Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
181s -
max time network
200s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
31/07/2022, 07:20
Static task
static1
Behavioral task
behavioral1
Sample
7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3.exe
Resource
win10v2004-20220721-en
General
-
Target
7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3.exe
-
Size
1.6MB
-
MD5
8af61cf426f27fabebb2f36a7fc09ecc
-
SHA1
625dba2ddc6c0be037b22870407e988f284f5e64
-
SHA256
7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3
-
SHA512
00a4967ce6a02f1cf1badf86efcf8051bcb0cf7100071e059e1bbc688aaef41ae1eedce07a35330731d448806f7d45ed839afa0937cc31199c9b6a892a4f54ce
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
resource yara_rule behavioral1/memory/2008-55-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2008-57-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2008-62-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2008-63-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2008-64-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2008-65-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral1/memory/2008-66-0x0000000000400000-0x0000000000608000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ 7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 948 set thread context of 2008 948 7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3.exe 27 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2008 7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3.exe 2008 7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 948 wrote to memory of 2008 948 7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3.exe 27 PID 948 wrote to memory of 2008 948 7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3.exe 27 PID 948 wrote to memory of 2008 948 7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3.exe 27 PID 948 wrote to memory of 2008 948 7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3.exe 27 PID 948 wrote to memory of 2008 948 7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3.exe 27 PID 948 wrote to memory of 2008 948 7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3.exe 27 PID 948 wrote to memory of 2008 948 7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3.exe 27 PID 948 wrote to memory of 2008 948 7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3.exe 27 PID 948 wrote to memory of 2008 948 7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3.exe"C:\Users\Admin\AppData\Local\Temp\7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3.exe"C:\Users\Admin\AppData\Local\Temp\7299a4d81ec242a0b24965bdf12cf85c18d474361e93a00457cc67deb928e0c3.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:2008
-