Overview

overview

10

Static

static

3

9cf5cb7f3c...18.exe

windows7-x64

10

9cf5cb7f3c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9cf5cb7f3c29d195ff4565af580f1498_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240611-ew3aeatfnd

  • MD5

    9cf5cb7f3c29d195ff4565af580f1498

  • SHA1

    efba29653fc216b5faf6ae5ceaa2b4105ebc8585

  • SHA256

    f09b23526032f2b5dc3229100f5f3bbcdff48208d6505006c81a38a5cc1b4fce

  • SHA512

    b6c6693a5b4edf784aabfc1367525f10b6774e4109f8f15a0d76b9498fc7b11fbb8df806dac197da143cbeaed56c20f2f865d93ee5a303437415954b1eb0d8b5

  • SSDEEP

    24576:jamF/69oQ9uy+UV66FbdvJn1cpsqd/XqIfP0VaHdHdHdHfFfHdHdHdHfFfHdHdHV:7FFa+krzcpZ/vfEmp

Score
10/10
troldeshpersistenceransomwaretrojanupx

Malware Config

Targets

    • Target

      9cf5cb7f3c29d195ff4565af580f1498_JaffaCakes118

    • Size

      1.2MB

    • MD5

      9cf5cb7f3c29d195ff4565af580f1498

    • SHA1

      efba29653fc216b5faf6ae5ceaa2b4105ebc8585

    • SHA256

      f09b23526032f2b5dc3229100f5f3bbcdff48208d6505006c81a38a5cc1b4fce

    • SHA512

      b6c6693a5b4edf784aabfc1367525f10b6774e4109f8f15a0d76b9498fc7b11fbb8df806dac197da143cbeaed56c20f2f865d93ee5a303437415954b1eb0d8b5

    • SSDEEP

      24576:jamF/69oQ9uy+UV66FbdvJn1cpsqd/XqIfP0VaHdHdHdHfFfHdHdHdHfFfHdHdHV:7FFa+krzcpZ/vfEmp

    Score
    10/10
    troldeshpersistenceransomwaretrojanupx

    • Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

      ransomwaretrojantroldesh

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks