Overview
overview
10Static
static
7BitchTits ...P].exe
windows7-x64
7WannaFartCry.exe
windows7-x64
3Wannashiturself.exe
windows7-x64
10big FAT ti...RE.exe
windows7-x64
10big fat se...re.exe
windows7-x64
1bitch man ...re.exe
windows7-x64
8bro what t...at.dll
windows7-x64
7cocksucker...L].exe
windows7-x64
7fart poopy...re.exe
windows7-x64
7fart weewe...re.exe
windows7-x64
10farting po...re.exe
windows7-x64
10farty poo ...re.exe
windows7-x64
10fuck you.exe
windows7-x64
7large peni...24.exe
windows7-x64
niggaware ...29.exe
windows7-x64
10pee poo pi...re.exe
windows7-x64
10retard ransomware.exe
windows7-x64
1Analysis
-
max time kernel
263s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
20-07-2024 14:23
Behavioral task
behavioral1
Sample
BitchTits Ransomware [VIP].exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
WannaFartCry.exe
Resource
win7-20240704-en
Behavioral task
behavioral3
Sample
Wannashiturself.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
big FAT tits RANSOMWARE.exe
Resource
win7-20240704-en
Behavioral task
behavioral5
Sample
big fat sexy dildo poop ransomware.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
bitch man ransomware.exe
Resource
win7-20240708-en
Behavioral task
behavioral7
Sample
bro what the fuckkk ur seriously beliving that.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
cocksucker ransomware [COOL].exe
Resource
win7-20240704-en
Behavioral task
behavioral9
Sample
fart poopy ransowmare.exe
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
fart weewee ransomware.exe
Resource
win7-20240708-en
Behavioral task
behavioral11
Sample
farting poop sex ransomware.exe
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
farty poo poo ransomware.exe
Resource
win7-20240705-en
Behavioral task
behavioral13
Sample
fuck you.exe
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
large penis ransomware 2024.exe
Resource
win7-20240704-en
Behavioral task
behavioral15
Sample
niggaware ransomware in 2029.exe
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
pee poo piss piss ransomware rare.exe
Resource
win7-20240705-en
Behavioral task
behavioral17
Sample
retard ransomware.exe
Resource
win7-20240705-en
General
-
Target
big FAT tits RANSOMWARE.exe
-
Size
1.6MB
-
MD5
6750c55843b503be8d3c8fafa9229a15
-
SHA1
6c1e35a314b760103465c6b8b295697de12f2654
-
SHA256
43d4ddb608614be57f034aaa0fce1fb801a284057b6141a0713f6e698a064bdc
-
SHA512
4a11450e628f3a3f3f8c205100c1a21fe9df5848f7eee0d317fd406d83ac53b8ff0c4a9f4dd8113cac6adae55b131b1e9bb2eace9fef0ff9e15e267fc4f4ce3a
-
SSDEEP
24576:atgZUgpG9t9x4iK7Dkv5lskkcv/8IIh8Tg6qpX103LNkVIgAoeLZfmSXm:aCZHitwiKUwtm8IKkgA7olAoedfTm
Malware Config
Signatures
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral4/memory/2948-6-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-8-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-9-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-7-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-5-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-10-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-12-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-14-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-11-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-13-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-19-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-20-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-21-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-22-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-23-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-24-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-27-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-28-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-29-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-30-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-31-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-32-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-33-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-34-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-35-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-36-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-37-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-38-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-39-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-40-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-41-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-42-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-43-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-44-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-45-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-46-0x0000000000400000-0x0000000000608000-memory.dmp upx behavioral4/memory/2948-47-0x0000000000400000-0x0000000000608000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
big FAT tits RANSOMWARE.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\"" big FAT tits RANSOMWARE.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
big FAT tits RANSOMWARE.exedescription pid process target process PID 1712 set thread context of 2948 1712 big FAT tits RANSOMWARE.exe big FAT tits RANSOMWARE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
big FAT tits RANSOMWARE.exepid process 2948 big FAT tits RANSOMWARE.exe 2948 big FAT tits RANSOMWARE.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
big FAT tits RANSOMWARE.exedescription pid process target process PID 1712 wrote to memory of 2948 1712 big FAT tits RANSOMWARE.exe big FAT tits RANSOMWARE.exe PID 1712 wrote to memory of 2948 1712 big FAT tits RANSOMWARE.exe big FAT tits RANSOMWARE.exe PID 1712 wrote to memory of 2948 1712 big FAT tits RANSOMWARE.exe big FAT tits RANSOMWARE.exe PID 1712 wrote to memory of 2948 1712 big FAT tits RANSOMWARE.exe big FAT tits RANSOMWARE.exe PID 1712 wrote to memory of 2948 1712 big FAT tits RANSOMWARE.exe big FAT tits RANSOMWARE.exe PID 1712 wrote to memory of 2948 1712 big FAT tits RANSOMWARE.exe big FAT tits RANSOMWARE.exe PID 1712 wrote to memory of 2948 1712 big FAT tits RANSOMWARE.exe big FAT tits RANSOMWARE.exe PID 1712 wrote to memory of 2948 1712 big FAT tits RANSOMWARE.exe big FAT tits RANSOMWARE.exe PID 1712 wrote to memory of 2948 1712 big FAT tits RANSOMWARE.exe big FAT tits RANSOMWARE.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\big FAT tits RANSOMWARE.exe"C:\Users\Admin\AppData\Local\Temp\big FAT tits RANSOMWARE.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\big FAT tits RANSOMWARE.exe"C:\Users\Admin\AppData\Local\Temp\big FAT tits RANSOMWARE.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:2948