TeslaCrypt

This ransomware is usually distributed as an email attachment or through websites that redirect the victim to the Angler Exploit Kit.

This ransomware is usually distributed as an email attachment or through websites that redirect the victim to the Angler Exploit Kit.

Posing as a fake invoice, they try to convince the users into opening an attached ZIP file.

Delete all system Volume Shadow Copies by executing “vssadmin.exe delete shadows /all /quiet” command

In our analysis, the exploit kit delivered a malicious Flash object containing an exploit against CVE-2015-0311. The payload for this exploit was a TeslaCrypt sample.

TeslaCrypt 2.0.0 does not use key.dat or storage.bin to store data. Instead, it uses the system registry: an install_id value is stored in HKCU\Software\msys\ID, and the following structure is added to HKCU\Software\ <install_id> \data

The final unpacked executable locates specific Windows directories such as the Application Data directory, and builds support files like the “key.dat” file, and files to store decryption instructions.

The ransomware tries to stay persistent on the infected system by adding the following entry to the registry key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

If the check passes, the real dropper is extracted and executed using a well-known method that makes use of the ZwMap(Unmap)ViewOfSection API functions to unmap the original PE memory image and re-map another image file.

The final unpacked executable locates specific Windows directories such as the Application Data directory, and builds support files like the “key.dat” file, and files to store decryption instructions.

The ransomware tries to stay persistent on the infected system by adding the following entry to the registry key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

The executable also adjusts its own privileges (adds “SeDebugPrivilege”) and copies itself using a random file name to the user’s Application Data directory.

Before TeslaCrypt version 0.4.1, server requests were sent in plaintext; in subsequent versions they were encrypted using the AES-256-CBC algorithm, with a SHA256 hash of a static string from the malicious program’s body used as a key.

the author has also implemented dynamic library and function loading.

Otherwise, it copies the image file to one of the directories, depending on the user account rights. The name of the file is generated randomly and contains 0x0C lower ASCII symbols.

If the check passes, the real dropper is extracted and executed using a well-known method that makes use of the ZwMap(Unmap)ViewOfSection API functions to unmap the original PE memory image and re-map another image file.

Versions 0.2.5 – 0.3.x saved the decryption key... in key.dat. The area containing the key was zeroed out in the file only after completing encryption... In version 0.4.0 ... On completing encryption, the key was overwritten with random bytes rather than zeros

It then executes the newly copied file and removes the original file with this command: {WINDOWS_DIRECTORY}\system32\cmd.exe /c DEL ${PATH_TO_EXE}

Execute the ShellExecuteEx function with one the following commands: wmic.exe shadowcopy delete /noninteractive

the ransomware uses the ShellExecuteEx function with a runas action for this command: {WINDOWS_DIRECTORY}\system32\cmd.exe /c "" ${PATH_TO_EXE}

Most TeslaCrypt samples use COM+ sandbox evasion techniques. For example, the dropper we analysed uses simple detection code that verifies if the “URLReader2” COM interface has been correctly installed in the DirectShow filter graph list.

First of all, the malware checks the SECURITY_MANDATORY level by calling the GetSidSubAuthority function

TeslaCrypt 2.0.0 does not use key.dat or storage.bin to store data. Instead, it uses the system registry: an install_id value is stored in HKCU\Software\msys\ID, and the following structure is added to HKCU\Software\ <install_id> \data

the ransomware checks if its path to the execution file contains the windir environment variable or CSIDL_MYDOCUMENTS (which depends on the user belonging to the Administrator group).

This thread is responsible for enumerating currently running processes in the operating system by using function EnumProcesses.

starts to enumerate all files of the victim workstation (filtering by extension type, Tesla Crypt supports over 170 different file extensions)

At the same time, all network resources are enumerated recursively using the WNet family functions. The ransomware looks for resources with the type RESOURCETYPE_DISK.

Most TeslaCrypt samples use COM+ sandbox evasion techniques. For example, the dropper we analysed uses simple detection code that verifies if the “URLReader2” COM interface has been correctly installed in the DirectShow filter graph list.

First of all, the malware checks the SECURITY_MANDATORY level by calling the GetSidSubAuthority function

The ransomware encrypts and encodes the data when it communicates with the C&C. It calculates the SHA256 checksum of the decrypted hardcoded string 0324532423723948572379453249857. The received hashsum is used as a key for the AES-CBC-128 encryption algorithm.

Send the new master encryption key to the C&C server through POST request

The ransomware sends packets to the C&C server using HTTP POST requests on the default TCP/80 port

C&C servers are located on the Tor network; the malware communicates with the C&Cs via public tor2web services.

the unpacked file's detection names reveal its actual behavior -- downloading other malware.

the ability to encrypt files while offline – i.e., C&C communication is not mandatory to initiate the encryption process.

The ransomware communicates with the C&C server to send information about the encryption keys, infected machine and the malware itself.

The ransomware performs disk encryption operations using an AES-CBC-128 algorithm with the previously generated random keys. | The file header that stores encryption-related information and encrypted data are stored in the original file.

This thread is responsible for removing shadow copies on the affected system to avoid restoring encrypted files from backup.

if a process with a filename that contains any of the words below is found, that process is terminated using the TerminateProcess Windows API function taskmgr procexp regedit msconfig cmd.exe