General
- Target Ransomware.TeslaCrypt.zip
- Size 479KB
- Sample260125-wcdalscv3g
- SHA256 3b246faa7e4b2a8550aa619f4da893db83721aacf62b46e5863644a5249aa87e
Score
10/10
Malware Config
Targets
-
- Target 3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370
- Size 284KB
- SHA256 3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370
Score10/10-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Teslacrypt family
-
Renames multiple (4450) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
- Target 51B4EF5DC9D26B7A26E214CEE90598631E2EAA67
- Size 257KB
- SHA256 9b462800f1bef019d7ec00098682d3ea7fc60e6721555f616399228e4e3ad122
Score3/10 -
- Target E906FA3D51E86A61741B3499145A114E9BFB7C56
- Size 261KB
- SHA256 afaba2400552c7032a5c4c6e6151df374d0e98dc67204066281e30e6699dbd18
Score3/10
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1