2a6630927211f7a0981c834928e417fb1b72f059be0e
-
Filesize
173KB
MD5ba8df94b630e51fe5db6472667d62419
SHA12883654ff25670b8f0e57b8ad0a32aa7397b7fba
SHA2560bc9e3411c2e7e0a0be9d102eb896193a9a01915752cc4f1ffff7b6cd5584365
SHA51269f59f596eb7661156793ee68e00b902b1ce51d742536bd097d4d6f60396c09206149e19d2b4936d2790595bc2a06fe5db5c1f51b37dfa3ec7fd40d08f59948d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
Filesize
342B
MD5a1e6f5f77653e972c8fa0fea40e44007
SHA140b823f248c14419010eb6dbcb333ae6ced4b77c
SHA2565aea526950f3010c181d667bf1357c2023b34fb6f93c88484afd29ab15298d3f
SHA512a9505d2caba7b20bc031a5c696208294fcd56070d0c90d96bf05fa8550d872e5a82358c926d6c7f89197f7ba92c51d8354f0d73a8c1f863dfb7c0120b39b296e
-
Filesize
342B
MD53fadb74e72aab5a510ccf2a98cf17e3b
SHA13e0579542389950b9ba3d78837fd6c6edd5a8a9f
SHA2564b8c30bd1f76c6ddc34bad820df352f65831a8146065e12474938aea825c95aa
SHA512f20f8eafaca45890e6978b0d245035a7ce945e09d8ebddceb077338ef9fec580bb286a130c3ad69a0f11dfdef7329f59f20085ee022cb1d9f00c34d357fd8732
-
Filesize
342B
MD56c784542ce10ccc1a93b9eed91320a03
SHA10d370ae643d2eef6719e4919939a0237f3f99aa4
SHA256f5f4d99156f4b3174d73626cc8eebbb859b7ae411699666c60aa7c7256f0f7d4
SHA5127472c8c9b4fd13bd7bfea3cab373de72d9f834286441c0b236e0959950038586d5fb1edc7f30e271c62272f9de14b39092a30742b1a43d1eaf8fa93d2632503e
-
Filesize
342B
MD5a3a2d3777328d5b45a1ae635f03bf0ae
SHA1b1e350c7f4791c4d4a101f461b909d78a3dd6ce2
SHA25620e2992de87c48471ec3a93b3ddec2026362e98088c6660205064d1adb4d9cf3
SHA512bd40b1167bd1a9605ad35dbcfc2a40504d0eda1b5fd221299fa008b993b8b06dab0e8498282ae6a7b1fa55348308e239b8ea16840667f072c35fa2729c55f02c
-
Filesize
342B
MD51ed217e165ecd6b1dd313866b19141fa
SHA1e28805c06f7d52083a60030ee3f803e785cb58c8
SHA256b513443016b924f9d40c57f5d68560069f589c7debfddf43730524e66cba6737
SHA5123b1687121e7ad219b758ef92ddeb5e1f27bc2c9076eeebe3c4c3a3b47a955a30ec20ba4cf60fc9169dff5aab22dc6d6ec18d24b5c2c65d9ac4be7df2f84eb970
-
Filesize
342B
MD561e591ad67b04d0727d125e5537d6a07
SHA130aca28d2492222dd7bee716cdcd6fe616c87b7a
SHA256852d0f36c66b7f15c98130d466926c9ce38a73e970f8a57777b15209a1de4bd0
SHA512fc668c3aaee03b847e81f0d4a537917a3331a5dd00cf06f04163ef393c9c2b4032fa30c55a055fc6e1dc0e51ab28ade312f1d6207c9b8b752b6574169451b1a0
-
Filesize
342B
MD58ab0f8f5b2431d3ae1398717ba1d2ed4
SHA1b7af064f5e97c0a2bc6dac8a909ab462d0b69cf1
SHA25695090b35c77fb9a4ea0a7490ead347a52f65d97b4742233e0b03f03e506b7fe5
SHA5123f2793537e93271ae4b634c0c8ec23e137a0952556b09b4ebec123d11c393199fc24991d0ac3cf17eda1bcab87607d393f404de25c97acfe8915fb7be0fe08f6
-
Filesize
342B
MD552bcc8c1fd004af14746f97f4873f535
SHA149d245e81303bb70cc0394de44f167687268aaf5
SHA2561dbb8d6fd4ed5302fd5cd689e6908feeeeb6ec82ec07460b8e8bb89c7c539cfb
SHA5128864345e8165403d078a5faceb48cdcb3da63fd988a6a20db0a51c6de7b4710b36457a48559a4afd682c41321616b4c48407e8771cbf26f23bbe8cbd3c4c6657
-
Filesize
342B
MD5e45a46bc72d3bfa8a6ef562687c9a9ba
SHA123a648a521fb99099299e3fbd83caabd219eeeee
SHA256cebd825f8fb3d1ca74d610559f51086946d1272ef83b9c64cb26905c36f8035f
SHA51232f3c296be181759ac9a8a6ac34d536117fc6d50416af17c8c6d7a17b64e758e4a9bbc1ca6f4639a5d02d0b0129c1174d3a7b0cb7b02c976ff89a336f39d9ad1
-
Filesize
342B
MD5f31453a15f29ac19391da9c997bb7eae
SHA184307ac45e4715313efdf233f7da77dfc734520e
SHA25659a37b02cea9db785ad4c8ca2ea58d567e497cbcba662e48f8ec71688289f708
SHA512ff700e25f0b8b575051271ef087ff02cf13d8e79236962b5dbb241ba6cfe9753bc109b4419dec7b0334d0a6fc296699326b605a006cf20ff7a0d56852a189de3
-
Filesize
242B
MD514d0e605730c530879880da1a24fda76
SHA1aeeb374ca01e62063b24a096ec683c459b32eab4
SHA256a048e0fa2de9f8dd59ab574b91993d7fb0c6da60cd755aa36c45fd9e62fae965
SHA512e3a1ccd18fe8902a860a176e5cc35b632c2a5149190c60b188ff1e8502e9cce7ee4abe931bd5352381155cf9ecbfe1830b0b188fd1d41b1785ebed57b066c1eb
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
388KB
MD597ee4e31ab54dd1286221f66882afc62
SHA1ed782ac0c113e6ee1573539927f3374b8c3e859f
SHA2564944771164216ccf6811e327befaa3aea12e9247ff731497a94f3c03d5b1b486
SHA5121e62643409d12493e3e53da846b746496ae55ccd207ae3aebc321744a62717ea8bbe74280ec5d7373a3478ba16bd5763711a002fc8778aaf1a6f068ffd80d1b0
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
8KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
4.4MB
