Overview

overview

10

Static

static

3

Scans53.scr

windows7-x64

10

Scans53.scr

windows10-2004-x64

7

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    218d317505e624ff3435e9fa317d3a02_JaffaCakes118

  • Size

    902KB

  • Sample

    240507-yz6xjsgd82

  • MD5

    218d317505e624ff3435e9fa317d3a02

  • SHA1

    3d6015dbf9b0debe1d9c9f91ebdd3fb44ca03a7d

  • SHA256

    51b4b2b477d5a03789241c1f93304796c0a12ab93fa48ff08b6b1a42c462096c

  • SHA512

    b06b39898bbd4c153f7b77f4de1766418eb2207d2b078fdaf8d5ed2348864cf8f8c57cc319642eccc6f85ddeba0abd28e7ba88d670f88b3f3d74c905af25f9d6

  • SSDEEP

    24576:rIWUBmsDTGokPAXPUDubN1Tl2oT5ZjfLF8wwWan8zT6aAFa:rIvRDTrIA1bXTrT5ZjfLFjw98P6aAw

Score
10/10
troldeshpersistenceransomwaretrojanupx

Malware Config

Targets

    • Target

      Scans53.scr

    • Size

      920KB

    • MD5

      413a810de39449d76506b8ef5c1ff203

    • SHA1

      97b7fbe4daebed58ce1aacea16797e963695a999

    • SHA256

      5d9da09172675f25ddc8419fc9c217df973fa86d7045d4b829a681a0201e7ace

    • SHA512

      51a0fb77c15be511deeaf51ce8e73b55efc0ae62a6421075fe2137e37770041f992b525d8be02dbc5f2ee4c37fdd01ebb1ae0b1e2db438642e88ea42210b661b

    • SSDEEP

      24576:mPvf+WUhGsDNGoknAXjUDEdz1HlqwHdZhfLb8iyW2nszt6kuFW:g+DxDNrmAtdxHNHdZhfLbhynsx6kuk

    Score
    10/10
    troldeshpersistenceransomwaretrojanupx

    • Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

      ransomwaretrojantroldesh

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/StartMenu.dll

    • Size

      7KB

    • MD5

      a09bcf528d02f89f9befa78937ca7d7b

    • SHA1

      3cbcb0fdc32a8f21d6d557cc4c3bb6c4ee246b6f

    • SHA256

      5a31abf36c0ed5e74295b7d7db5a2b09d8aa308483612b7b0bc04771000ac8ad

    • SHA512

      ad4bbc478c028d4b8b890ea60a26ecae1c0dfacad872d150bfb1c334d7f52f2963123c45cef4ee0d773d9b3e143dde2c3d8da92ea9f703e44c5ee873a873b95c

    • SSDEEP

      96:QgiqVPb3X8K8Kdr3gEq6nNdMk6Qiw290+q6LDtJ1tT3hhEl7y:QgiqVPgK8K9eIdE9B/tThg7

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      55a26d7800446f1373056064c64c3ce8

    • SHA1

      80256857e9a0a9c8897923b717f3435295a76002

    • SHA256

      904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8

    • SHA512

      04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b

    • SSDEEP

      192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      ee449b0adce56fbfa433b0239f3f81be

    • SHA1

      ec1e4f9815ea592a3f19b1fe473329b8ddfa201c

    • SHA256

      c1cc3aa4326e83a73a778dee0cf9afcc03a6bafb0a32cea791a27eb9c2288985

    • SHA512

      22fb25bc7628946213e6e970a865d3fbd50d12ce559c37d6848a82c28fa6be09fedffc3b87d5aea8dcfe8dfc4e0f129d9f02e32dae764b8e6a08332b42386686

    • SSDEEP

      96:oCqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4iqndYHnxss:oCq+CP3uKrpyREs06Yx+dGn

    Score
    3/10
    behavioral7behavioral8

    • Target

      uninst.exe

    • Size

      67KB

    • MD5

      0a24574cd9f484a9a72056fb187758d8

    • SHA1

      65502d1fdac883d33eff6f335eab9ef87ac8e9eb

    • SHA256

      7947b56a572bb9de99145af441ceb0f58000ca1048e6e3cdf7db397add40794d

    • SHA512

      12a4243d5f6672d80d22e767fa3b8b1aa73ab1afef4ce4ec0524e4555ca49f04c593df6240b7e7ef7ef526ca7ab38c62e43fc1c30bb02e82d6b9b1b26eacea56

    • SSDEEP

      1536:AU+dcy3fxBk9UmZHs/hcQgdLeAyNxdnw+HMKUKB5TiN5h:ANzPHk9MpcQceAcwWMKU6k

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral10behavioral9

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      55a26d7800446f1373056064c64c3ce8

    • SHA1

      80256857e9a0a9c8897923b717f3435295a76002

    • SHA256

      904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8

    • SHA512

      04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b

    • SSDEEP

      192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa

    Score
    3/10
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      ee449b0adce56fbfa433b0239f3f81be

    • SHA1

      ec1e4f9815ea592a3f19b1fe473329b8ddfa201c

    • SHA256

      c1cc3aa4326e83a73a778dee0cf9afcc03a6bafb0a32cea791a27eb9c2288985

    • SHA512

      22fb25bc7628946213e6e970a865d3fbd50d12ce559c37d6848a82c28fa6be09fedffc3b87d5aea8dcfe8dfc4e0f129d9f02e32dae764b8e6a08332b42386686

    • SSDEEP

      96:oCqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4iqndYHnxss:oCq+CP3uKrpyREs06Yx+dGn

    Score
    3/10
    behavioral13behavioral14

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks