Severity
High
Analysis Summary
Researchers found that the Tellyouthepass ransomware variant was active during the routine risk file investigation. The attacker uses the compression tool to package the exe, and integrates the ms16-032 kernel privilege escalation vulnerability exploit module and the Eternal Blue intranet spread module into the ransomware attack package to achieve intranet worm-like virus transmission.
Sample Analysis
The complete exploit package is an exe executable program packaged with a compression tool. After running, the run_update.bat script in the package will be executed first.
The run_update.bat script further starts the other two modules with awindows_privedge.exe as the parent process
awindows_privedge.exe is an exploit program for the ms16-032 kernel privilege escalation vulnerability. The attacker tries to execute other attack modules with SYSTEM privileges, so as to achieve a wider coverage of ransomware encrypted files and a more stable intranet spread attack process.
After the encryption is completed, the files are all added with the .locked extension suffix, and a ransom note named README.html is left.
Impact
File encryption
Indicators of Compromise
MD5
- cf89542ef0095543a46bb79f0e06fb3a
- 0a0d5d2d3c663c54a92cb11f7102eb39
- fa3f30b22757cb0ce2148cbd3d1198dd
- 4d087a11abc7ebd998ab1283676f7a97
- 33aa4d88e79595b3a558ce205a331d43
- 1992134d3f21def5de107f414b6b2067
- 62883c84dc55eb65fd713416957d8524
- 08b94446162ed7a1a1b078d6ad5907f5
SHA-256
- f71b2c5ef9040261760629afe3ef9eebe72b6c014595a3bdbb3f9519c7c691bd
- 51a0e792024ee299e3b27edd53a5f76f7ae7e1b77ace1c0f58e6cefb1dd1612b
- bdfa2baa55546ca3034513ef51858a569c4bac88343e03ae2d13de394a265b5a
SHA1
- 25586dd164f42a2ef0dfe5b55afb03dec74f3204
- fc490fe9de870e4af9e0b44071d255c9aaf5f38c
- fcd337523af76887d1f55a6724058b758ff6b667
Remediation
Block all threat indicators at your respective controls.
Search for IOCs in your environment.