Overview

overview

10

Static

static

3

Scans46.scr

windows7-x64

10

Scans46.scr

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

Uninstall.exe

windows7-x64

7

Uninstall.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0a20c7cc0cbb5c6b735646f0c65c70aa_JaffaCakes118

  • Size

    887KB

  • Sample

    240430-tfjwfscd77

  • MD5

    0a20c7cc0cbb5c6b735646f0c65c70aa

  • SHA1

    829741665df3e135f54ae3e78021332415a155a9

  • SHA256

    2564e6fcff82ffdd9e6bdcd89e15cf1b6389faaae2279975326eac70dedffffb

  • SHA512

    d6c4b1fc811a3ca5e21cdc9bb3dc78b22beb603497a5e654b1fb532b99fc3a36a23b8c70f727e3987d54350fe2f15fe77e491763716dcd467758cd2cef9c18ab

  • SSDEEP

    24576:2sF22BjRyGcvHnOkmmfCIk8IxAYEZw+cSL8c4ErkFqwLCgD8kKh:VEf/vrmmqIGxEJL8hZLCe8kKh

Score
10/10
troldeshpersistenceransomwaretrojanupx

Malware Config

Targets

    • Target

      Scans46.scr

    • Size

      904KB

    • MD5

      b5cea1631da405d27fd932f6c0ee485d

    • SHA1

      2e94efa7cfc5ec145f60686b939a43462e1a9cc5

    • SHA256

      35b52d3ea2a913a3ba0b9b306c911e4804b12b1c61fc563ecf04a9e0903979b9

    • SHA512

      7b03bab5df4839f08bd51223f38a37a7ed04a1167608db8bf4824c03b9d694196201d0ada3572fc340bdbc2b0b576cedc25eace6d8896f564ca1fb0f630b8d22

    • SSDEEP

      24576:gb/Kqq2Bxvyw+vHnc+mkf0EkgINAiEHw+caL8c4cxAFq6LCaD8kHo:lqqbFvNmksEMNmtL8hVLCk8kHo

    Score
    10/10
    troldeshpersistenceransomwaretrojanupx

    • Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

      ransomwaretrojantroldesh

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      ea60c7bd5edd6048601729bd31362c16

    • SHA1

      6e6919d969eb61a141595014395b6c3f44139073

    • SHA256

      4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39

    • SHA512

      f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993

    • SSDEEP

      48:im1nEhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0J6of5dwe:F1jpl9NLBAZuYtR0xd

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      55a26d7800446f1373056064c64c3ce8

    • SHA1

      80256857e9a0a9c8897923b717f3435295a76002

    • SHA256

      904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8

    • SHA512

      04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b

    • SSDEEP

      192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      ee449b0adce56fbfa433b0239f3f81be

    • SHA1

      ec1e4f9815ea592a3f19b1fe473329b8ddfa201c

    • SHA256

      c1cc3aa4326e83a73a778dee0cf9afcc03a6bafb0a32cea791a27eb9c2288985

    • SHA512

      22fb25bc7628946213e6e970a865d3fbd50d12ce559c37d6848a82c28fa6be09fedffc3b87d5aea8dcfe8dfc4e0f129d9f02e32dae764b8e6a08332b42386686

    • SSDEEP

      96:oCqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4iqndYHnxss:oCq+CP3uKrpyREs06Yx+dGn

    Score
    3/10
    behavioral7behavioral8

    • Target

      Uninstall.exe

    • Size

      57KB

    • MD5

      3db1d34674bdfab493aca0b6380d3639

    • SHA1

      05a2b02b653cd9efd98f1e276a266efaca29c5ae

    • SHA256

      426e613848dfa42b08e66aaa03a7c490a8832fc113f610d77cb29a87b7a5ea2e

    • SHA512

      d459cd9655cd5056b2700da36a4eb1738c7c2b961de4bc8542c479d46952c096e9a3d21263b24da87a8409eed889018b94e1238f6d938b7355e56ed8eab8af23

    • SSDEEP

      1536:aU+dcy3fxBk9UmZHs/hc0gdLeAyNxdDEaQttySC:aNzPHk9Mpc0ceAYjme

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral10behavioral9

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      ea60c7bd5edd6048601729bd31362c16

    • SHA1

      6e6919d969eb61a141595014395b6c3f44139073

    • SHA256

      4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39

    • SHA512

      f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993

    • SSDEEP

      48:im1nEhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0J6of5dwe:F1jpl9NLBAZuYtR0xd

    Score
    3/10
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      55a26d7800446f1373056064c64c3ce8

    • SHA1

      80256857e9a0a9c8897923b717f3435295a76002

    • SHA256

      904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8

    • SHA512

      04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b

    • SSDEEP

      192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa

    Score
    3/10
    behavioral13behavioral14

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks