Resubmissions

29-01-2023 18:07

230129-wqck8sgd68 10

Analysis

  • max time kernel
    1191s
  • max time network
    1134s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    14-04-2024 12:17

General

  • Target

    e5379ed6dfd3130a49dcddcdddec6b21c7f90d7dee15fc9219e7ccaa0fad87d4.exe

  • Size

    1.1MB

  • MD5

    7e921e11caeb6f9594fa286d217af62e

  • SHA1

    9253c2e0c30b7279fe6cf6a052b55b2b43ee2f84

  • SHA256

    e5379ed6dfd3130a49dcddcdddec6b21c7f90d7dee15fc9219e7ccaa0fad87d4

  • SHA512

    8d5af1af21e4a24d5546515d9f2af5a51598de7e5e335e139c38f5f426fdb0359dabb00ea6e0d0b84846781be553a8ab234b1b6c9cdf429100569101ba055fcc

  • SSDEEP

    12288:n0FWRGqrviIa4un1WnkOJz2CFBsZX/STM3f7rUuWe+UmXELXSLbFUhNl7T7R+UtU:MunKIaNAnkOEKBslQU8ELitm/DtVy

Malware Config

Signatures

  • Troldesh, Shade, Encoder.858

    Troldesh is a ransomware spread by malspam.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Interacts with shadow copies 2 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of FindShellTrayWindow 44 IoCs
  • Suspicious use of SendNotifyMessage 23 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e5379ed6dfd3130a49dcddcdddec6b21c7f90d7dee15fc9219e7ccaa0fad87d4.exe
    "C:\Users\Admin\AppData\Local\Temp\e5379ed6dfd3130a49dcddcdddec6b21c7f90d7dee15fc9219e7ccaa0fad87d4.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1888
    • C:\Windows\system32\vssadmin.exe
      C:\Windows\system32\vssadmin.exe List Shadows
      2⤵
      • Interacts with shadow copies
      PID:3580
    • C:\Windows\system32\vssadmin.exe
      C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:3988
    • C:\Windows\system32\vssadmin.exe
      C:\Windows\system32\vssadmin.exe List Shadows
      2⤵
      • Interacts with shadow copies
      PID:2792
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4600
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Enumerates connected drives
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3724
  • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4584

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

4
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

4
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

4
T1082

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

2
T1490

Defacement

1
T1491

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\System32\xfs
    Filesize

    135KB

    MD5

    f18e1810b6039d18d92ece33b666bb47

    SHA1

    ad5c58bc5fbff5e63802e76c506b22695b8e126f

    SHA256

    f862d62977a135228f08bb64d7b08c05b8c878c4a89744e62c80bed34fe3c2da

    SHA512

    9a20b8a4ec6f50bc07769ded7ad2cf07f664b75e8340c1698967d33ba24ad7a68a0c9bd79eef4a88902d69d82c85849e2a53565e65eecb9d6ac9c2b17723eeed

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
    Filesize

    1024KB

    MD5

    c54cde3ceede65db57e1ef09429038d6

    SHA1

    d40df43ca2538ba8f23eb8d5e6ba48c6cd1a29a7

    SHA256

    80a0bcaaf774d79edb86f7cf3793bb8d584f3b74a67112b7b7b651aa762240eb

    SHA512

    1677ee5d05e7357550bf0b45d5f077557e3835d066ac930692112c69c4719a4f618af33f8531b9b99f202d3e69716e2f53faa7da0c8092ffa22a43b585777f2b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
    Filesize

    1024KB

    MD5

    e3cae80d58dfdaf9c3bf28c3494db2c3

    SHA1

    b37ee81d7e1a4bc53bdce4ae82f3ff3b6f2102ad

    SHA256

    0a592657e5b6c873acbede837e3b045b5975c56ba35ed9740edb91988fbd7cc0

    SHA512

    2b284c3da3f3afdfbaf58277f4a244ff657b8f05fcf9fdcb1c805a966726f24187b5f38b8580715e72366bfeb626a08b8164bcb1614b9e9036757e2959dab93a

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
    Filesize

    7KB

    MD5

    53a1264b64e3b5b0d8f3c913e97524e2

    SHA1

    85a684869f8721cb327cf7f6fb3ce8f2b39e80e9

    SHA256

    9353985c11ae4085208fcd8527fe754bf3feda7bc1c93efe0ba0bcf98f37594a

    SHA512

    c50ee6e14cae24769d211e46bebd7bebfc684132baa1f67930434709505acbd1b74885efc28acd8c3c43885f12599e135594dcca89c96ccbd6b7a11689da945a

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
    Filesize

    7KB

    MD5

    03e1867fe2e1224c5571479a0d8e53f1

    SHA1

    306671155a0a8662e057d3acfb1453a3bd1abc0f

    SHA256

    fb5b70f76e4609572a3371ab56f9512d4fd1d2beb6e8b45d14f52669091bb4ea

    SHA512

    6f17d7a22b5028b05092ac8c04c6eabc3eea8091f0198c72fd79d5939f3c4cba517ac0398280142cee63d6ee028191530af16f93cc70e0b54ed7189fbc712cfd

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db
    Filesize

    1024KB

    MD5

    eba4e0b01ffe34626b5e200d18741b66

    SHA1

    1b5c320a0d0df24fa823d3e7d089e25a0db6a0a5

    SHA256

    ff580f5b35bf1846a5250e56ee820d7fa1c7adb54784562da5907ee0d896d438

    SHA512

    909910ec8fd0041f61935533779c4c0dbf4848b4a1d688cb1c37139cfdcaef3b3e49f7e747fd015efa0da4446de7b9098bdb5724fc683fc52e634b6daa2f45db

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
    Filesize

    24B

    MD5

    ae6fbded57f9f7d048b95468ddee47ca

    SHA1

    c4473ea845be2fb5d28a61efd72f19d74d5fc82e

    SHA256

    d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9

    SHA512

    f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
    Filesize

    7KB

    MD5

    834ea5b8eae0cc502fffec8ed6ff4b7c

    SHA1

    c5b4e9d46caa0fc37d75aefbf51dc645b5c71fd4

    SHA256

    8c32b3ae58dea844c66d3b1a76ea614c55f71a08bc6f223e73ceb6457855a674

    SHA512

    51d2604b87a39b1cb90692332d9b88ea15d4970a36c8d1c8646b1cf3ec9737bd71a12d66a27ae3087d43289969a939042bc389a4b5875ca3ddb2a087ccac80ff

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
    Filesize

    7KB

    MD5

    4b4d56c6d633d3f7941d63b0aad90ab2

    SHA1

    8089e2d1292136f30976fb68887907590a4f80fc

    SHA256

    b5bc44d76798a3dc10d470ecb8d32d95a93fa9b232c83c1e224284ef5849c4b3

    SHA512

    2cb25c6cd01faeb4d3326be1462905a33a50ae22a93a64a6a47cb5cc2d70ee2578ea78f993ca84f6294e808ad81d6373b2322c21440bd3a69a9f1af76e71b08e

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MOQY2KJ2\microsoft.windows[1].xml
    Filesize

    97B

    MD5

    8469d80baa0dfd009d2edf9a0b23c0dc

    SHA1

    29a657d1f292de4f1629c7c39a4a79804bffc407

    SHA256

    ac1f017a55d5ba213e187390bc3864c2c29fd7fe89a7c1b3a135847138397acf

    SHA512

    19674c46a0066568bfa6c8479fc8c4ba29c9089c238bb1c121ba45d476601e55165e880c9025395029f7d6b41f7c8114f25e40687b42ac67d618ada136df9123

  • C:\Users\Admin\AppData\Roaming\0432FDBA0432FDBA.bmp
    Filesize

    2.6MB

    MD5

    993cc909a89f0fb7fe90acc3703c2105

    SHA1

    f422cdcb426718b235a19080b0daf71c9b448768

    SHA256

    4aa6cdb9ce95410f85a05b21967d224cfd49cf8c7fa18d9998304a16d4e4b5d8

    SHA512

    5ec562b1e6f91f8774bf8fd00a6a413b4b4b5be2ede17ff9c417fce7097b7d313b136740e525c19a77f220e80fb0e92f8f4d1866ea185c9fc6755c3b41aa9762

  • memory/1888-39-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-45-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-12-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-13-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-14-0x00000000022B0000-0x0000000002385000-memory.dmp
    Filesize

    852KB

  • memory/1888-15-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-16-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-17-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-20-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-21-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-22-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-23-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-24-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-25-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-26-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-27-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-28-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-29-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-30-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-31-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-32-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-33-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-34-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-35-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-36-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-37-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-38-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-8-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-40-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-41-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-42-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-43-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-44-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-11-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-46-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-47-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-48-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-49-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-50-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-51-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-52-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-53-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-54-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-55-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-56-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-57-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-58-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-59-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-60-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-61-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-62-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-63-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-64-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-65-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-66-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-5-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-4-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-3-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-2-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-1-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-0-0x00000000022B0000-0x0000000002385000-memory.dmp
    Filesize

    852KB

  • memory/1888-67-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-68-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-69-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-70-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB

  • memory/1888-71-0x0000000000400000-0x0000000000608000-memory.dmp
    Filesize

    2.0MB