Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
28-09-2024 14:11
General
-
Target
VirusShare1a9ab9e924a6856d642bbe88064e4236.exe
-
Size
418KB
-
MD5
1a9ab9e924a6856d642bbe88064e4236
-
SHA1
d9d445e9dcb8694398c7acb33f38d7261c95321c
-
SHA256
69155f404a1482e4188726cb0f88b6c6fd6ca94d834b31e05f36e88662281e22
-
SHA512
f41e93d25fe32248f55dbf5c1c721e4af5d2c28531816955094585a00afa94ea2dab0a6e25191abe8896a2185cdbc535d9dcf3beac14b683d05e1c8c7c6f80b2
-
SSDEEP
6144:/lhEMsxe34/JTpHIOdX2JOVM8aSC4Zl7rOfT+yIaIWk3HtlE0/Ce+Mx62q2jQ1+d:7ssoJhf8JOqQC4/7CfTk/rsh2jQ1T0jv
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_RECoVERY_+kodgj.txt
teslacrypt
http://sondr5344ygfweyjbfkw4fhsefv.heliofetch.at/E08D11FFC7249231
http://pts764gt354fder34fsqw45gdfsavadfgsfg.kraskula.com/E08D11FFC7249231
http://yyre45dbvn2nhbefbmh.begumvelic.at/E08D11FFC7249231
http://xlowfznrg4wf7dli.ONION/E08D11FFC7249231
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (426) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 6 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 52 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare1a9ab9e924a6856d642bbe88064e4236.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare1a9ab9e924a6856d642bbe88064e4236.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VirusShare1a9ab9e924a6856d642bbe88064e4236.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare1a9ab9e924a6856d642bbe88064e4236.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\hrexicrfavnm.exeC:\Windows\hrexicrfavnm.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\hrexicrfavnm.exeC:\Windows\hrexicrfavnm.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT5⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RECOVERY.HTM5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2736 CREDAT:275457 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\HREXIC~1.EXE5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD59cf2a9c429ee69b94206a5430582334b
SHA136e850ab241874b3223eb03c27ec245f5f32ee3f
SHA256c03b516f70ac14675540bf853ed992d0b8fdeb2e01d6b969664ad47e3c889f5e
SHA51288cc91ea5df2c00010b979453e54899807da463f1c12eb62fbdf0080ac13274fc746b6bee57e67fdae92e41236c13f83f025d73663e452b99252a70da701ed38
-
Filesize
65KB
MD5e740cd7f2d9f9b1a1369480cc2104511
SHA17e63a394b9a62314e367059bd4118a33422e3500
SHA2564e4eb84cfb8d4f663844ac68fbc5a2b3149f508f5d986a51ecced36735a5f9ea
SHA512e93bf5e90dcdf6fb5985533a88bb018077f187833d93442cd4c34883462c35c5da107ce3e9c15062d727f1ca78d47c3732b1434a4479fc411836113f87fe14fe
-
Filesize
1KB
MD550237e2f19b30b65d40f92fe3130e63e
SHA1302c011cb37fc7e2bd5feba1a8d3ddc4be89153a
SHA2569ed0fe9c8f73b328236ba5ce6222ad07760300a698fc6bd91f7bb37887e41d42
SHA51242d8768be0b02225d9fa1aee79992c2db998a1f1275fa8d18dd969282efd72661d030f4546f89523e2076eee0a6da8c62db49b751af2021e9f77e1b32c356057
-
Filesize
11KB
MD5a7eca999434e0d441b7de84c7d2d5b61
SHA1f885fb954dc2fee071f9985f01854973007fa2e9
SHA2560e3521ef0e64637d3a8ec3e8fb8c4660f590454f11cdb1c4e6da9a51ebdf22f9
SHA512103b971aed3d7c4dc03975c09eed2985001ee9fd7c12aa576b6e4c20340cc5f638fb15fc63c9df29dd0ca3eeca40cfc8e0e742051368933e8ba66ae178622314
-
Filesize
109KB
MD55cd686c693d3f303ce1503b3335b68ad
SHA165a043e498fb54c6905edcbdf3cfb4def57b8a81
SHA256af63bbc441d3bb5af2e20bcd9616d93e69b8b549bbd9e90726b3dd6a5fa73e60
SHA51209778917dd8bfb853845e359a239e26511ed1a4b404463f006e849f53bbc2bcf259ff7f6758d6a8dce4d80aadc192fe2358ebec0896af8f9d47e29067641ffc9
-
Filesize
173KB
MD5b89e6d3f23f1ae797f114b94251ccfb5
SHA10ff22e6b16ec1e0983d8fe943722306f20484724
SHA25697ddfd6e3ed994045441fb90635d9d2fb89f89ee2b434770a9c953ff1eff2702
SHA5124abd764a3bf86e2244127f9429acadf2d6e0a289f855c9524c90770b9c4bb18403113d12e6122eeb10f962bf1b4841b67ae50a41acf03cef54a672ed368a02e4
-
Filesize
342B
MD54e078286476f1e93bcf7aeff4915f931
SHA1086a43b07a4d0987eec27c7e78f4a5d00bad2a3d
SHA256db18dbb20b419cd1397c096c4fef9e22d16ee96b9bdc8a6bfb7fd47af0dcb6da
SHA5128204a6104bd504415ceebf231161f0d669be9be721a96a9cb6d90470451e9ffd56b3406a2eae599c5287702385f5e688a275cb3f2cb7e2cfa194336e684fd0ca
-
Filesize
342B
MD5606feaf18fa65b42bdaf0c8597437c9d
SHA12c63cbd4052e8de126dd4cec2c2c0791b99a0319
SHA256759f2af651edd8903e3c7d9c39575266963e5ce858d15361ec0dad6329648db1
SHA512d4cb7281fec194bb2cb25b227da3bfb1e5b0db079e2d2e0f42190aaff9c8abbb35224e2a803212f040c860f4ef3e3d673838f7b30b8eb8cc6ae383847387487d
-
Filesize
342B
MD57914cc320b760e7cdfb8dfdc98d044bd
SHA1af029034509ea77d7ad854e9633727e7481df273
SHA2567cce0ce095bcaae4c1e5a40cad61d7e65aac57ba7dc8c4858af7dc420b4f9c1a
SHA512771dc757245d7559b14d1d731a85e8b59a3c17db80e3489ff857c597d40f03daa565bde204062c48801fbcb80cf84c12cbc3622c8e2dc53c2cc4a5ff51bbd831
-
Filesize
342B
MD5b995aae334e3034a021c306969edbd22
SHA18f82cee470916967c4d701100aea31f723dec550
SHA2566d1d87f564b37efcee0cef695b57b43a5cbc150c9ada4c74eea60292807e4fa8
SHA512b5f88e40a3132ce3f757b573ff17d66268a54870d1a78ae5407f500e8c7e62527cf997830b8064928016318798cbc1b2d7e5afbbac975e295939f9b0a3bcd828
-
Filesize
342B
MD5c638fb375cf128c9ec6e3dade364351d
SHA1c51b6c36fc31b9358046eea373bc1ebd54b9f44c
SHA256e41b8cef0d8986565076fa338c3fc68425debcdf55e9f3ff5acdbe0335814f6c
SHA512ea7120eed0293ab4b1d379540e8980f6d6014601baa692685bb93d70d67379fabf3b5293d7548bc2a53fcce4c396d66e5179b9437133d9390a915d8cab4e26ea
-
Filesize
342B
MD5b4b88bdbeeddddcfa87c86c003d90ae3
SHA1c36ac3aa2a3d209827f4ce211443d54bf741304d
SHA25626effe2becb0282d73772a9d8493e88889a4d18a3db9fbfd39df24b344e0a56b
SHA512c752a8e5e3b929a1309254945ad03179c6227dc33a49fd828837b2629f84f81df2d5760055a7f77dc94a702d3876da8eb1cf725bc5a59226795e9b16a2f5925f
-
Filesize
342B
MD5a68c75dc2c569bf249115212a0fa8ac2
SHA1e6bf48ebcc3d2c9d0ce3e562d8615e174f683c32
SHA2564015c51f25f2bdfa7d97d0884dd24b26cae125832b001d7091e427d1188aaa33
SHA512e34a02e907827e3bbf2ce652e610ba3e284ca1af86dd2317eaa8121e21b0ec1984a779f146f05b0f7485cf76afb504869b7ce2994bf3373931424b5649ed19db
-
Filesize
342B
MD5ae09c02b402844d0c15db1bf23885cc6
SHA10594dd47d5dd2cedb45b8ef79ce969d9438ed984
SHA2566c86f14e681b214191cd28d0563c856ee3e30c12cfff6ddb8849d86674000ad3
SHA512a0d75a9ddb7ec9df1c5b63d4d23403bdc626e71f5922d65d5ff2c6cbcc44d4f080da8110b113b295ad111017ca4f0c8d271996ba487d361813d50ddce45f6e99
-
Filesize
342B
MD5d743750853a4fb809859873a6fb659c6
SHA1c12cd63f67493036011067d9eb555d3a33d7e5c0
SHA25684f3df4b848523f916302667ac42f59e7a2dd07c446e055f8aa63823827a6640
SHA5127bf37036021a2d4aa11c9902e09d8d41f473b1cfe47357381b5436002f817874c84e82213a5bb8a8236dfa75bdbf9115bc2ac056190ba7b383f59deb44e2d9f3
-
Filesize
342B
MD55d995d78da85481609ea51e9e7e9016e
SHA1bccf0b43c7eaed20af2e8fc329c444c53869f66c
SHA2566214bc075457a01cf1fc6d3a0ce1d2d5b0ce002f1a83edfb6926764462a08bc9
SHA5122c202d5211086b344b1b3c09ba986541ddf6e9e0ea30accfb5bbf48bc23f8996ed922be4d2d0bef974b5931eb2f3143f90b849020be5808cc02dc5117ba8b0d9
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
418KB
MD51a9ab9e924a6856d642bbe88064e4236
SHA1d9d445e9dcb8694398c7acb33f38d7261c95321c
SHA25669155f404a1482e4188726cb0f88b6c6fd6ca94d834b31e05f36e88662281e22
SHA512f41e93d25fe32248f55dbf5c1c721e4af5d2c28531816955094585a00afa94ea2dab0a6e25191abe8896a2185cdbc535d9dcf3beac14b683d05e1c8c7c6f80b2
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
8KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
772KB
-
Filesize
8KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
4KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
