Analysis
-
max time kernel
1791s -
max time network
1558s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
17-07-2024 19:21
General
-
Target
3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe
-
Size
947KB
-
MD5
39217b125403ff7c755622ef9bbef974
-
SHA1
9fc607b7c17919c83999bdd119e9cd6bf413101a
-
SHA256
3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816
-
SHA512
1252ea94931eaf4426ca1eb94a070645238775c447a09286109fe894c569de29ca502882a0fa34e97e09109c43c486a3aa32081e3a3afef0b6557db59c71fc50
-
SSDEEP
12288:3+Zn/gJtKaNIBpB+iMMOD30ZnZ47m0T3JF9j3GOF0l7B2FzqL2aZa7rf58bs:3+RYeaNILZi/JDLG60y1aZvs
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 1 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe"C:\Users\Admin\AppData\Local\Temp\3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe List Shadows2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD523d01f217c591acab433c8a2bd77b443
SHA100407b2e755fadd5d75772f87e220ce468e90875
SHA25681b9acbc0fb26cabcc81260b969f3428287ada14d31d1507e6907d8de7a028f7
SHA512f123edb87025814ca4f9bedec6b9ac3cb5b51f0089e8e85e47ff9d137be3157469e0d62cd1cb8c99c19671c1048e623aafcd9fd573b521e08ec3ef079a91bb2c
-
Filesize
20KB
MD54e63bdff72dfa4d2713dce962c18e38c
SHA1bb60df3b6392b6f2151dadc2a81766041231c920
SHA2564d83d94e6879f653117c4011485bf95c497b90a22e0f217041d7f50c95d2b8d8
SHA5120f7145bd75242e9b13262770d7649f2ea19596ed9f05b9b8b7c666106e1208645866de057321296d60d9adaadf9c40f36fb887d7d9fdb8850ccd44a18fa8eda1
-
Filesize
89B
MD5727bbc94a1b684827ef1d0fc35e00067
SHA185d463a4c460261ceeabfc3b46468adc71321595
SHA256d68f9a4df65ebb02ebcee1919f0d7e89207a5f9232aa9b106cf0fb6a56ea4cc0
SHA512755d7e893237c52462b41501f68cd2240c30830f741c9991eaafb784e43f135268b5f6309075d7fec0999013a27d6ea8265b0ab756e4fabe872de7abd858563c
-
Filesize
1KB
MD5ee9e22aec9a309fc5192c4f9303c9114
SHA1f9afc13269eec0d4d0d763bd33b694eebbae9d51
SHA256867f988759410462e548f4d2ad7e70636e36051bd8f5e1ab1eddb333843397a6
SHA51252fda1d7edccb61f5c5426d670daab6dadbdb6b981d6215b28dc97f0c678be763ed1139b78699e3297d6f2d2c3508101e4cecdc5c609ed87d00db48e715c3bad
-
Filesize
4KB
MD5b96761e70e08a15c7418b511adfa424d
SHA13fe7e3edceaf8f587ad36997e0bdd589f09aaec3
SHA256dd499aec816f5d43a286091231b37d266cb547d9f16b4d02e3294b9e5373d107
SHA5128516aec7837f180d01269a2fdca6d12feed1aa44fef77f32d5f733f196382c7d52338641b3ce783c062e416f6bc25eb70913424f025b57db07a6580b8458ff93
-
Filesize
192KB
MD5bf19a1dfb90385290217a4bcafeb8607
SHA1dff6eb240d6572211f457d6f19726c300147b07a
SHA25605b06d0a0398fc1a9897d1a79a2438887bf2fa0d4ee5cd7b79cd558945654087
SHA51216aa23cff56af415c064bc822e9c7a95370cf42e879f1b693140ca8d6ecdb645b02b879a8dfe29a4b93dcc80cf58a1fd22e0d048bb341f7f01bb1796861d4602
-
Filesize
3KB
MD515636fb145fd0b7819e40f183e029b62
SHA19d7b30ed8a37a0e12ff659c300b7112d34877364
SHA2565c21c12b7ff22b3ca11faa559aa800e4c9a38f13bed47e8487b4c3fefd47b2d1
SHA5124957a6d44881c8fd67e731b16cb658ecb5d5bf7eb71c18dfdbc41556ad1d42dc7b272c68a908cc56eec7519df2903a84337fad50b94fb5b87e9c0a19df76d439
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
796KB
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
796KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB