Resubmissions
17/04/2024, 12:14
240417-pesdzsfh4y1017/04/2024, 12:14
240417-persfsfh4x1017/04/2024, 12:14
240417-peqv6aec971017/04/2024, 12:14
240417-pedktsfh3z1017/04/2024, 12:14
240417-peczasec871017/04/2024, 06:32
240417-ha37csfh6710Analysis
- max time kernel
1556s - max time network
1562s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
17/04/2024, 12:14
General
- Target c4a48fbe5df0c9b765899f3edf6e1003fd3a2a6bcc39d1b3a0343bb246b78856.exe
- Size 1.1MB
- Sample240417-peqv6aec97
- SHA256 c4a48fbe5df0c9b765899f3edf6e1003fd3a2a6bcc39d1b3a0343bb246b78856
Malware Config
Signatures
- Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4a48fbe5df0c9b765899f3edf6e1003fd3a2a6bcc39d1b3a0343bb246b78856.exe"C:\Users\Admin\AppData\Local\Temp\c4a48fbe5df0c9b765899f3edf6e1003fd3a2a6bcc39d1b3a0343bb246b78856.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
xfs
memory/2776-0-0x0000000000400000-0x000000000060B000-memory.dmp
memory/2776-1-0x00000000002E0000-0x00000000003AE000-memory.dmp
memory/2776-2-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-3-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-4-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-5-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-9-0x0000000000400000-0x000000000060B000-memory.dmp
memory/2776-10-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-13-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-34-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-35-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-36-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-39-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-38-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-40-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-37-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-41-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-42-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-43-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-45-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-44-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-47-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-48-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-49-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-46-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-51-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-50-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-52-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-53-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-54-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-55-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-56-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-57-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-58-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-60-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-59-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-61-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-62-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-63-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-64-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-65-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-67-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-68-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-69-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-70-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-66-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-71-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-72-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-73-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-74-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-76-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-77-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-75-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-78-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-79-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-80-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-82-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-81-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-83-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-84-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-85-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-86-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-87-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-88-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-89-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-92-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-91-0x0000000000400000-0x00000000005DE000-memory.dmp
memory/2776-90-0x0000000000400000-0x00000000005DE000-memory.dmp