Resubmissions
18-03-2024 13:43
240318-q1nhlaag4w 10Analysis
-
max time kernel
591s -
max time network
395s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
14-04-2024 10:53
General
-
Target
3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe
-
Size
947KB
-
MD5
39217b125403ff7c755622ef9bbef974
-
SHA1
9fc607b7c17919c83999bdd119e9cd6bf413101a
-
SHA256
3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816
-
SHA512
1252ea94931eaf4426ca1eb94a070645238775c447a09286109fe894c569de29ca502882a0fa34e97e09109c43c486a3aa32081e3a3afef0b6557db59c71fc50
-
SSDEEP
12288:3+Zn/gJtKaNIBpB+iMMOD30ZnZ47m0T3JF9j3GOF0l7B2FzqL2aZa7rf58bs:3+RYeaNILZi/JDLG60y1aZvs
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 7 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe"C:\Users\Admin\AppData\Local\Temp\3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 9562⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 10922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 11922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 12082⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 12202⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 11722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 12602⤵
- Program crash
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5bfca410f6a21866be24873211e385650
SHA1f33e4e4680119b7fb37bc26668c05950d5936e54
SHA2565d32e8e988f77e8da5b892022b2bebf3f62ceb56d6faca8c2fb08fd23a000ae1
SHA512d833ee1e1e93600f2718f5c65b0e451667363565df18f87f0997eb2bd57790a4233805a37f36a38a786a340aea0a7001206fae65804fd1022f5a97c91d40362f
-
Filesize
25KB
MD5ec980bb131b4c8d221c428859fd170e0
SHA1410c1d26a6139c377a7f52a57ce5e7a9b0f5885a
SHA256c53040ada9c3fff355a9092e23855e4077aa8f6fea1c3b458b56660125e6b99f
SHA5123cfcc3961e8059118b85e28f7be8bb46df46e68401248c767c12198f9ec0b580c77dd2fa441c0424c721cd1e916a2634845a43098a837e64e0162dc32d35bc22
-
Filesize
155KB
MD524432dcb90205dbe5b991332b17044ef
SHA1a90461f6da07c85f52d9b0717b79bbe953df96e7
SHA2563a94e913f903c04b9cd61754cb1c9a0765544a4360468387ff6471758fc32079
SHA5125cf6ac4964b2fa4802e3f827803b35cd22f3a8430818ae778d23ee9d9da85c19f721a12fa75c3f437ae27599edbe84b81645b919c2508ad6184d4be2a6123053
-
Filesize
182B
MD5fb3d513f3cc93f691c61e68810b45562
SHA15fb4d6b5d8c5f0b2ff83e417a34c87211b9c8b79
SHA2567e5cd2717f8164e69b9e65198d44da416db4ebf57998f0377eb2cd4bd4535b67
SHA51294d56a3c46673df6116340c9af3ffb50b862fbea4529e757fd596014b0f4016eca1b6a5c50b6111c4c526223d6a8b02c118b8f4e15d753dbd4adb377ca5d4c88
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB