Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
17/04/2024, 15:10 UTC
240417-skjktade45 1017/04/2024, 15:10 UTC
240417-skhzaade44 1017/04/2024, 15:10 UTC
240417-skhcrafa4s 1017/04/2024, 15:10 UTC
240417-skgq8ade42 1017/04/2024, 15:10 UTC
240417-skgffsde39 1015/04/2024, 12:57 UTC
240415-p6157shb6w 1015/04/2024, 12:56 UTC
240415-p6n6mshb5y 1015/04/2024, 12:56 UTC
240415-p6ft9seh37 1015/04/2024, 12:56 UTC
240415-p6exzaeh36 1015/04/2024, 12:56 UTC
240415-p6d1nseh34 10Analysis
-
max time kernel
292s -
max time network
299s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
17/04/2024, 15:10 UTC
General
-
Target
02e8c7af3724ff535da627197920ad14.exe
-
Size
1.2MB
-
MD5
02e8c7af3724ff535da627197920ad14
-
SHA1
794bd6f52a9673e1146321fa2545c580858c0d5f
-
SHA256
ed801a3e54843afe989aadd69cdab5e6fbf00e8e02742f354519b4b16de8f31c
-
SHA512
8a8710ffced04c30f5c43c71ebcbcf56f7b096836f67d1a847db4a8df4f39e291f3e7119f45f03fa1ca0abd0021f81abd31bb775fa22fe2340c1cf24f19f2555
-
SSDEEP
24576:XHtrdKYVVSrqGDohJ3STZG8vIn/sCBGnWsY0Dyk:XHtV7GwBSTc8An/4YFk
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 37 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\02e8c7af3724ff535da627197920ad14.exe"C:\Users\Admin\AppData\Local\Temp\02e8c7af3724ff535da627197920ad14.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
-
DNS189.40.188.131.in-addr.arpaRemote address:8.8.8.8:53Request189.40.188.131.in-addr.arpaIN PTRResponse189.40.188.131.in-addr.arpaIN PTRdespari informatik uni-erlangende -
DNS48.229.111.52.in-addr.arpaRemote address:8.8.8.8:53Request48.229.111.52.in-addr.arpaIN PTRResponse
-
DNS10.173.189.20.in-addr.arpaRemote address:8.8.8.8:53Request10.173.189.20.in-addr.arpaIN PTRResponse
-
DNS18.24.18.2.in-addr.arpaRemote address:8.8.8.8:53Request18.24.18.2.in-addr.arpaIN PTRResponse18.24.18.2.in-addr.arpaIN PTRa2-18-24-18deploystaticakamaitechnologiescom
-
131.188.40.189:443www.pbdzcgvgptgo44c3ut6vj2d.comtls -
127.0.0.1:49794 -
76.73.17.194:9090
-
8.8.8.8:53189.40.188.131.in-addr.arpadns
DNS Request
189.40.188.131.in-addr.arpa
-
8.8.8.8:5348.229.111.52.in-addr.arpadns
DNS Request
48.229.111.52.in-addr.arpa
-
8.8.8.8:5310.173.189.20.in-addr.arpadns
DNS Request
10.173.189.20.in-addr.arpa
-
8.8.8.8:5318.24.18.2.in-addr.arpadns
DNS Request
18.24.18.2.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
852KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
852KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB