Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
30/12/2023, 09:02
231230-kzgqrsedaj 10Analysis
-
max time kernel
196s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 09:02
Static task
static1
Behavioral task
behavioral1
Sample
13ff5145f905b197eee478e565e30f4e.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
13ff5145f905b197eee478e565e30f4e.exe
Resource
win10v2004-20231215-en
General
-
Target
13ff5145f905b197eee478e565e30f4e.exe
-
Size
1.2MB
-
MD5
13ff5145f905b197eee478e565e30f4e
-
SHA1
5d983937eeb3ce1455eed52bb478c84d54d64f81
-
SHA256
df2894b4298be05620b329d27bf0b45314629316fd6a082b6d90bbdfe9bf5a53
-
SHA512
02a97bcca38b98d481e05bb8216d22bc893594d887b45bb9c87732c0f030dcdcdc40e3f1d3a5954751e888a3056bd44996ea7e36eca37f4977642ef38da417ca
-
SSDEEP
24576:XHtrdKYVVSrqGDohJ3STZG8vIn/sCBGnWsY0Dy2:XHtV7GwBSTc8An/4YF2
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
resource yara_rule behavioral2/memory/4072-1-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/4072-2-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/4072-3-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/4072-4-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/4072-5-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/4072-7-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/4072-11-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/4072-12-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/4072-14-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/4072-15-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/4072-16-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/4072-17-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/4072-18-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/4072-21-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/4072-22-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/4072-23-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/4072-24-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/4072-25-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/4072-26-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/4072-27-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/4072-28-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral2/memory/4072-29-0x0000000000400000-0x0000000000608000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" 13ff5145f905b197eee478e565e30f4e.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4072 13ff5145f905b197eee478e565e30f4e.exe 4072 13ff5145f905b197eee478e565e30f4e.exe 4072 13ff5145f905b197eee478e565e30f4e.exe 4072 13ff5145f905b197eee478e565e30f4e.exe