Overview

overview

10

Static

static

3

62a3384531...18.exe

windows7-x64

10

62a3384531...18.exe

windows10-2004-x64

7

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

Uninstall.exe

windows7-x64

7

Uninstall.exe

windows10-2004-x64

7

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    62a3384531a6f4d2c74980833b8f01c0_JaffaCakes118

  • Size

    940KB

  • Sample

    240521-j8t7saec94

  • MD5

    62a3384531a6f4d2c74980833b8f01c0

  • SHA1

    98fbbb1b64e627b7eb312469a89b221ba2be07ae

  • SHA256

    9f76bdf33649d6e035eddd507a6d6826283ef450a3055320806ce3053523a2aa

  • SHA512

    d789bfc8dd7436fc0f4c5912cc71d546e8230f3ac51ca3e226154e05f7f3b2a4e43b91249080f031d6cd2b6d8215bb3b68de617bf0dcd569142c856fda568675

  • SSDEEP

    24576:Mrx+v0kJ7zGWSuGMuJov3rsM7ok8XWv2bz09Wvfr1Yoz:m+v0kB6WLGMu+zsM7ok8XWv2vuWHC8

Score
10/10
troldeshdiscoverypersistenceransomwarespywarestealertrojanupx

Malware Config

Targets

    • Target

      62a3384531a6f4d2c74980833b8f01c0_JaffaCakes118

    • Size

      940KB

    • MD5

      62a3384531a6f4d2c74980833b8f01c0

    • SHA1

      98fbbb1b64e627b7eb312469a89b221ba2be07ae

    • SHA256

      9f76bdf33649d6e035eddd507a6d6826283ef450a3055320806ce3053523a2aa

    • SHA512

      d789bfc8dd7436fc0f4c5912cc71d546e8230f3ac51ca3e226154e05f7f3b2a4e43b91249080f031d6cd2b6d8215bb3b68de617bf0dcd569142c856fda568675

    • SSDEEP

      24576:Mrx+v0kJ7zGWSuGMuJov3rsM7ok8XWv2bz09Wvfr1Yoz:m+v0kB6WLGMu+zsM7ok8XWv2vuWHC8

    Score
    10/10
    troldeshdiscoverypersistenceransomwarespywarestealertrojanupx

    • Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

      ransomwaretrojantroldesh

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/StartMenu.dll

    • Size

      7KB

    • MD5

      12281b59f907027f4d374b8423e2b0f9

    • SHA1

      21216630633bb6cc4aa9b1c5873f345bbe06b74c

    • SHA256

      1cc68f4aef76d70d7326853f0e604ff3ac926c1dfe7aee7ad69a3259280a4e66

    • SHA512

      7c8c7a5c7f8e6d7a0b5d54ad1bfc34831358487985bd64459cd22f45f82385f4740e7a62048b01759b79e3d0f05ccb8152d63c3d864f308146ce5c746a9296b6

    • SSDEEP

      96:qgiqVPb3X8K8Kdr3gEq6nNdMk6Qiw290+q6LDtJ1tR3hhEl7y:qgiqVPgK8K9eIdE9B/tVhg7

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      3f176d1ee13b0d7d6bd92e1c7a0b9bae

    • SHA1

      fe582246792774c2c9dd15639ffa0aca90d6fd0b

    • SHA256

      fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

    • SHA512

      0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

    • SSDEEP

      192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      b5a1f9dc73e2944a388a61411bdd8c70

    • SHA1

      dc9b20df3f3810c2e81a0c54dea385704ba8bef7

    • SHA256

      288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884

    • SHA512

      b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8

    • SSDEEP

      96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH

    Score
    3/10
    behavioral7behavioral8

    • Target

      Uninstall.exe

    • Size

      54KB

    • MD5

      cafdc399426afcb8523a207cb5496f4e

    • SHA1

      5bcd97c6d36757bce8329af3f7deefff6677d138

    • SHA256

      f86eb5b330384114bb42d127403b4756987a9a87deb277c376f8d7e95717e449

    • SHA512

      d12cb75a35c6aa1ed401e3168777aca50de41c90a0f92570552ec177054ffb5ce90412c0a77c4e5950684820f57365d19dca1ab72b7f8114817ffb25a26523de

    • SSDEEP

      1536:vaLuXE8XPIYyr7jvN0DoJ+cngdLeAyNx5UaLVel:SLuXzXwYyr6DoocnceAQUkVel

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral10behavioral9

    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      b5a1f9dc73e2944a388a61411bdd8c70

    • SHA1

      dc9b20df3f3810c2e81a0c54dea385704ba8bef7

    • SHA256

      288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884

    • SHA512

      b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8

    • SSDEEP

      96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH

    Score
    3/10
    behavioral11behavioral12

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks