Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/D...

windows10-1703-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09-03-2024 17:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://github.com/Da2dalus/The-MALWARE-Repo/raw/master/Ransomware/NoMoreRansom.exe

Score
10/10
troldeshpersistenceransomwaretrojanupx

Malware Config

Signatures

  • Troldesh, Shade, Encoder.858

    Troldesh is a ransomware spread by malspam.

    ransomwaretrojantroldesh
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "https://github.com/Da2dalus/The-MALWARE-Repo/raw/master/Ransomware/NoMoreRansom.exe"
    1⤵
      PID:316
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2012
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of WriteProcessMemory
      PID:1128
      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\NoMoreRansom.exe
        "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\NoMoreRansom.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:2596
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4580
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2244
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:4128
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2300
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:2316
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2832
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:3496
        • C:\Windows\system32\ipconfig.exe
          ipconfig
          2⤵
          • Gathers network information
          PID:4380

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BDNVZVVU\edgecompatviewlist[1].xml
        Filesize

        74KB

        MD5

        d4fc49dc14f63895d997fa4940f24378

        SHA1

        3efb1437a7c5e46034147cbbc8db017c69d02c31

        SHA256

        853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

        SHA512

        cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\MPI9GFLR\suggestions[1].en-US
        Filesize

        17KB

        MD5

        5a34cb996293fde2cb7a4ac89587393a

        SHA1

        3c96c993500690d1a77873cd62bc639b3a10653f

        SHA256

        c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

        SHA512

        e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\NoMoreRansom.exe.wh0z82v.partial
        Filesize

        1.4MB

        MD5

        63210f8f1dde6c40a7f3643ccf0ff313

        SHA1

        57edd72391d710d71bead504d44389d0462ccec9

        SHA256

        2aab13d49b60001de3aa47fb8f7251a973faa7f3c53a3840cdf5fd0b26e9a09f

        SHA512

        87a89e8ab85be150a783a9f8d41797cfa12f86fdccb48f2180c0498bfd2b1040b730dee4665fe2c83b98d436453680226051b7f1532e1c0e0cda0cf702e80a11

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\1KA10RDX\NoMoreRansom[1].exe
        Filesize

        143KB

        MD5

        a2bf928f39de53a437898db8e0b6cd05

        SHA1

        ab54d5d3c22c52e7814d79575e71eda63dc5d6e0

        SHA256

        b325402b2f409e7a059f4eaedddee742c3b57a0df8251b2e5c2fcecfcb08c32b

        SHA512

        db7650360e8a313e0293375c13537c2ccf3e664a381c19bef149c81d3a8a06599d98424ab830c71ef4a476b2ad703c7f7e78a3c200308903c8d533f075fdf909

        Download Submit

      • memory/2012-16-0x00000225ED900000-0x00000225ED910000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2012-35-0x00000225EA9F0000-0x00000225EA9F2000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2012-0-0x00000225ED520000-0x00000225ED530000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2012-163-0x00000225F57D0000-0x00000225F57D1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2012-164-0x00000225F57E0000-0x00000225F57E1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2300-129-0x000001A7F29D0000-0x000001A7F29F0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2316-174-0x000002FE01D80000-0x000002FE01D82000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2316-172-0x000002FE01D60000-0x000002FE01D62000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2316-169-0x000002FE01D30000-0x000002FE01D32000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2596-201-0x0000000000400000-0x00000000005DE000-memory.dmp

        Filesize

        1.9MB

        Download

      • memory/2596-198-0x0000000002200000-0x00000000022CE000-memory.dmp

        Filesize

        824KB

        Download

      • memory/2596-202-0x0000000000400000-0x00000000005DE000-memory.dmp

        Filesize

        1.9MB

        Download

      • memory/2596-203-0x0000000000400000-0x00000000005DE000-memory.dmp

        Filesize

        1.9MB

        Download

      • memory/2596-200-0x0000000000400000-0x00000000005DE000-memory.dmp

        Filesize

        1.9MB

        Download

      • memory/2596-228-0x0000000000400000-0x00000000005DE000-memory.dmp

        Filesize

        1.9MB

        Download

      • memory/2596-229-0x0000000000400000-0x00000000005DE000-memory.dmp

        Filesize

        1.9MB

        Download

      • memory/2596-230-0x0000000000400000-0x00000000005DE000-memory.dmp

        Filesize

        1.9MB

        Download

      • memory/2596-232-0x0000000000400000-0x00000000005DE000-memory.dmp

        Filesize

        1.9MB

        Download

      • memory/2596-199-0x0000000000400000-0x00000000005DE000-memory.dmp

        Filesize

        1.9MB

        Download

      • memory/2596-259-0x0000000000400000-0x00000000005DE000-memory.dmp

        Filesize

        1.9MB

        Download

      • memory/2596-262-0x0000000000400000-0x00000000005DE000-memory.dmp

        Filesize

        1.9MB

        Download

      • memory/2596-263-0x0000000000400000-0x00000000005DE000-memory.dmp

        Filesize

        1.9MB

        Download

      • memory/2596-264-0x0000000000400000-0x00000000005DE000-memory.dmp

        Filesize

        1.9MB

        Download

      • memory/2596-265-0x0000000000400000-0x00000000005DE000-memory.dmp

        Filesize

        1.9MB

        Download

      • memory/2596-266-0x0000000000400000-0x00000000005DE000-memory.dmp

        Filesize

        1.9MB

        Download

      • memory/2596-267-0x0000000000400000-0x00000000005DE000-memory.dmp

        Filesize

        1.9MB

        Download

      • memory/2596-268-0x0000000000400000-0x00000000005DE000-memory.dmp

        Filesize

        1.9MB

        Download