Analysis
-
max time kernel
136s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
10-06-2024 11:48
General
-
Target
VirusShare_a5eb9cf3b138e8466071ec20a6722b5c.exe
-
Size
336KB
-
MD5
a5eb9cf3b138e8466071ec20a6722b5c
-
SHA1
5b8db28fdc2e40fd67b3de164eb9d904122e5cef
-
SHA256
ea7be43ae12bab3a5c3e00a568f3b3564c9225a056960048eda72f9f8f9f690e
-
SHA512
499af2dfd9997cd737ebdd758d7c84e36084d5db5cf1f2eb032fd496b549e808303eb73275e9ddf378e966972c1ddbab03174ba5b9b97fd4c75c2ba1e5d14a24
-
SSDEEP
6144:81w0U6D6x4kyjf+g0uc2RTqWmx7Ikw9NShXvSmk2OpXaP/EBySkQ4:8i0Uu6ikyjcuk5y0hXaxpKkB
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+ohmmo.txt
teslacrypt
http://gwe32fdr74bhfsyujb34gfszfv.zatcurr.com/64E65EAB38EE1FE3
http://tes543berda73i48fsdfsd.keratadze.at/64E65EAB38EE1FE3
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/64E65EAB38EE1FE3
http://xlowfznrg4wf7dli.ONION/64E65EAB38EE1FE3
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (419) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 52 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_a5eb9cf3b138e8466071ec20a6722b5c.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_a5eb9cf3b138e8466071ec20a6722b5c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_a5eb9cf3b138e8466071ec20a6722b5c.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_a5eb9cf3b138e8466071ec20a6722b5c.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\pnxiwcsktuxo.exeC:\Windows\pnxiwcsktuxo.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\pnxiwcsktuxo.exeC:\Windows\pnxiwcsktuxo.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1204 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\PNXIWC~1.EXE5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE3⤵
- Deletes itself
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5bf5f4a12712d68e360db27839d6c6888
SHA15a0367288c87c4cd802a6106cc845e3497b5c762
SHA2565a8d43fd8366f85e6549dbaafcdc0857990e787c4c3043ee4166e4b469fae554
SHA5128854706e478ecf246bccd63682853a0aa04aedc2dc6e20476deec45e0796ab0876f7f0b9b481b657581558b0f1e8443f99c92c455a1707c1ecf2d08997b927ff
-
Filesize
62KB
MD5c0c6ecb974dea3719e54347fbac49e36
SHA1327fea1d93e7d8b0b35bc99ffcc56875ed8a89dd
SHA2569166e42c799f9803bd68a8ad332f942f453a55331be929a7fb8c07f19219bfac
SHA512566998cebae3803b099dd4bb46d4c74068e471a6fdf86a121217f0711b547bba4d0aeb1a05574110043f0bc5be7e71036f0d8726a977de4159cd57486312b70a
-
Filesize
1KB
MD57215225cfb7afc317a9301da5d58e6b2
SHA16a42c011508db197218126e4cafc33892c11755d
SHA256c4062ef03274c8956c61c75d77ca3b91d250cfd700109ca5c9144b2d50080282
SHA512289278aaf7544162a086645c5c5420ae55d5c618dd15b52af8ce4c914921444f17bda2a3007249c54f2acfdeb4894da24117e0a870e3c7156741eebdafd8f554
-
Filesize
11KB
MD5cef0ce4d612c3a266c2135f69cd86fa2
SHA1bd4a60457332009a9227651d201e9322efd2ea12
SHA256cf47ce6d42c8d2dc037236f7512d0f627f689ff0442aecdc7a67b0caca57f7a4
SHA512728f609ba6231ae1f98c1fc76785cc5df8172334b8d7c57b0aac6ebf83bf57add028c78cf2113b2c38425066d13b8fa66ac512ff44a911e19d23e459d8c73f16
-
Filesize
109KB
MD5841d5907704ee6b9fce9d45865baf5ce
SHA16bff822283d615798a9e862184f87fe4de66da26
SHA25652f093b5a8df03b6a4b089a591be5878e9e21c57a0ee31422785c879018e69bc
SHA5121f363ee0df236b4622f8152a0bc01acc2259a8cb6f4526fcf8923c57871f3185c6dd155388f32d96fe7764181797fcd4b1b8c8548daef6f003ded150f1b73341
-
Filesize
173KB
MD57989de6b23db4151b8356f5fd19d8a55
SHA196fcf51baf7ce40c4ed09fa37bf72dc79bca3dcb
SHA256b83e934ebfedb0f2c3cb8b9ef96b737df8c95059bcea11a2e87c1f5f9b00491e
SHA512bdf29684cf8d1986e7fed1cf541bf3c1c676481e540b7e020455413b19ce6424c6b109d3c6ced422e5e3fd6b1c65095cb8dd07ff6065cd5a3d09abe81bf42e64
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
342B
MD5ecc8a0cf696cdfa7fe4ac673c9d2bacf
SHA1e8911b6cba84b3ac8b00d43a7462a6bc02882735
SHA2560c060dae769e24383a2d971656a5ddb51aa47b47d02850b5c58ca81d1f391cf6
SHA51272993b2c0ccda87df364aef61a55b0fa6cfc22041d947ea84168eb6921d1af799a7375fe81b9cf04fc7094ed939572e6d1deb0cce466adc1df682f933720c7f9
-
Filesize
342B
MD5b446865dc536d8c4e37b562b24518b95
SHA126f7a8b9ea63e62e84bcc86e088f8a23738955fb
SHA25635d0a0824e122ea7b792c5d4131c87b7eb4fc25a188d1dfe68f53071c7d83424
SHA512cc9a1bf2bfa628bea17be0f4130f707dbd83bab0cf1b9fd0304004eb432fdad8c0e1d79bd7bbafba9cc4f33ce09b04519b0b14ee5c752528cde1b0a188f48048
-
Filesize
342B
MD5657c1c56779cf272d742e3e200c51e94
SHA12939042a01d917d713fa8b7293be8b753492c76d
SHA25647db1174fca917b7c1d8ecd9a6d37a56a862c11f8488697b31db7d49b726559c
SHA5120e9c3f325b58b7d133907aac8bf21066824b91a4199eb3085acbb2aec38a32493265f42c6da9b06c18f82db23ec21a546e8cd268a0885429f2fbf754e8bfe168
-
Filesize
342B
MD55b34958c6541107bc032e011a6f7995d
SHA1a52862502814f28eb9f5a18cf66c54baef5cd296
SHA2569cf1e25e660b62ad1eb55d703dbd3e6da36be1846b80ad1e93b605895811665a
SHA51277c31934639773189c9127448e2cc98125f43951415f4d1370032723544ef7cc2dbe487da1c302753b4328cc90c8ae3deadf225d56628e6f4caea275ffad6a97
-
Filesize
342B
MD5fdaaa8ea2495b2532903dcc04c5ec149
SHA117121fcf59a49c824aa93c7cdfe518937ca2faad
SHA256f480883ae929806001a2c595b9254c64761abddd5e3384d4e30a85775fe6d7f7
SHA51227cc7dd6e61e4c4453746ac0e1e3e5a6c9e03d82ab571269da879281ab2e9acfa175f413641dccf9d6f3b0ea032111f3d96bc2f53714fc2b06ca37b20fc888f6
-
Filesize
342B
MD511565d59a997a73d0379441be6dd8765
SHA13d26f7fe409be6c232e0dbdc4c620d839461a3b5
SHA256412feef5112c8b242e2211fc3cf9ed4fc4d425941cea04a0c54b5d1623f65e7f
SHA512f0a45edfeb7ce9570f74725da7eb7b1fb1a687ad5139b46eb3199e314220d9816ef1fa071f62247bb6bd1dc9f1f54dc6f03ebc37cadeadbfc67c08f6f5c9f70a
-
Filesize
342B
MD50460a867ac10439af7b4036e6b8c6f48
SHA119f17c55a8c5d05a0e53ebcfcc1b6bf429f9b3e5
SHA256c37cba5cddd86839a95fe4ce81a20a917b174e69a10620102c74b2ece4f72988
SHA51275b6b314a0c601599a054dee6c6646f213140b5cbbc0b40d493d265237f573ce27689beedf30af76e23561c3451178415d51db26f1c8b9795875f43a2be2ea24
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
336KB
MD5a5eb9cf3b138e8466071ec20a6722b5c
SHA15b8db28fdc2e40fd67b3de164eb9d904122e5cef
SHA256ea7be43ae12bab3a5c3e00a568f3b3564c9225a056960048eda72f9f8f9f690e
SHA512499af2dfd9997cd737ebdd758d7c84e36084d5db5cf1f2eb032fd496b549e808303eb73275e9ddf378e966972c1ddbab03174ba5b9b97fd4c75c2ba1e5d14a24
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
4KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
8KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
8KB
-
Filesize
3.3MB
