Analysis
- max time kernel
1197s - max time network
1061s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
- submitted
14/04/2024, 11:47
General
- Target ce7104bc850c5a07a867cadb8f4bfa59.exe
- Size 1.1MB
- Sample240414-nx1mmsbc21
- SHA256 cd2bc2ceb0e1b7d7c31f7a2aec7e838d3a90767ed3d02e1720170875e4a23cb6
Malware Config
Signatures
- Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 31 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce7104bc850c5a07a867cadb8f4bfa59.exe"C:\Users\Admin\AppData\Local\Temp\ce7104bc850c5a07a867cadb8f4bfa59.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1420-0-0x0000000000610000-0x00000000006E5000-memory.dmp
memory/1420-1-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-2-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-3-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-6-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-5-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-4-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-9-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-11-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-12-0x0000000000610000-0x00000000006E5000-memory.dmp
memory/1420-13-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-16-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-38-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-40-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-41-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-43-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-42-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-44-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-45-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-46-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-47-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-37-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-48-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-49-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-50-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-52-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-53-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-54-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-55-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-56-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-51-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-57-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-59-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-58-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-61-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-62-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-60-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-63-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-64-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-66-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-68-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-70-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-71-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-72-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-69-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-73-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-74-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-67-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-75-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-65-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-76-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-77-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-78-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-80-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-82-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-83-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-81-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-84-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-79-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-86-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-88-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-87-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-89-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-90-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-85-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-91-0x0000000000400000-0x0000000000608000-memory.dmp
memory/1420-92-0x0000000000400000-0x0000000000608000-memory.dmp