Resubmissions
18-03-2024 13:43
240318-q1nhlaag4w 10Analysis
-
max time kernel
1192s -
max time network
1021s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
14-04-2024 10:53
General
-
Target
3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe
-
Size
947KB
-
MD5
39217b125403ff7c755622ef9bbef974
-
SHA1
9fc607b7c17919c83999bdd119e9cd6bf413101a
-
SHA256
3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816
-
SHA512
1252ea94931eaf4426ca1eb94a070645238775c447a09286109fe894c569de29ca502882a0fa34e97e09109c43c486a3aa32081e3a3afef0b6557db59c71fc50
-
SSDEEP
12288:3+Zn/gJtKaNIBpB+iMMOD30ZnZ47m0T3JF9j3GOF0l7B2FzqL2aZa7rf58bs:3+RYeaNILZi/JDLG60y1aZvs
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 1 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe"C:\Users\Admin\AppData\Local\Temp\3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55c3bec99706c8598b345462892d6924c
SHA12d44e2b3bd3a9cdf98dd7859dd1c6263a8c6c048
SHA256b3c2d6892aee6dc6bebb507bd4a03626e70e52bb7ca30ad70ed6ce1d5ce3665a
SHA512478c8857a480742fd3dd5d4c2423ff6167276628cc0459c41f03c7e3aef68c8636daa58984b9238af9c78442ce343e68ae47b3736cccec144f4eae3469110ca3
-
Filesize
3KB
MD566fd4bd40686493c91313a7e6db7360d
SHA1fcf451c6a978d83b06929941485efb1c77f534b0
SHA256a9babb64258a62f62d1a0592e84ce8c90424ff9890d42662e2cadac2b470ca7d
SHA512a3f15cf6165d91635fa9f4b09cf034bdf8857546216fe0862505e57ff740333b9399585db66bd21f4c8c397f9938297a7e0dfbb877250154884b53692bb35f31
-
Filesize
4KB
MD5ab3cf23931ba1cab5d97820e88b464e0
SHA1d0880dcc221f8c9aeff3ddaddc38f21309401810
SHA256c49ab48ba3c3b9cb5ee703b4dfa41b65bc67aa0fd105d89f3f4d73f8040fbacc
SHA512f1902486fbcbaae64e00cba8eef74ea16b0e8562138e7672a37be659331724426d5c748aba1ed77a7ca9ce3287c3991140cc3c2fdb15efc87fd59315eb603ff6
-
Filesize
2KB
MD5169860a484f4bfa86db4785e6bb2d45d
SHA1c01ddf849865cd3ec34ca51c2ea3ee608ff0daef
SHA256bb383479e564a059dbe50f540e9484c4907e04e68e05040f00a2bafe5144c51a
SHA512da57f1089ece75b2671f150cb686fe84a599551499aff6af10ae35799c755caaeec249b367ab3d5a783702acc1cf6f07fd631ba12650ae5255821439304dd537
-
Filesize
2KB
MD5c392534e2b566dc8120f5463141bafe4
SHA1719c8acd3ca2eb45c9acd20f8dc6abb21eec1881
SHA2567a47d75d93702d1327c8e9040d502b372c681c7dd1b23dd754574df5948003f4
SHA5126803d0d1be8b739c0be7c5fb53bf5e6c2023378f8a904d0fc08866399a2e142d9aa0097eff1ec805c8fc0d8bdc938fa411f2b1a4daadd5d8efaa7207f41d557b
-
Filesize
3KB
MD530004041d49449a4a751919c451dbc1c
SHA17077fc7f8a5036f4be4a54aea4fd26e8b438bf5a
SHA256719a3d2cf812967a517e95ee0c55aa19e1d5f9e9721c59527ec0a305683a8467
SHA512f9209b9d4655d59befc3fb96b47547a5c1992d8c19382590b06c7a59dc0812f126427e58c910b1ca20c8fc48790c3ad33530765e0a222cc788fbe184e78377f6
-
Filesize
8KB
MD534794a8069f8c5a1b13ada9d635e74fb
SHA1b739de8c67ad90a33389444fdd11db26d3cb6783
SHA256b64249e2c6617c20d780d6f2d209ab40c096749e4fd7264a9c36096b99a27cc4
SHA51292cfd7b691f6481ecb5b1140704003775a356f7f8898c3e70b6eb23ddf743878e9acd0fcf125d304207a20f40104bb21209d1eac35672b89964513344822edda
-
Filesize
128KB
MD56d2dbfaf1d4c34ebe0932de9411cc733
SHA1e6d6a8256771cd83b17067f530e473fbbcb0eb4a
SHA256ad32a8a1821e8a07977871c087448926b9a463cd2f3b80732ee606ed9db3ce3d
SHA51285771106723a4e75bcf02cb3f0b5c9e9ef0e4f7b9827d5740513184bff07ac19df4427430dbf3151b8f141f36cad85e7a3a1794315433864fcc41e4e10a667d5
-
Filesize
3KB
MD58d85a8399f0fca88fab94ffbece62509
SHA1d18849a32b94f2bac42150897703576dee776ded
SHA256ecc68893ba0d4c397d5b9b91884de33a09b4c67982c3313cf0aabba67e8faba2
SHA5127e6eccc6694951b1cfd69272048dc7a61e98f2a33509a75e74c937c969e2d04e0a1157a34fc2ec3dbf4e38f823e1bebb0118c6def440633db55f928d5e55c1aa
-
Filesize
4KB
MD5cf34e2d93131b33fdad723f01535e1c4
SHA1107bcf26711b31fbd0e443ed96a0cbe8d6ddea96
SHA256e97333ac23c45e24e9903ce78cdb12b24a80d107868860bed23d94b47c9eda41
SHA512e869891ba801e4ded929b700bd4ca288fb5e085aa15206c45b2347785acfc1b71045f9aab56f522f1aa5cdcde083889bf27939e9d56fabc3689d5253042de5a4
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB