Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
2024-12-29_1f9d9c8b17bc4e6ab42217e4ca879273_teslacrypt.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-12-29_1f9d9c8b17bc4e6ab42217e4ca879273_teslacrypt.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-12-29_1f9d9c8b17bc4e6ab42217e4ca879273_teslacrypt
-
Size
316KB
-
MD5
1f9d9c8b17bc4e6ab42217e4ca879273
-
SHA1
ebbaefabffef6eac50f8c52c84a51cb7442ecaea
-
SHA256
c2f389b2ee29d7b7d23ba7f1d248b0e9fc9d8c8a60e77cd75b6bd8dd2b38db00
-
SHA512
9ff77d473a0cbaee33d576aea49cfde04946353c2334d18587ee732c90eb656eef35485996934385b32f94729999c6f2bf83ae572541f4adb56f4659cc9c848e
-
SSDEEP
3072:sP36v0ABWbDFp7yz5dwjtYjt+XOCGNjYQMhLwZil6hdZrz5ZbJnCgo5QTRpALo3:IhKjjtxVYQuwFhdZrz5ZC5aXALo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-12-29_1f9d9c8b17bc4e6ab42217e4ca879273_teslacrypt
Files
-
2024-12-29_1f9d9c8b17bc4e6ab42217e4ca879273_teslacrypt.exe windows:4 windows x86 arch:x86
d14f6633ecbe16251030c22f8466f2de
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
RegQueryValueExA
AdjustTokenPrivileges
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
LookupPrivilegeValueA
GetTokenInformation
GetSidSubAuthority
OpenProcessToken
RegSetValueExW
RegCloseKey
RegFlushKey
RegCreateKeyExA
RegQueryValueExW
RegCreateKeyExW
gdi32
SetBkMode
CreateFontW
GetStockObject
DeleteDC
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
SetTextColor
kernel32
HeapFree
GetProcessHeap
WriteFile
GlobalAlloc
Sleep
GetFileAttributesW
CreateFileW
ExitThread
FlushFileBuffers
GetLastError
GlobalFree
FindClose
CloseHandle
DeleteFileW
SetFileAttributesW
GetVolumeInformationW
GlobalMemoryStatus
FreeLibrary
QueryPerformanceCounter
GetTickCount
LoadLibraryW
GetLogicalDriveStringsW
GetCurrentProcessId
GetEnvironmentVariableW
CreateProcessW
GetCurrentProcess
WaitForSingleObject
GetModuleHandleW
CopyFileW
GetModuleFileNameW
SetThreadPriority
SetLastError
LocalAlloc
GetShortPathNameW
LocalFree
CreateThread
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
LCMapStringW
MoveFileExW
HeapAlloc
GetDriveTypeW
SetFilePointer
GetFileSize
ReadFile
SetHandleCount
GetFileType
DeleteCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetConsoleCP
GetVersionExW
GetConsoleMode
MultiByteToWideChar
GetStringTypeW
SetStdHandle
WriteConsoleW
IsProcessorFeaturePresent
HeapSize
SetEndOfFile
GetProcAddress
GetCurrentThreadId
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetStdHandle
ExitProcess
HeapCreate
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
HeapReAlloc
GetCommandLineW
HeapSetInformation
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
mpr
WNetEnumResourceW
WNetOpenEnumW
WNetCloseEnum
psapi
GetProcessImageFileNameW
EnumProcesses
shell32
ShellExecuteExW
SHGetFolderPathW
SHGetSpecialFolderPathW
shlwapi
PathFindExtensionW
PathFindFileNameW
user32
LoadStringW
GetDC
ReleaseDC
DrawTextA
wininet
InternetOpenA
InternetCrackUrlA
HttpSendRequestA
InternetSetOptionA
InternetCloseHandle
gdiplus
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdipDisposeImage
GdipFree
GdipAlloc
GdipCloneImage
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToFile
ntdll
isxdigit
wcsstr
wcsncmp
strstr
_vsnwprintf
_allshl
_alldiv
_aullshr
RtlUnwind
ole32
CoInitializeEx
Sections
.text Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
para Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 225KB - Virtual size: 332KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.crt Size: - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
CODE Size: 71KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.erloc Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.SCY Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE