Overview

overview

10

Static

static

3

69231c0c5f...18.exe

windows7-x64

10

69231c0c5f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    69231c0c5f533a3bee41c1fbdbb53d88_JaffaCakes118

  • Size

    1007KB

  • Sample

    240523-arhyraeg99

  • MD5

    69231c0c5f533a3bee41c1fbdbb53d88

  • SHA1

    a21ae0918618fd8362ceaa0dd21326a3ac085de0

  • SHA256

    b0235590d7649c6dc4bc2e94eb8a32a24eac07df2a330b52fa72f97f71f0432c

  • SHA512

    d9aab88cd9558ee43df10df0b65d719a030fb0088aa3dc57b4258bad5c99efb9d12df3f7ec2b21185c4a2ff3a4d3467d57e4dfeda5722509cd4570bd31f227d4

  • SSDEEP

    24576:ymrsY0pl10w3COTWN8mKqIccHAlX1wdhMlsmgJtel2RQnVUrC:9Gpl10c3mKqtr11w+TgJty2yn/

Score
10/10
troldeshpersistenceransomwaretrojanupx

Malware Config

Targets

    • Target

      69231c0c5f533a3bee41c1fbdbb53d88_JaffaCakes118

    • Size

      1007KB

    • MD5

      69231c0c5f533a3bee41c1fbdbb53d88

    • SHA1

      a21ae0918618fd8362ceaa0dd21326a3ac085de0

    • SHA256

      b0235590d7649c6dc4bc2e94eb8a32a24eac07df2a330b52fa72f97f71f0432c

    • SHA512

      d9aab88cd9558ee43df10df0b65d719a030fb0088aa3dc57b4258bad5c99efb9d12df3f7ec2b21185c4a2ff3a4d3467d57e4dfeda5722509cd4570bd31f227d4

    • SSDEEP

      24576:ymrsY0pl10w3COTWN8mKqIccHAlX1wdhMlsmgJtel2RQnVUrC:9Gpl10c3mKqtr11w+TgJty2yn/

    Score
    10/10
    troldeshpersistenceransomwaretrojanupx

    • Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

      ransomwaretrojantroldesh

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks