Resubmissions
07-04-2024 03:02
240407-djjf4abh74 1007-04-2024 03:01
240407-djdwlsbh69 1007-04-2024 03:01
240407-dh9xnabd4y 1007-04-2024 03:01
240407-dh3tcabd31 1019-06-2020 09:02
200619-7wsmkj8vh6 10Analysis
-
max time kernel
151s -
max time network
135s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
19-06-2020 09:02
Static task
static1
Behavioral task
behavioral1
Sample
0a0ae5d804271f56c1fa5e1e695cc514.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
0a0ae5d804271f56c1fa5e1e695cc514.exe
Resource
win10
General
-
Target
0a0ae5d804271f56c1fa5e1e695cc514.exe
-
Size
1.0MB
-
MD5
0a0ae5d804271f56c1fa5e1e695cc514
-
SHA1
e8d307b58856cd38c5b43f576a5dfd451f29b11c
-
SHA256
50119da56e84ae4baa207a9391a0143fe5aa66c212aeba08e2d6d864af0a0d83
-
SHA512
27d1a4cb2e8a62ea02191db8171d66d2cd485cae7649be03a65e5bf936d6d92e98a888d33b3c4826f47eae26b3e45cd8efeca7b73626ae9913b055fd2b5bfe11
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Checks for installed software on the system 1 TTPs 29 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName 0a0ae5d804271f56c1fa5e1e695cc514.exe -
Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ 0a0ae5d804271f56c1fa5e1e695cc514.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 0a0ae5d804271f56c1fa5e1e695cc514.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of UnmapMainImage 1 IoCs
pid Process 888 0a0ae5d804271f56c1fa5e1e695cc514.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 888 0a0ae5d804271f56c1fa5e1e695cc514.exe 888 0a0ae5d804271f56c1fa5e1e695cc514.exe -
js 1 IoCs
resource yara_rule behavioral1/memory/888-0-0x0000000000400000-0x0000000000608000-memory.dmp js -
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
resource yara_rule behavioral1/memory/888-0-0x0000000000400000-0x0000000000608000-memory.dmp upx
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a0ae5d804271f56c1fa5e1e695cc514.exe"C:\Users\Admin\AppData\Local\Temp\0a0ae5d804271f56c1fa5e1e695cc514.exe"1⤵
- Checks for installed software on the system
- Adds Run entry to start application
- Suspicious use of UnmapMainImage
- Suspicious behavior: EnumeratesProcesses
PID:888