Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
17/04/2024, 15:10 UTC
240417-skjktade45 1017/04/2024, 15:10 UTC
240417-skhzaade44 1017/04/2024, 15:10 UTC
240417-skhcrafa4s 1017/04/2024, 15:10 UTC
240417-skgq8ade42 1017/04/2024, 15:10 UTC
240417-skgffsde39 1015/04/2024, 12:57 UTC
240415-p6157shb6w 1015/04/2024, 12:56 UTC
240415-p6n6mshb5y 1015/04/2024, 12:56 UTC
240415-p6ft9seh37 1015/04/2024, 12:56 UTC
240415-p6exzaeh36 1015/04/2024, 12:56 UTC
240415-p6d1nseh34 10Analysis
-
max time kernel
342s -
max time network
342s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
-
submitted
17/04/2024, 15:10 UTC
General
-
Target
02e8c7af3724ff535da627197920ad14.exe
-
Size
1.2MB
-
MD5
02e8c7af3724ff535da627197920ad14
-
SHA1
794bd6f52a9673e1146321fa2545c580858c0d5f
-
SHA256
ed801a3e54843afe989aadd69cdab5e6fbf00e8e02742f354519b4b16de8f31c
-
SHA512
8a8710ffced04c30f5c43c71ebcbcf56f7b096836f67d1a847db4a8df4f39e291f3e7119f45f03fa1ca0abd0021f81abd31bb775fa22fe2340c1cf24f19f2555
-
SSDEEP
24576:XHtrdKYVVSrqGDohJ3STZG8vIn/sCBGnWsY0Dyk:XHtV7GwBSTc8An/4YFk
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 36 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\02e8c7af3724ff535da627197920ad14.exe"C:\Users\Admin\AppData\Local\Temp\02e8c7af3724ff535da627197920ad14.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
-
DNS189.40.188.131.in-addr.arpaRemote address:8.8.8.8:53Request189.40.188.131.in-addr.arpaIN PTRResponse189.40.188.131.in-addr.arpaIN PTRdespari informatik uni-erlangende -
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
DNSnexusrules.officeapps.live.comRemote address:8.8.8.8:53Requestnexusrules.officeapps.live.comIN AResponsenexusrules.officeapps.live.comIN CNAMEprod.nexusrules.live.com.akadns.netprod.nexusrules.live.com.akadns.netIN A52.111.243.31
-
DNSself.events.data.microsoft.comRemote address:8.8.8.8:53Requestself.events.data.microsoft.comIN AResponseself.events.data.microsoft.comIN CNAMEself-events-data.trafficmanager.netself-events-data.trafficmanager.netIN CNAMEonedscolprdcus14.centralus.cloudapp.azure.comonedscolprdcus14.centralus.cloudapp.azure.comIN A104.208.16.90
-
DNS90.16.208.104.in-addr.arpaRemote address:8.8.8.8:53Request90.16.208.104.in-addr.arpaIN PTRResponse
-
DNSctldl.windowsupdate.comRemote address:8.8.8.8:53Requestctldl.windowsupdate.comIN AResponsectldl.windowsupdate.comIN CNAMEwu-bg-shim.trafficmanager.netwu-bg-shim.trafficmanager.netIN CNAMEwindowsupdatebg.s.llnwi.netwindowsupdatebg.s.llnwi.netIN A87.248.205.0
-
DNS0.205.248.87.in-addr.arpaRemote address:8.8.8.8:53Request0.205.248.87.in-addr.arpaIN PTRResponse0.205.248.87.in-addr.arpaIN PTRhttps-87-248-205-0lgwllnwnet
-
DNSctldl.windowsupdate.comRemote address:8.8.8.8:53Requestctldl.windowsupdate.comIN AResponsectldl.windowsupdate.comIN CNAMEwu-bg-shim.trafficmanager.netwu-bg-shim.trafficmanager.netIN CNAMEdownload.windowsupdate.com.edgesuite.netdownload.windowsupdate.com.edgesuite.netIN CNAMEa767.dspw65.akamai.neta767.dspw65.akamai.netIN A2.18.24.25a767.dspw65.akamai.netIN A2.18.24.18
-
DNSctldl.windowsupdate.comRemote address:8.8.8.8:53Requestctldl.windowsupdate.comIN A
-
DNS25.24.18.2.in-addr.arpaRemote address:8.8.8.8:53Request25.24.18.2.in-addr.arpaIN PTRResponse25.24.18.2.in-addr.arpaIN PTRa2-18-24-25deploystaticakamaitechnologiescom
-
127.0.0.1:49738 -
131.188.40.189:443www.lsz4pwfagbaz32dpuanz2i.comtls -
76.73.17.194:9090
-
8.8.8.8:53189.40.188.131.in-addr.arpadns
DNS Request
189.40.188.131.in-addr.arpa
DNS Request
8.8.8.8.in-addr.arpa
DNS Request
nexusrules.officeapps.live.com
DNS Response
52.111.243.31
DNS Request
self.events.data.microsoft.com
DNS Response
104.208.16.90
DNS Request
90.16.208.104.in-addr.arpa
DNS Request
ctldl.windowsupdate.com
DNS Response
87.248.205.0
DNS Request
0.205.248.87.in-addr.arpa
DNS Request
ctldl.windowsupdate.com
DNS Request
ctldl.windowsupdate.com
DNS Response
2.18.24.252.18.24.18
-
8.8.8.8:5325.24.18.2.in-addr.arpadns
DNS Request
25.24.18.2.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
852KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
852KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB