Static task
static1
Behavioral task
behavioral1
Sample
2024-09-16_d338855d06c451c8357f4fbf61790f43_teslacrypt.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-16_d338855d06c451c8357f4fbf61790f43_teslacrypt.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-16_d338855d06c451c8357f4fbf61790f43_teslacrypt
-
Size
251KB
-
MD5
d338855d06c451c8357f4fbf61790f43
-
SHA1
41a3c753fc279c41814f758d34d99f3caabb40b1
-
SHA256
49e7123bc10323f2d784f09586174e3fa9fd1a5e078f35d916165602ef34f2b0
-
SHA512
fb41c9cde3ca237a8ca755ce895fccf704b7e8c2fcf1151fd24391494c0c8fb44a9018d1499085ca4ca399c3bcd9c87f7dc0b7e39a892dcab59137d4c0af5203
-
SSDEEP
3072:q346YQgDABWbDF5LizpJo7VQjI+XOCGdYQchceAMbZadZh6qO/1yL1qTC1TRpA:O+KTjIRdYQuAQGh6qO/iXA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2024-09-16_d338855d06c451c8357f4fbf61790f43_teslacrypt
Files
-
2024-09-16_d338855d06c451c8357f4fbf61790f43_teslacrypt.exe windows:5 windows x86 arch:x86
50e1f8f4ffaf0027d5b9f05d6a625798
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdiplus
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdipDisposeImage
GdipFree
GdipAlloc
GdipCloneImage
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToFile
shlwapi
PathFindExtensionW
PathFindFileNameW
psapi
GetProcessImageFileNameW
EnumProcesses
ntdll
isxdigit
wcsstr
wcsncmp
strstr
_vsnwprintf
_allshl
_alldiv
_aullshr
RtlUnwind
kernel32
HeapFree
GetProcessHeap
WriteFile
GlobalAlloc
Sleep
GetFileAttributesW
CreateFileW
ExitThread
FlushFileBuffers
GetLastError
GlobalFree
FindClose
CloseHandle
DeleteFileW
SetFileAttributesW
GetVolumeInformationW
GlobalMemoryStatus
FreeLibrary
QueryPerformanceCounter
GetTickCount
LoadLibraryW
GetLogicalDriveStringsW
GetCurrentProcessId
GetEnvironmentVariableW
CreateProcessW
GetCurrentProcess
WaitForSingleObject
GetModuleHandleW
CopyFileW
GetModuleFileNameW
SetThreadPriority
SetLastError
LocalAlloc
GetShortPathNameW
LocalFree
CreateThread
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
LCMapStringW
MoveFileExW
HeapAlloc
GetDriveTypeW
SetFilePointer
GetFileSize
ReadFile
SetHandleCount
GetFileType
DeleteCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetConsoleCP
GetVersionExW
GetConsoleMode
MultiByteToWideChar
GetStringTypeW
SetStdHandle
WriteConsoleW
IsProcessorFeaturePresent
HeapSize
SetEndOfFile
GetProcAddress
GetCurrentThreadId
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetStdHandle
ExitProcess
HeapCreate
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
HeapReAlloc
GetCommandLineW
HeapSetInformation
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
user32
LoadStringW
GetDC
ReleaseDC
DrawTextA
gdi32
SetBkMode
CreateFontW
GetStockObject
DeleteDC
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
SetTextColor
advapi32
RegQueryValueExA
AdjustTokenPrivileges
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
LookupPrivilegeValueA
GetTokenInformation
GetSidSubAuthority
OpenProcessToken
RegSetValueExW
RegCloseKey
RegFlushKey
RegCreateKeyExA
RegQueryValueExW
RegCreateKeyExW
shell32
ShellExecuteExW
SHGetFolderPathW
SHGetSpecialFolderPathW
ole32
CoInitializeEx
mpr
WNetEnumResourceW
WNetOpenEnumW
WNetCloseEnum
wininet
InternetOpenA
InternetCrackUrlA
HttpSendRequestA
InternetSetOptionA
InternetCloseHandle
Sections
.text Size: 189KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 9KB - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ