Resubmissions
17-04-2024 15:08
240417-sh9dfsdd79 1017-04-2024 15:08
240417-sh8rxseh9s 1017-04-2024 15:08
240417-sh76dsdd78 1017-04-2024 15:08
240417-sh7vmaeh8z 1017-04-2024 15:08
240417-sh684aeh8y 1015-04-2024 11:51
240415-n1dx2sdg29 1015-04-2024 11:51
240415-n1cd8aga41 1015-04-2024 11:48
240415-nygadsdf57 1015-04-2024 11:48
240415-nyfnvsfh8x 1015-04-2024 11:48
240415-nyfc4adf55 10Analysis
-
max time kernel
1191s -
max time network
1144s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
17-04-2024 15:08
General
-
Target
3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe
-
Size
1.2MB
-
MD5
c722f0a20113bb1488382daefda9a358
-
SHA1
4d269f0ec76a564f952c348b32a3b59c34bab2b4
-
SHA256
3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4
-
SHA512
534a1acdd94846138086a9912f8c2bcf154e0765f80d0a8432004687c76909fa9ab95adef24b8ec67b10cdff2aa59c50d0bf086e034e3b12f4ea484c7605e991
-
SSDEEP
24576:IIvEq8jlEBPkNShzxh7QjO+NhXh1l/JFfnE88smv:najiNOsbQjOuXh1lvESw
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies registry class 32 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 55 IoCs
-
Suspicious use of FindShellTrayWindow 44 IoCs
-
Suspicious use of SendNotifyMessage 23 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe"C:\Users\Admin\AppData\Local\Temp\3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
243KB
MD51b0862982ce26461d70335928b2fad45
SHA1a79d43cb841ff248a8a97ffba3603856d4fc09cd
SHA256b502863a5c2392f075893eb2db4b8631530ef89407053655ac134c1c7414a392
SHA512a54409cf584c2f8f8dbbea07eee2e215a53462075b7c075c06f96df08ce9b3d186403caaf8dbfd4ea7ef47907254a2ccf5ad2c9f2473373ea88004889e7aa756
-
Filesize
1024KB
MD569df9f0e34496de2b714243192c3a323
SHA117bbc178547486a02077de9b6c7204cfad8095d3
SHA256e031a63d3861071f16ad8ec27cf54fca39e1f3131a5b960983e7abb92cccaf66
SHA5125c178b9fc117cdf03a7f31e4b2461178df796091a98b4d07854ebbce1847b59637020260fa4c04870d27c78ce8580d1557d5e839c0291eb489481f8daa3f98d0
-
Filesize
7KB
MD572b78288f700dff230880068c7a047ee
SHA1f186052d3a7db6812de49974f736de92939770fe
SHA256076e173786dae456944e5d829dab356e95baf6c497dbee1ad775f4c2961d6f5f
SHA5122637eb117991122cdd1072bb676ed823f9ceb5ac8e5f4427ae45350e6148d4d04991380431c4f7e38a3462dc1cccfde29fa19d463291b5dc77b070f2a520bbe4
-
Filesize
1024KB
MD53aabc4bf6bdd14699294220f6a1f4729
SHA19a47a69b8371dc499aaf36df4949e4fd7c9c68d3
SHA256da398c29b43f27b898b0ab0b389c98d95eb0cc95232b7bd2a320c9817708be62
SHA512913f5746cc417e6010661a1d03ea59605e438c440b6db9c9775cc92bbf78ca61f5ab39f5cbcee2c0fcc684b941bacab8ea99ed24293212ff0065b8a69d63ffc2
-
Filesize
1024KB
MD549c171919e0d846e973a468024a71510
SHA1ed568605a8e9e1decd7b5db02be1a6aa744f7477
SHA256bc73544d1149eb5cc3cc72e93af3637c81d2e8b4e818c6766345f8b0c868bc1f
SHA512750baa04f8635367420aaeec47743933431c838e5543e7c7c0c124e454ae948e53c365bfb95baf506f40acc6b47b54d0a22dc1023af30401e23c023b352333ea
-
Filesize
24B
MD5ae6fbded57f9f7d048b95468ddee47ca
SHA1c4473ea845be2fb5d28a61efd72f19d74d5fc82e
SHA256d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
SHA512f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3
-
Filesize
7KB
MD588514bed1dbd866dc5026c141d99206b
SHA12598fc94ee02895852843673d910c961e8dba09e
SHA256f8bafb7d3c3608af6131c0a0c312c996b4621c7f5140686bc5a0c2b056c64666
SHA5120e3bcb186223e0a2993d23c2a55b7c85e9e59a97f2333128ba2ada79f436eaf1f94c626ce196b4331a758620c0d1b83061077cc63b5e1d3377e28058a7d52193
-
Filesize
7KB
MD5afedbf2ea918af1e22ad910df5a58a38
SHA1a7ac664931535710aa5650ada2dede931f182be6
SHA2565eaa714e3a6d22a73c087c9b13fc1582076552279be4c3138dbe926a91055986
SHA512922b6e2cfce4c54bdf6bd6682ae51b157c479f7bfd2bdfb8d5fac73dd616fc3583580356d9bfc9b912fe4dd06827179298e0f42c5eceb92422376a7ff8d59947
-
Filesize
96B
MD54c9a982c19c6d589511f86e4921a7682
SHA13474a16a7cfe8a5bbf21be0bffcc4ae6a0679233
SHA2564070b4e0d96024f058d14110972e6ffcd333f4d3f18c7c491ba15e58990a80be
SHA51273cac248ceade0c2f9b5c8cb3d80db244558f44951c3f9e1c2cefa7750b9aded3faa7b037bf2656931d8bd7f5952a743dc67a6dd1435accac3f80273d35bc5be
-
Filesize
2.6MB
MD5993cc909a89f0fb7fe90acc3703c2105
SHA1f422cdcb426718b235a19080b0daf71c9b448768
SHA2564aa6cdb9ce95410f85a05b21967d224cfd49cf8c7fa18d9998304a16d4e4b5d8
SHA5125ec562b1e6f91f8774bf8fd00a6a413b4b4b5be2ede17ff9c417fce7097b7d313b136740e525c19a77f220e80fb0e92f8f4d1866ea185c9fc6755c3b41aa9762
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
852KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
852KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
