Resubmissions
18-03-2024 13:43
240318-q1nhlaag4w 10Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
18-03-2024 13:43
General
-
Target
3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe
-
Size
947KB
-
MD5
39217b125403ff7c755622ef9bbef974
-
SHA1
9fc607b7c17919c83999bdd119e9cd6bf413101a
-
SHA256
3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816
-
SHA512
1252ea94931eaf4426ca1eb94a070645238775c447a09286109fe894c569de29ca502882a0fa34e97e09109c43c486a3aa32081e3a3afef0b6557db59c71fc50
-
SSDEEP
12288:3+Zn/gJtKaNIBpB+iMMOD30ZnZ47m0T3JF9j3GOF0l7B2FzqL2aZa7rf58bs:3+RYeaNILZi/JDLG60y1aZvs
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
UPX dump on OEP (original entry point) 19 IoCs
-
UPX packed file 20 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe"C:\Users\Admin\AppData\Local\Temp\3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
154KB
MD5b23c2dca8d4a176f3af63c3a1cabf94b
SHA11957e744ca7e229efd58b9daa7b114e638c34fa5
SHA2566e51f3bf3cbc646eaa89af7435513eb2e52bc4ae47d2c901baaf88fda4a54c0d
SHA512fd0b733e134cb6c6c65d5b784c452db1ec7cddf8b8a0ce8d66bc7026e2289a6c2031f291284a079d711d9b255974ef0273f07cdedf8a43c7b2b933d86bd84d93
-
Filesize
112KB
MD52928bbac0d98feb8de1d649b741df66d
SHA17cd75031a0ea48cb6d7b9e8e460d4ef94dd2f7a9
SHA256ec0aa2156b26df68f0a86f9515f766f748714807cb422be4fbdd57d7d2c1b420
SHA512527e6823e2460de259498c131885f808d96367f2455df2c2deccd478ce0d592440b153574a6a682259e08d384c449e6b1883d5fab6862c4713d7826504b211df
-
Filesize
1.9MB
-
Filesize
800KB
-
Filesize
1.9MB
-
Filesize
800KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB