Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
06/04/2024, 15:14
240406-smhrasdf93 1006/04/2024, 15:14
240406-smb9hsda31 1006/04/2024, 15:13
240406-sl7n2ada3y 1006/04/2024, 15:13
240406-sl1wgsdf85 1028/09/2021, 10:15
210928-magetabef7 10Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
28/09/2021, 10:15
Static task
static1
Behavioral task
behavioral1
Sample
32c3fc22cab918195b3590ae17a424b5f79c145f6ee8c7d4aff376ce070248fc.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
32c3fc22cab918195b3590ae17a424b5f79c145f6ee8c7d4aff376ce070248fc.exe
Resource
win10-en-20210920
General
-
Target
32c3fc22cab918195b3590ae17a424b5f79c145f6ee8c7d4aff376ce070248fc.exe
-
Size
1.1MB
-
MD5
168557f53a1ffa882cabb043578b2216
-
SHA1
3ad007c50fb13801f252233862dc6d8e1ecfcc5c
-
SHA256
32c3fc22cab918195b3590ae17a424b5f79c145f6ee8c7d4aff376ce070248fc
-
SHA512
50f3c9b987ba5e8502b263018d88bd00b9f46a07b624b8bcd5cb626945a2000d316fe67f66876e835ed912f07309aec03c24383c5ba605c349b008d402cfb0bc
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
resource yara_rule behavioral2/memory/2524-116-0x0000000000400000-0x0000000000608000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ 32c3fc22cab918195b3590ae17a424b5f79c145f6ee8c7d4aff376ce070248fc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 32c3fc22cab918195b3590ae17a424b5f79c145f6ee8c7d4aff376ce070248fc.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2524 32c3fc22cab918195b3590ae17a424b5f79c145f6ee8c7d4aff376ce070248fc.exe 2524 32c3fc22cab918195b3590ae17a424b5f79c145f6ee8c7d4aff376ce070248fc.exe 2524 32c3fc22cab918195b3590ae17a424b5f79c145f6ee8c7d4aff376ce070248fc.exe 2524 32c3fc22cab918195b3590ae17a424b5f79c145f6ee8c7d4aff376ce070248fc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\32c3fc22cab918195b3590ae17a424b5f79c145f6ee8c7d4aff376ce070248fc.exe"C:\Users\Admin\AppData\Local\Temp\32c3fc22cab918195b3590ae17a424b5f79c145f6ee8c7d4aff376ce070248fc.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:2524