Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20231201-en -
resource tags
arch:x64arch:x86image:win10v2004-20231201-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2023, 18:48
Static task
static1
1 signatures
6 signatures
150 seconds
5 signatures
150 seconds
General
-
Target
-
Size
1.4MB
-
MD5
63210f8f1dde6c40a7f3643ccf0ff313
-
SHA1
57edd72391d710d71bead504d44389d0462ccec9
-
SHA256
2aab13d49b60001de3aa47fb8f7251a973faa7f3c53a3840cdf5fd0b26e9a09f
-
SHA512
87a89e8ab85be150a783a9f8d41797cfa12f86fdccb48f2180c0498bfd2b1040b730dee4665fe2c83b98d436453680226051b7f1532e1c0e0cda0cf702e80a11
-
SSDEEP
12288:WZgSKWk54jeg6lL5assQHtzV2KoLJ+PwXxwuLSJ8slf1zMr6iL/KNDx2PIXe2Q:KgoLetlLS8tz6V+PwD0XVMrXCNDxtK
Score
10/10
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
resource yara_rule behavioral2/memory/3596-1-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral2/memory/3596-2-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral2/memory/3596-3-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral2/memory/3596-4-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral2/memory/3596-5-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral2/memory/3596-9-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral2/memory/3596-10-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral2/memory/3596-11-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral2/memory/3596-12-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral2/memory/3596-13-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral2/memory/3596-16-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral2/memory/3596-17-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral2/memory/3596-18-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral2/memory/3596-19-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral2/memory/3596-20-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral2/memory/3596-21-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral2/memory/3596-22-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral2/memory/3596-23-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral2/memory/3596-24-0x0000000000400000-0x00000000005DE000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2192493100-457715857-1189582111-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" [email protected] -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3596 [email protected] 3596 [email protected] 3596 [email protected] 3596 [email protected]
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:3596