Rewterz Threat Alert – Tellyouthepass Ransomware worm

Severity

High

Analysis Summary

Researchers found that the Tellyouthepass ransomware variant was active during the routine risk file investigation. The attacker uses the compression tool to package the exe, and integrates the ms16-032 kernel privilege escalation vulnerability exploit module and the Eternal Blue intranet spread module into the ransomware attack package to achieve intranet worm-like virus transmission. 

Sample Analysis

The complete exploit package is an exe executable program packaged with a compression tool. After running, the run_update.bat script in the package will be executed first.

The run_update.bat script further starts the other two modules with awindows_privedge.exe as the parent process

awindows_privedge.exe is an exploit program for the ms16-032 kernel privilege escalation vulnerability. The attacker tries to execute other attack modules with SYSTEM privileges, so as to achieve a wider coverage of ransomware encrypted files and a more stable intranet spread attack process.

After the encryption is completed, the files are all added with the .locked extension suffix, and a ransom note named README.html is left. 

Impact

File encryption

Indicators of Compromise

MD5

• cf89542ef0095543a46bb79f0e06fb3a
• 0a0d5d2d3c663c54a92cb11f7102eb39
• fa3f30b22757cb0ce2148cbd3d1198dd
• 4d087a11abc7ebd998ab1283676f7a97
• 33aa4d88e79595b3a558ce205a331d43
• 1992134d3f21def5de107f414b6b2067
• 62883c84dc55eb65fd713416957d8524
• 08b94446162ed7a1a1b078d6ad5907f5

SHA-256

• f71b2c5ef9040261760629afe3ef9eebe72b6c014595a3bdbb3f9519c7c691bd
• 51a0e792024ee299e3b27edd53a5f76f7ae7e1b77ace1c0f58e6cefb1dd1612b
• bdfa2baa55546ca3034513ef51858a569c4bac88343e03ae2d13de394a265b5a

SHA1

• 25586dd164f42a2ef0dfe5b55afb03dec74f3204
• fc490fe9de870e4af9e0b44071d255c9aaf5f38c
• fcd337523af76887d1f55a6724058b758ff6b667

Remediation

Block all threat indicators at your respective controls.
Search for IOCs in your environment.