Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
17/04/2024, 15:10 UTC
240417-skjktade45 1017/04/2024, 15:10 UTC
240417-skhzaade44 1017/04/2024, 15:10 UTC
240417-skhcrafa4s 1017/04/2024, 15:10 UTC
240417-skgq8ade42 1017/04/2024, 15:10 UTC
240417-skgffsde39 1015/04/2024, 12:57 UTC
240415-p6157shb6w 1015/04/2024, 12:56 UTC
240415-p6n6mshb5y 1015/04/2024, 12:56 UTC
240415-p6ft9seh37 1015/04/2024, 12:56 UTC
240415-p6exzaeh36 1015/04/2024, 12:56 UTC
240415-p6d1nseh34 10Analysis
-
max time kernel
293s -
max time network
286s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
17/04/2024, 15:10 UTC
General
-
Target
02e8c7af3724ff535da627197920ad14.exe
-
Size
1.2MB
-
MD5
02e8c7af3724ff535da627197920ad14
-
SHA1
794bd6f52a9673e1146321fa2545c580858c0d5f
-
SHA256
ed801a3e54843afe989aadd69cdab5e6fbf00e8e02742f354519b4b16de8f31c
-
SHA512
8a8710ffced04c30f5c43c71ebcbcf56f7b096836f67d1a847db4a8df4f39e291f3e7119f45f03fa1ca0abd0021f81abd31bb775fa22fe2340c1cf24f19f2555
-
SSDEEP
24576:XHtrdKYVVSrqGDohJ3STZG8vIn/sCBGnWsY0Dyk:XHtV7GwBSTc8An/4YFk
Score
10/10
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
UPX packed file 36 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\02e8c7af3724ff535da627197920ad14.exe"C:\Users\Admin\AppData\Local\Temp\02e8c7af3724ff535da627197920ad14.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
-
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle -
DNS67.31.126.40.in-addr.arpaRemote address:8.8.8.8:53Request67.31.126.40.in-addr.arpaIN PTRResponse
-
DNS172.210.232.199.in-addr.arpaRemote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
DNS9.228.82.20.in-addr.arpaRemote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTRResponse
-
DNS169.249.36.23.in-addr.arpaRemote address:8.8.8.8:53Request169.249.36.23.in-addr.arpaIN PTRResponse169.249.36.23.in-addr.arpaIN PTRa23-36-249-169deploystaticakamaitechnologiescom
-
DNS26.35.223.20.in-addr.arpaRemote address:8.8.8.8:53Request26.35.223.20.in-addr.arpaIN PTRResponse
-
DNS241.154.82.20.in-addr.arpaRemote address:8.8.8.8:53Request241.154.82.20.in-addr.arpaIN PTRResponse
-
DNS157.123.68.40.in-addr.arpaRemote address:8.8.8.8:53Request157.123.68.40.in-addr.arpaIN PTRResponse
-
DNS206.23.85.13.in-addr.arpaRemote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
DNS18.24.18.2.in-addr.arpaRemote address:8.8.8.8:53Request18.24.18.2.in-addr.arpaIN PTRResponse18.24.18.2.in-addr.arpaIN PTRa2-18-24-18deploystaticakamaitechnologiescom
-
DNS9.139.73.23.in-addr.arpaRemote address:8.8.8.8:53Request9.139.73.23.in-addr.arpaIN PTRResponse9.139.73.23.in-addr.arpaIN PTRa23-73-139-9deploystaticakamaitechnologiescom
-
DNS29.243.111.52.in-addr.arpaRemote address:8.8.8.8:53Request29.243.111.52.in-addr.arpaIN PTRResponse
-
DNS107.211.222.173.in-addr.arpaRemote address:8.8.8.8:53Request107.211.222.173.in-addr.arpaIN PTRResponse107.211.222.173.in-addr.arpaIN PTRa173-222-211-107deploystaticakamaitechnologiescom
-
DNS244.244.23.193.in-addr.arpaRemote address:8.8.8.8:53Request244.244.23.193.in-addr.arpaIN PTRResponse244.244.23.193.in-addr.arpaIN PTRdannenbergtorauthde
-
DNS90.16.208.104.in-addr.arpaRemote address:8.8.8.8:53Request90.16.208.104.in-addr.arpaIN PTRResponse
-
127.0.0.1:49544 -
128.31.0.39:9101
-
154.35.32.5:443
-
193.23.244.244:443www.ywb6ea5s7aqiyui.comtls
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
-
8.8.8.8:5367.31.126.40.in-addr.arpadns
DNS Request
67.31.126.40.in-addr.arpa
-
8.8.8.8:53172.210.232.199.in-addr.arpadns
DNS Request
172.210.232.199.in-addr.arpa
-
8.8.8.8:539.228.82.20.in-addr.arpadns
DNS Request
9.228.82.20.in-addr.arpa
-
8.8.8.8:53169.249.36.23.in-addr.arpadns
DNS Request
169.249.36.23.in-addr.arpa
-
8.8.8.8:5326.35.223.20.in-addr.arpadns
DNS Request
26.35.223.20.in-addr.arpa
-
8.8.8.8:53241.154.82.20.in-addr.arpadns
DNS Request
241.154.82.20.in-addr.arpa
-
8.8.8.8:53157.123.68.40.in-addr.arpadns
DNS Request
157.123.68.40.in-addr.arpa
-
8.8.8.8:53206.23.85.13.in-addr.arpadns
DNS Request
206.23.85.13.in-addr.arpa
-
8.8.8.8:5318.24.18.2.in-addr.arpadns
DNS Request
18.24.18.2.in-addr.arpa
-
8.8.8.8:539.139.73.23.in-addr.arpadns
DNS Request
9.139.73.23.in-addr.arpa
-
8.8.8.8:5329.243.111.52.in-addr.arpadns
DNS Request
29.243.111.52.in-addr.arpa
-
8.8.8.8:53107.211.222.173.in-addr.arpadns
DNS Request
107.211.222.173.in-addr.arpa
-
8.8.8.8:53244.244.23.193.in-addr.arpadns
DNS Request
244.244.23.193.in-addr.arpa
-
8.8.8.8:5390.16.208.104.in-addr.arpadns
DNS Request
90.16.208.104.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
852KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
852KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB