Overview

overview

10

Static

static

3

3d0feb3f06...18.exe

windows7-x64

10

3d0feb3f06...18.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

uninstall.exe

windows7-x64

7

uninstall.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3d0feb3f0686dd409e054545835722aa_JaffaCakes118

  • Size

    909KB

  • Sample

    240513-3py66sad31

  • MD5

    3d0feb3f0686dd409e054545835722aa

  • SHA1

    b9bff64d671ef71a67cc3131c05c9bef39f0253c

  • SHA256

    35eb2d9458b5cf967f2db1cadc8a71675d4205b4ce7b5f28e05d111e865340ad

  • SHA512

    1608b8a0dd9f6cc190a27ef84d6cefdd59aad4de32d9a388cc3e5fd41e3dea0f9800d3170177e6af8e5b61d9c5f5a99ddf2d204c37e756bd2412adeac53085e8

  • SSDEEP

    24576:oJgkwIT5ad3ssUkZG7FsaTvq4mAiXnnM82f:qwITgd3s1s8vNf

Score
10/10
troldeshpersistenceransomwaretrojanupx

Malware Config

Targets

    • Target

      3d0feb3f0686dd409e054545835722aa_JaffaCakes118

    • Size

      909KB

    • MD5

      3d0feb3f0686dd409e054545835722aa

    • SHA1

      b9bff64d671ef71a67cc3131c05c9bef39f0253c

    • SHA256

      35eb2d9458b5cf967f2db1cadc8a71675d4205b4ce7b5f28e05d111e865340ad

    • SHA512

      1608b8a0dd9f6cc190a27ef84d6cefdd59aad4de32d9a388cc3e5fd41e3dea0f9800d3170177e6af8e5b61d9c5f5a99ddf2d204c37e756bd2412adeac53085e8

    • SSDEEP

      24576:oJgkwIT5ad3ssUkZG7FsaTvq4mAiXnnM82f:qwITgd3s1s8vNf

    Score
    10/10
    troldeshpersistenceransomwaretrojanupx

    • Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

      ransomwaretrojantroldesh

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      55a26d7800446f1373056064c64c3ce8

    • SHA1

      80256857e9a0a9c8897923b717f3435295a76002

    • SHA256

      904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8

    • SHA512

      04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b

    • SSDEEP

      192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      ee449b0adce56fbfa433b0239f3f81be

    • SHA1

      ec1e4f9815ea592a3f19b1fe473329b8ddfa201c

    • SHA256

      c1cc3aa4326e83a73a778dee0cf9afcc03a6bafb0a32cea791a27eb9c2288985

    • SHA512

      22fb25bc7628946213e6e970a865d3fbd50d12ce559c37d6848a82c28fa6be09fedffc3b87d5aea8dcfe8dfc4e0f129d9f02e32dae764b8e6a08332b42386686

    • SSDEEP

      96:oCqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4iqndYHnxss:oCq+CP3uKrpyREs06Yx+dGn

    Score
    3/10
    behavioral5behavioral6

    • Target

      uninstall.exe

    • Size

      63KB

    • MD5

      f8d6ebf478d5bfade14535f056b9b66f

    • SHA1

      483a691dcb923101626bafb87b584deb9d74f61c

    • SHA256

      343fb9291ce225ff187b288cd5283038e9b49014abcf92c6ab59ee2b771685b3

    • SHA512

      bf9fd99357cf678af0c75f9c880267e5d6c6424ddef70217c909a70efc14a2a1fbc8b1e2f3da5c5cc7eb96ed9aef7ca9d542bbb74faad06c197c00ffaabcf075

    • SSDEEP

      1536:CU+dcy3fxBk9UmZHs/hcSgdLeAyNGdsjrRDN:CNzPHk9MpcSceAbsHv

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral7behavioral8

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      55a26d7800446f1373056064c64c3ce8

    • SHA1

      80256857e9a0a9c8897923b717f3435295a76002

    • SHA256

      904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8

    • SHA512

      04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b

    • SSDEEP

      192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa

    Score
    3/10
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      ee449b0adce56fbfa433b0239f3f81be

    • SHA1

      ec1e4f9815ea592a3f19b1fe473329b8ddfa201c

    • SHA256

      c1cc3aa4326e83a73a778dee0cf9afcc03a6bafb0a32cea791a27eb9c2288985

    • SHA512

      22fb25bc7628946213e6e970a865d3fbd50d12ce559c37d6848a82c28fa6be09fedffc3b87d5aea8dcfe8dfc4e0f129d9f02e32dae764b8e6a08332b42386686

    • SSDEEP

      96:oCqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4iqndYHnxss:oCq+CP3uKrpyREs06Yx+dGn

    Score
    3/10
    behavioral11behavioral12

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks