Resubmissions

17-04-2024 15:08

240417-sh9dfsdd79 10

17-04-2024 15:08

240417-sh8rxseh9s 10

17-04-2024 15:08

240417-sh76dsdd78 10

17-04-2024 15:08

240417-sh7vmaeh8z 10

17-04-2024 15:08

240417-sh684aeh8y 10

15-04-2024 11:51

240415-n1dx2sdg29 10

15-04-2024 11:51

240415-n1cd8aga41 10

15-04-2024 11:48

240415-nygadsdf57 10

15-04-2024 11:48

240415-nyfnvsfh8x 10

15-04-2024 11:48

240415-nyfc4adf55 10

Analysis

  • max time kernel
    1191s
  • max time network
    1144s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    17-04-2024 15:08

General

  • Target

    3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe

  • Size

    1.2MB

  • MD5

    c722f0a20113bb1488382daefda9a358

  • SHA1

    4d269f0ec76a564f952c348b32a3b59c34bab2b4

  • SHA256

    3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4

  • SHA512

    534a1acdd94846138086a9912f8c2bcf154e0765f80d0a8432004687c76909fa9ab95adef24b8ec67b10cdff2aa59c50d0bf086e034e3b12f4ea484c7605e991

  • SSDEEP

    24576:IIvEq8jlEBPkNShzxh7QjO+NhXh1l/JFfnE88smv:najiNOsbQjOuXh1lvESw

Malware Config

Signatures

  • Troldesh, Shade, Encoder.858

    Troldesh is a ransomware spread by malspam.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Interacts with shadow copies 2 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of FindShellTrayWindow 44 IoCs
  • Suspicious use of SendNotifyMessage 23 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe
    "C:\Users\Admin\AppData\Local\Temp\3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Windows\system32\vssadmin.exe
      C:\Windows\system32\vssadmin.exe List Shadows
      2⤵
      • Interacts with shadow copies
      PID:3272
    • C:\Windows\system32\vssadmin.exe
      C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Interacts with shadow copies
      PID:2592
    • C:\Windows\system32\vssadmin.exe
      C:\Windows\system32\vssadmin.exe List Shadows
      2⤵
      • Interacts with shadow copies
      PID:660
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1428
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Enumerates connected drives
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3888
  • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3084

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\System32\xfs

    Filesize

    243KB

    MD5

    1b0862982ce26461d70335928b2fad45

    SHA1

    a79d43cb841ff248a8a97ffba3603856d4fc09cd

    SHA256

    b502863a5c2392f075893eb2db4b8631530ef89407053655ac134c1c7414a392

    SHA512

    a54409cf584c2f8f8dbbea07eee2e215a53462075b7c075c06f96df08ce9b3d186403caaf8dbfd4ea7ef47907254a2ccf5ad2c9f2473373ea88004889e7aa756

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db

    Filesize

    1024KB

    MD5

    69df9f0e34496de2b714243192c3a323

    SHA1

    17bbc178547486a02077de9b6c7204cfad8095d3

    SHA256

    e031a63d3861071f16ad8ec27cf54fca39e1f3131a5b960983e7abb92cccaf66

    SHA512

    5c178b9fc117cdf03a7f31e4b2461178df796091a98b4d07854ebbce1847b59637020260fa4c04870d27c78ce8580d1557d5e839c0291eb489481f8daa3f98d0

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

    Filesize

    7KB

    MD5

    72b78288f700dff230880068c7a047ee

    SHA1

    f186052d3a7db6812de49974f736de92939770fe

    SHA256

    076e173786dae456944e5d829dab356e95baf6c497dbee1ad775f4c2961d6f5f

    SHA512

    2637eb117991122cdd1072bb676ed823f9ceb5ac8e5f4427ae45350e6148d4d04991380431c4f7e38a3462dc1cccfde29fa19d463291b5dc77b070f2a520bbe4

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db

    Filesize

    1024KB

    MD5

    3aabc4bf6bdd14699294220f6a1f4729

    SHA1

    9a47a69b8371dc499aaf36df4949e4fd7c9c68d3

    SHA256

    da398c29b43f27b898b0ab0b389c98d95eb0cc95232b7bd2a320c9817708be62

    SHA512

    913f5746cc417e6010661a1d03ea59605e438c440b6db9c9775cc92bbf78ca61f5ab39f5cbcee2c0fcc684b941bacab8ea99ed24293212ff0065b8a69d63ffc2

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db

    Filesize

    1024KB

    MD5

    49c171919e0d846e973a468024a71510

    SHA1

    ed568605a8e9e1decd7b5db02be1a6aa744f7477

    SHA256

    bc73544d1149eb5cc3cc72e93af3637c81d2e8b4e818c6766345f8b0c868bc1f

    SHA512

    750baa04f8635367420aaeec47743933431c838e5543e7c7c0c124e454ae948e53c365bfb95baf506f40acc6b47b54d0a22dc1023af30401e23c023b352333ea

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db

    Filesize

    24B

    MD5

    ae6fbded57f9f7d048b95468ddee47ca

    SHA1

    c4473ea845be2fb5d28a61efd72f19d74d5fc82e

    SHA256

    d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9

    SHA512

    f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

    Filesize

    7KB

    MD5

    88514bed1dbd866dc5026c141d99206b

    SHA1

    2598fc94ee02895852843673d910c961e8dba09e

    SHA256

    f8bafb7d3c3608af6131c0a0c312c996b4621c7f5140686bc5a0c2b056c64666

    SHA512

    0e3bcb186223e0a2993d23c2a55b7c85e9e59a97f2333128ba2ada79f436eaf1f94c626ce196b4331a758620c0d1b83061077cc63b5e1d3377e28058a7d52193

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

    Filesize

    7KB

    MD5

    afedbf2ea918af1e22ad910df5a58a38

    SHA1

    a7ac664931535710aa5650ada2dede931f182be6

    SHA256

    5eaa714e3a6d22a73c087c9b13fc1582076552279be4c3138dbe926a91055986

    SHA512

    922b6e2cfce4c54bdf6bd6682ae51b157c479f7bfd2bdfb8d5fac73dd616fc3583580356d9bfc9b912fe4dd06827179298e0f42c5eceb92422376a7ff8d59947

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GO5H5QJ1\microsoft.windows[1].xml

    Filesize

    96B

    MD5

    4c9a982c19c6d589511f86e4921a7682

    SHA1

    3474a16a7cfe8a5bbf21be0bffcc4ae6a0679233

    SHA256

    4070b4e0d96024f058d14110972e6ffcd333f4d3f18c7c491ba15e58990a80be

    SHA512

    73cac248ceade0c2f9b5c8cb3d80db244558f44951c3f9e1c2cefa7750b9aded3faa7b037bf2656931d8bd7f5952a743dc67a6dd1435accac3f80273d35bc5be

  • C:\Users\Admin\AppData\Roaming\2731873627318736.bmp

    Filesize

    2.6MB

    MD5

    993cc909a89f0fb7fe90acc3703c2105

    SHA1

    f422cdcb426718b235a19080b0daf71c9b448768

    SHA256

    4aa6cdb9ce95410f85a05b21967d224cfd49cf8c7fa18d9998304a16d4e4b5d8

    SHA512

    5ec562b1e6f91f8774bf8fd00a6a413b4b4b5be2ede17ff9c417fce7097b7d313b136740e525c19a77f220e80fb0e92f8f4d1866ea185c9fc6755c3b41aa9762

  • memory/2424-39-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-44-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-11-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-12-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-13-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-14-0x0000000002220000-0x00000000022F5000-memory.dmp

    Filesize

    852KB

  • memory/2424-15-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-16-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-17-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-18-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-19-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-22-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-23-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-24-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-25-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-26-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-27-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-28-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-29-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-30-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-31-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-32-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-33-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-34-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-35-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-36-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-37-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-38-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-7-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-40-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-41-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-42-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-43-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-3-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-45-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-46-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-47-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-48-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-49-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-50-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-51-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-52-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-53-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-54-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-55-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-56-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-57-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-58-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-59-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-60-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-61-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-62-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-63-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-64-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-65-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-66-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-67-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-4-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-5-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-2-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-1-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-0-0x0000000002220000-0x00000000022F5000-memory.dmp

    Filesize

    852KB

  • memory/2424-68-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-69-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-70-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-71-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB

  • memory/2424-72-0x0000000000400000-0x0000000000608000-memory.dmp

    Filesize

    2.0MB