Resubmissions
17-04-2024 15:08
240417-sh9dfsdd79 1017-04-2024 15:08
240417-sh8rxseh9s 1017-04-2024 15:08
240417-sh76dsdd78 1017-04-2024 15:08
240417-sh7vmaeh8z 1017-04-2024 15:08
240417-sh684aeh8y 1015-04-2024 11:51
240415-n1dx2sdg29 1015-04-2024 11:51
240415-n1cd8aga41 1015-04-2024 11:48
240415-nygadsdf57 1015-04-2024 11:48
240415-nyfnvsfh8x 1015-04-2024 11:48
240415-nyfc4adf55 10Analysis
-
max time kernel
1191s -
max time network
922s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
15-04-2024 11:51
General
-
Target
3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe
-
Size
1.2MB
-
MD5
c722f0a20113bb1488382daefda9a358
-
SHA1
4d269f0ec76a564f952c348b32a3b59c34bab2b4
-
SHA256
3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4
-
SHA512
534a1acdd94846138086a9912f8c2bcf154e0765f80d0a8432004687c76909fa9ab95adef24b8ec67b10cdff2aa59c50d0bf086e034e3b12f4ea484c7605e991
-
SSDEEP
24576:IIvEq8jlEBPkNShzxh7QjO+NhXh1l/JFfnE88smv:najiNOsbQjOuXh1lvESw
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies registry class 32 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 44 IoCs
-
Suspicious use of SendNotifyMessage 23 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe"C:\Users\Admin\AppData\Local\Temp\3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
126KB
MD5dfadb4f2f9e0000ec76ed40372fd95ef
SHA1472995f282d73659c23359ec74aa00c691e9fb9c
SHA256c8162e67b463e732905b87a3d66e527b7c672df780c99575fab1b22d3510097a
SHA512d82f06dea7dd672f616870dc0814900eec6690598ed2fd827aa8b7780f55b74b2e289a1b1d04af7f5c0e539d881c8bc0cc2ed328b47a1d2bd59f41cb76cbf73b
-
Filesize
1024KB
MD5f5fef41e3d9b7053177844b3f94d8b61
SHA1c0c6384f2e0b56c6ac0b999d8584a2bc9509d20e
SHA25668431ab4b4a76a1a635df107e402a68d272c88729c157e5de0fbdf84523b879e
SHA5127039fbe40f264b4a79df4219fbee8952ad0d05a2501cf9ca5cfd28adc86558dc6df1a2568e486d06b6f50566f1ce74b7b9d0796891b5d1dbabcf077fa7dbd885
-
Filesize
1024KB
MD56748fd775a5d998c92deb92f0fddabdf
SHA1b18c72611974846620065a5a95674d4791bee9a9
SHA256195c499bf00663471a2dc16be16ae2ae8cebd80896aa2302f2fa16f61119a99e
SHA51269839266bbb26c1fd54f2bfe432e3d71fbd8151c656b516eb89d222f73cd3b301d93ddb2e73fc6259fa92c412dc921310b86fe6177ac619fc7866ae832debfc6
-
Filesize
7KB
MD575430994a9d6eb12d7d466adc7721020
SHA10f304f258fec9553341dffe96b752e9e086d265b
SHA25639a780d6a9729f61a05bec79ae999168eaab1a60ad23ba6e63387fc084f1f142
SHA5127ddda9b9d99cb59f11b079830268ad750b99c8368cffa00e552197816b829e307d2879d039023485ab6a5c21df7627376376c31a81966ea5dcad130848b18b8c
-
Filesize
7KB
MD514b693a03ed013519340604f4933abc3
SHA1ac67ca7abdda231ce4b7a939d757b1b878f23855
SHA256638f32c065804dee1b7e396cc3951684322f549c2c9c0aa8e28441abd1e02c82
SHA512b7c241bac88fc1e14700fd6bc54cfdb314394090cd1ec7da3fe96e8021789a910294cd5391b33504ef01b52cf23d91bb72e7d4af7d94defc5e8722763a260929
-
Filesize
1024KB
MD54a5f8cd23701d2608ec285ef1ac4511c
SHA1494c53f4572c074d5f4c9a5c79cc00c8934469dc
SHA256bb9b1cc0b9ced91e5dc883a57c56e89ba2c1069bb33c567b9f5996ea382b76fb
SHA512c675051f8250f67c2d998a62ac09924176129295e663a77ed55812170f1837a0cad21f06064f03e65b7add0efb2a4c41bdc88f2eea84a53e68ee95895a969e34
-
Filesize
1024KB
MD5edc4fbe9cef5daa25e40fa9ce0d394ed
SHA1d7230a0e93013e6a34b07a58c38cd492000cb28f
SHA2567cbaec95d6644e8651f26502d0438398bf295acbb204b55c390788d72b71cbba
SHA5120c6458bdbc2a39688587898d05d4f866ec23685b01b249c5cdb453c8f41225e315b6a548f0f1b11dba74cfbfafc8d76060e2ca29638f646b57396647d6b4a9f8
-
Filesize
24B
MD5ae6fbded57f9f7d048b95468ddee47ca
SHA1c4473ea845be2fb5d28a61efd72f19d74d5fc82e
SHA256d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
SHA512f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3
-
Filesize
7KB
MD56f6a64f29f4f92e2864508559cb56a9b
SHA18b97726548e31fa0da0050d0f861f4f10e0e8c03
SHA256dc935f3fd8a2999918ae5a15b0389376ab84de3dda4298b64b0faf2df155d064
SHA512fee966bf5405fcaee3dda8f7d887822b1125c9e72779f0e7d672e286e587047b741b5f34f65825951142b4663e0be44062e031fa13aeb4014e2f5e4c2be20670
-
Filesize
7KB
MD59e86440344c2649808f63b0d47f0291c
SHA1c270415ce2c280d766771cae055ea2d49f66b79c
SHA2565a74dfe38cd4e2e5120087915f8d01f25b97bc519fcc69d79fa8fdfdf1c3870f
SHA512eefd086a022ddfd092c41b7a72c291d86cd4a1b569c1495b61c989a84896d54ad76038cf4518eba1164edd80ddf405ce72abe6141789769d48825ae482f48e30
-
Filesize
97B
MD5485f56e033ffb1968764c4e380aec989
SHA1e859f0ff3347a7a694ca0018ef25fc8b211fd817
SHA256090b53b31caf7c0e61ff7304db404909e61679ccd3dd4f636add3eaec7e7c201
SHA512dc47dc0e9d20b795183bec398924e63775169d256e919367b954cfc4e0e2522c4067a0aede7edc0c44f96525d33e6332f0e81bbe4bf1bc10c06119470f4f29d8
-
Filesize
2.6MB
MD5993cc909a89f0fb7fe90acc3703c2105
SHA1f422cdcb426718b235a19080b0daf71c9b448768
SHA2564aa6cdb9ce95410f85a05b21967d224cfd49cf8c7fa18d9998304a16d4e4b5d8
SHA5125ec562b1e6f91f8774bf8fd00a6a413b4b4b5be2ede17ff9c417fce7097b7d313b136740e525c19a77f220e80fb0e92f8f4d1866ea185c9fc6755c3b41aa9762
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
852KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
852KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
