Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
27/02/2024, 22:24
240227-2bnb3sdb2x 1027/02/2024, 22:23
240227-2a4mnsda9s 1027/02/2024, 22:21
240227-19v9xach75 1027/02/2024, 22:20
240227-186dgsda5s 10Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/02/2024, 22:23
Static task
static1
General
-
Target
-
Size
1.4MB
-
MD5
63210f8f1dde6c40a7f3643ccf0ff313
-
SHA1
57edd72391d710d71bead504d44389d0462ccec9
-
SHA256
2aab13d49b60001de3aa47fb8f7251a973faa7f3c53a3840cdf5fd0b26e9a09f
-
SHA512
87a89e8ab85be150a783a9f8d41797cfa12f86fdccb48f2180c0498bfd2b1040b730dee4665fe2c83b98d436453680226051b7f1532e1c0e0cda0cf702e80a11
-
SSDEEP
12288:WZgSKWk54jeg6lL5assQHtzV2KoLJ+PwXxwuLSJ8slf1zMr6iL/KNDx2PIXe2Q:KgoLetlLS8tz6V+PwD0XVMrXCNDxtK
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
resource yara_rule behavioral1/memory/1908-1-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1908-2-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1908-4-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1908-5-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1908-3-0x0000000000400000-0x00000000005DE000-memory.dmp upx behavioral1/memory/1908-9-0x0000000000400000-0x00000000005DE000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" [email protected] -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F381D211-D5BE-11EE-9D93-569FD5A164C1} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20cb85c8cb69da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f70000000002000000000010660000000100002000000007810ac4e6e1c82b6aa50e21d8853362b479729547d24e2dc74b81dd95d09abb000000000e80000000020000200000005f1a0d480abf79431d88d8bc3f7ab59440be9c075080bc2b4f561082936e733b9000000081ce777898b3dc5848988a900d979186a1db073c7fd1c14cb566dccdb18ffdedb4a53f753ad8aac72e732092d4f019e796e9469e0935723d89eb1a6692d3b79ab1ee2ddaf6445921de45010d2fd9468187bf695629acc80f5ade8fe10327b65e5667ddf4671da115c662383097adc41f362d25e80b1bcc1b5e1456a079364a1f18bd5f948dd509ea88b6ef0bd8a81732400000001bf502ff1badecceac9dfabc229de486f227ec8419f432bb406bddeac0354a97d0959f7eb005eec0f3962139a3f181147c5357f1124b5e185f0af28109be216f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000e697c862cc3fa5a56a2719f178e74e5bbaee62fcb9d9de7509ebbeaaba3d0909000000000e8000000002000020000000fee7817ca779fdb437c58d7d0f92bba211746e478067c238052bf14295f38ebe2000000054ef5882f5732c7d57309f2abfbdd164dc5d863be144db71c9b1a574bf6b988440000000efe08ed5627c879af5810e88f3a9d1f1d2654af253e201187ee159445cc8bf3e331d01b7d36e5af97684c769fa216bc29a05b67206f7b19afb73fb018d444919 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1908 [email protected] 1908 [email protected] -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2664 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2664 iexplore.exe 2664 iexplore.exe 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1908 [email protected] -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2664 wrote to memory of 2716 2664 iexplore.exe 30 PID 2664 wrote to memory of 2716 2664 iexplore.exe 30 PID 2664 wrote to memory of 2716 2664 iexplore.exe 30 PID 2664 wrote to memory of 2716 2664 iexplore.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1908
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\EditGroup.gif1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2716
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d916a69eb02c62c5b45e8f4dfc7e22cf
SHA14b77b688b53143c35307e5f93df6b0ab8e47f9ac
SHA2567859c87e63e993c06eba7372a4329b2de3f94f7826cd49ed53a15b3c0d0d8497
SHA512c13beaec3cd498d4c1595730973568d5dc2402cb99c5c56d884f8da4d376b40c622505589b0123bbfca4a2f64e801acf146dded393adbb54fe2bd118e53cca60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526be33eac2fc6847f0c99045de86b103
SHA1810e3a335e5d2826a564d951a4508f2c3e7d967e
SHA2567741a24ba38110e890138d1425476e6f02baa0a7443552e4f865c4f98905cb02
SHA51280b65e7cf41bb2bbf9e7e23872a1a2f5414a1cde1fe0385c817204ed5bb95328fce64c981f1ff6c35cd967b74dbecb05e2222653f83c1c3ae1054c3cec1ac602
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dea02918db88b92c4f95dca5d6ed17e5
SHA10945e60b047c636dbf6a3f9f39728753c8094034
SHA25633d48daa40aaa7aef87dbec5b3e584cb2307b2d3842cba11eb3c85b97c4bf9c4
SHA5121da5629c7783ee48a54075e904341acf3799b3460147f06be8a8360e0aeed180747f7efdf7fa888a4ff49ed12311945dc057dfbb878bf85b1b616f1bb25ad3c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e7e8c4edcb94d787d40b9c760327d1e
SHA128f2d4888cbfab0cfc70295be22275d75527860d
SHA256cd11d965caa9e2bb75c33ca002dd50f839de6561e862681500424f353b0bc79e
SHA512993f52f00e9ae2fa54a0a74544b579ef108b288254a41f52039a8028ef601cd9196569c2daf5cd178e0ea5af4b85c0cb262aab49938649249e7ff56eee44b0a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c87ae94a4da138ea943b25bdca1d6a82
SHA122f28176deedb2306245abefa25e6b1b04da0cbd
SHA2566ccaee14a1b1160224a83e2852e8daa797ca8d21d17de101960775248faad497
SHA512392528817ea1c20b12ecdff0739ef48c1272e12e2dbaaca8a57b549f0940b897c0e7457443c70bec43bf1a480317b2f9a7178877de8e3765da05bf0f1522e054
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5225de1ee9cc135757d8fd3919299a2b9
SHA1d00aa7da837799ea294e6a8bc84d4f343f16fa1d
SHA256fa5264a87143269437682c683e4893bc9748b0a7f498223b70a2e2295ed542f7
SHA512f2b03f8a96877bb872d4b398162b6fa28dc38187d85c58a2ee90895733ee02ae46fc2b9d387ec0200e03488bd8b51bcbb9e3c2f5a369e91a2bf5916eef45de1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac5694f1c33c23200bbf690285d95241
SHA11b4551e211110fbc4c317eeaa6017bb549a4f4ff
SHA25626dbcef69eb168f0bd63a49cdf1e3e1d46516c5517de70a331f7d654cd243c12
SHA512f5eb0f3610833c09bda05455153e6e9122f563931e67df078d6e861e108cbf4b3ec83f1be31681a4c6dc95818afa013ef49f63e8128733fc10e0099c1242020c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbda45db2c9b03efeedb7fe4ca56b5d4
SHA10f01a4e36d4f2b10a509b62cec0a5ed456fa2674
SHA256dc387aef34c24fd411ebd2e9afef9fe3c2f17b420573430c3fe6a0aa4f0c35d7
SHA512f23c62d7d82b914e16cae4664a7d44b4624fe0db5031efa6383503b08b9baf67c32752e79d647bc7f383c733a756d23617e28afcc5a87caf592569f5e9a75f79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdf8d3c48a4e2cde2783b845ecf747a1
SHA1dcded10c79d0ee452e5b7475df2495f602cb1fc3
SHA256254c14f73ce139cc4cc8c8c1742fbd623e9906086fdbc6de80c0d4ac8cadd6a8
SHA5121fc75a11051f4a5087d40e764212f333a88d7d4cb6f12b2915c929d0c50c569d37e59630a74fca7f331b3d6078ed93b079c5058a42fcff336bb167693bc712f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ccded9512e2217c06fc0ff26d3b9189
SHA1094411defb9f6845bb44272ef3d1f67f656a634d
SHA256e52f26b280667bdd56841259f3fb2aa546ed07ea038c8619ba4e9ac85fe15965
SHA5124192b4e345b92895f4bf2d8aad12845cfc3715bf6008311079f6a03e3cfa08762b0f5e1bbf91e0e35459db6c5e20210991a09dd4075b42b1d27d2e064f0e8d65
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
-
Filesize
16KB
MD59dec12962198e228a7270309355ff5ac
SHA1ec7419a9c1851015d4f8ea6dc19814b99d7d5b24
SHA256c0abeb889372c26084da9019ee8a211ace538df9eba85b05594d4ad2a8b9682d
SHA5125eab2016aee6b12637573d0ef3805cddc2e7dacf9aff011ae719dda3b3bfb7638b287cec220e4eb66cd740bb9852fd593b0899532a99352b0962e5045dfa477a