Analysis
-
max time kernel
117s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
28-01-2024 07:32
General
-
Target
7c8548dc28e0e2b14cfb953f4d2690b3.exe
-
Size
1.2MB
-
MD5
7c8548dc28e0e2b14cfb953f4d2690b3
-
SHA1
e70a729a4bbc5de08fa4461d3ba43098cb17b3b6
-
SHA256
e32998012af31476e39dedb2f725269dbd0a165d74b53a32e5e359da3a01221d
-
SHA512
e8c34edd78e5edb1872c54047a4c17bf97a3a282948ee59eb66812fb251f2d8a5d5ca04237492ca87b4119dbec795d47c7d6458ea015158caf05d35c292f5ddf
-
SSDEEP
12288:XpflAzWulcKX7yKCHqknCLv/gEOF0ZV/cgtx61slrEiv/Kc9Rf8/3cwd88888881:BlAzCEMKaMpjt02yiv/7Rf8/MwoTxBB
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c8548dc28e0e2b14cfb953f4d2690b3.exe"C:\Users\Admin\AppData\Local\Temp\7c8548dc28e0e2b14cfb953f4d2690b3.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
852KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
852KB
-
Filesize
2.0MB
-
Filesize
2.0MB