Overview

overview

10

Static

static

3

Scans43.scr

windows7-x64

10

Scans43.scr

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

Uninstall.exe

windows7-x64

7

Uninstall.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2845ffea89a6f8c52355a370a1397804_JaffaCakes118

  • Size

    890KB

  • Sample

    240509-exj58aac5z

  • MD5

    2845ffea89a6f8c52355a370a1397804

  • SHA1

    fdc311fbbf145d1bd22bdcf2021fbda9649afd74

  • SHA256

    11ff52baee11330a7e323810621924871f0939195436f5834c45aab8749f75c1

  • SHA512

    a40360f879beae499bc4d739d770408d9323f66d7dbcc68cfd3cdf0c82fa6341f018e37d9cb3f5804f7844834ab102efacfaec452a1083c9ae85db0db3702f69

  • SSDEEP

    12288:S0np62rDpdmCsgOc9xgfGlQg4rHLj/7oW6hiGomfGQrEvVyv9oYSRLePCrtTCqkB:Dnom3zsKuGvM/7La5e+EVGoPt5q1

Score
10/10
troldeshpersistenceransomwaretrojanupx

Malware Config

Targets

    • Target

      Scans43.scr

    • Size

      907KB

    • MD5

      80c96b710a809cd0dc5d71ced520e343

    • SHA1

      e628c2f5ca249987a860df0a5bd9225aff1f9553

    • SHA256

      b38eb05b2bb722b2e9e4b6032645d07524da27629167578426918468aebf3d21

    • SHA512

      0e7520e98435f96c4a3fee921d8468d1747308671911dfb6c9150acf978d6791e46831b1259d1a7a6bf1c3747836d79f8930931d2833f4554e5a84f7bb6f12f9

    • SSDEEP

      12288:gb/bnp62fDpd0CsgoiLxgfGBQg4pHxR/76W6hiAomLGorkvzyv9o8UR7etQr7TCn:gb/bnoA3lsEQGrA/7B85qWkzG8r7HqN

    Score
    10/10
    troldeshpersistenceransomwaretrojanupx

    • Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

      ransomwaretrojantroldesh

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      ea60c7bd5edd6048601729bd31362c16

    • SHA1

      6e6919d969eb61a141595014395b6c3f44139073

    • SHA256

      4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39

    • SHA512

      f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993

    • SSDEEP

      48:im1nEhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0J6of5dwe:F1jpl9NLBAZuYtR0xd

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      55a26d7800446f1373056064c64c3ce8

    • SHA1

      80256857e9a0a9c8897923b717f3435295a76002

    • SHA256

      904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8

    • SHA512

      04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b

    • SSDEEP

      192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      ee449b0adce56fbfa433b0239f3f81be

    • SHA1

      ec1e4f9815ea592a3f19b1fe473329b8ddfa201c

    • SHA256

      c1cc3aa4326e83a73a778dee0cf9afcc03a6bafb0a32cea791a27eb9c2288985

    • SHA512

      22fb25bc7628946213e6e970a865d3fbd50d12ce559c37d6848a82c28fa6be09fedffc3b87d5aea8dcfe8dfc4e0f129d9f02e32dae764b8e6a08332b42386686

    • SSDEEP

      96:oCqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4iqndYHnxss:oCq+CP3uKrpyREs06Yx+dGn

    Score
    3/10
    behavioral7behavioral8

    • Target

      Uninstall.exe

    • Size

      57KB

    • MD5

      3db1d34674bdfab493aca0b6380d3639

    • SHA1

      05a2b02b653cd9efd98f1e276a266efaca29c5ae

    • SHA256

      426e613848dfa42b08e66aaa03a7c490a8832fc113f610d77cb29a87b7a5ea2e

    • SHA512

      d459cd9655cd5056b2700da36a4eb1738c7c2b961de4bc8542c479d46952c096e9a3d21263b24da87a8409eed889018b94e1238f6d938b7355e56ed8eab8af23

    • SSDEEP

      1536:aU+dcy3fxBk9UmZHs/hc0gdLeAyNxdDEaQttySC:aNzPHk9Mpc0ceAYjme

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral10behavioral9

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      ea60c7bd5edd6048601729bd31362c16

    • SHA1

      6e6919d969eb61a141595014395b6c3f44139073

    • SHA256

      4e72c8b4d36f128b25281440e59e39af7ec2080d02e024f35ac413d769d91f39

    • SHA512

      f9dc35220697153bb06e3a06caf645079881cb75aed008dbe5381ecaf3442d5be03500b36bbca8b3d114845fac3d667ddf4063c16bc35d29bbea862930939993

    • SSDEEP

      48:im1nEhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0J6of5dwe:F1jpl9NLBAZuYtR0xd

    Score
    3/10
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      55a26d7800446f1373056064c64c3ce8

    • SHA1

      80256857e9a0a9c8897923b717f3435295a76002

    • SHA256

      904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8

    • SHA512

      04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b

    • SSDEEP

      192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa

    Score
    3/10
    behavioral13behavioral14

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks