Overview

overview

10

Static

static

3

8e2b714a76...18.exe

windows7-x64

10

8e2b714a76...18.exe

windows10-2004-x64

10

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8e2b714a764d849f44757244b10afe6d_JaffaCakes118

  • Size

    926KB

  • Sample

    240602-qakzsadh39

  • MD5

    8e2b714a764d849f44757244b10afe6d

  • SHA1

    bc80b2bd2c4d81ea8630ac62be4a410afac1ddfb

  • SHA256

    cb88c3e0bef38cccf209f3901a4d3bbe787546d7e2c373095786fec63a9766d8

  • SHA512

    57d3e4e179957844670ad48dc42561090a2157ee2a8136a3d57ca782c738d03ee48aa612972f1c6f85f5150ed73cb72cd9724543b7d1c5220a970e3fbca2ecf8

  • SSDEEP

    24576:mPvGu50EbqydfeuYng+DzaC84QOug6/B8LspI9LjFPt1:59Ebr7ADe2Ot/OLzdb1

Score
10/10
troldeshpersistenceransomwaretrojanupx

Malware Config

Targets

    • Target

      8e2b714a764d849f44757244b10afe6d_JaffaCakes118

    • Size

      926KB

    • MD5

      8e2b714a764d849f44757244b10afe6d

    • SHA1

      bc80b2bd2c4d81ea8630ac62be4a410afac1ddfb

    • SHA256

      cb88c3e0bef38cccf209f3901a4d3bbe787546d7e2c373095786fec63a9766d8

    • SHA512

      57d3e4e179957844670ad48dc42561090a2157ee2a8136a3d57ca782c738d03ee48aa612972f1c6f85f5150ed73cb72cd9724543b7d1c5220a970e3fbca2ecf8

    • SSDEEP

      24576:mPvGu50EbqydfeuYng+DzaC84QOug6/B8LspI9LjFPt1:59Ebr7ADe2Ot/OLzdb1

    Score
    10/10
    troldeshpersistenceransomwaretrojanupx

    • Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

      ransomwaretrojantroldesh

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/StartMenu.dll

    • Size

      7KB

    • MD5

      a09bcf528d02f89f9befa78937ca7d7b

    • SHA1

      3cbcb0fdc32a8f21d6d557cc4c3bb6c4ee246b6f

    • SHA256

      5a31abf36c0ed5e74295b7d7db5a2b09d8aa308483612b7b0bc04771000ac8ad

    • SHA512

      ad4bbc478c028d4b8b890ea60a26ecae1c0dfacad872d150bfb1c334d7f52f2963123c45cef4ee0d773d9b3e143dde2c3d8da92ea9f703e44c5ee873a873b95c

    • SSDEEP

      96:QgiqVPb3X8K8Kdr3gEq6nNdMk6Qiw290+q6LDtJ1tT3hhEl7y:QgiqVPgK8K9eIdE9B/tThg7

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      55a26d7800446f1373056064c64c3ce8

    • SHA1

      80256857e9a0a9c8897923b717f3435295a76002

    • SHA256

      904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8

    • SHA512

      04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b

    • SSDEEP

      192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      ee449b0adce56fbfa433b0239f3f81be

    • SHA1

      ec1e4f9815ea592a3f19b1fe473329b8ddfa201c

    • SHA256

      c1cc3aa4326e83a73a778dee0cf9afcc03a6bafb0a32cea791a27eb9c2288985

    • SHA512

      22fb25bc7628946213e6e970a865d3fbd50d12ce559c37d6848a82c28fa6be09fedffc3b87d5aea8dcfe8dfc4e0f129d9f02e32dae764b8e6a08332b42386686

    • SSDEEP

      96:oCqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4iqndYHnxss:oCq+CP3uKrpyREs06Yx+dGn

    Score
    3/10
    behavioral7behavioral8

    • Target

      uninst.exe

    • Size

      67KB

    • MD5

      0a24574cd9f484a9a72056fb187758d8

    • SHA1

      65502d1fdac883d33eff6f335eab9ef87ac8e9eb

    • SHA256

      7947b56a572bb9de99145af441ceb0f58000ca1048e6e3cdf7db397add40794d

    • SHA512

      12a4243d5f6672d80d22e767fa3b8b1aa73ab1afef4ce4ec0524e4555ca49f04c593df6240b7e7ef7ef526ca7ab38c62e43fc1c30bb02e82d6b9b1b26eacea56

    • SSDEEP

      1536:AU+dcy3fxBk9UmZHs/hcQgdLeAyNxdnw+HMKUKB5TiN5h:ANzPHk9MpcQceAcwWMKU6k

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral10behavioral9

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      55a26d7800446f1373056064c64c3ce8

    • SHA1

      80256857e9a0a9c8897923b717f3435295a76002

    • SHA256

      904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8

    • SHA512

      04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b

    • SSDEEP

      192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa

    Score
    3/10
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      ee449b0adce56fbfa433b0239f3f81be

    • SHA1

      ec1e4f9815ea592a3f19b1fe473329b8ddfa201c

    • SHA256

      c1cc3aa4326e83a73a778dee0cf9afcc03a6bafb0a32cea791a27eb9c2288985

    • SHA512

      22fb25bc7628946213e6e970a865d3fbd50d12ce559c37d6848a82c28fa6be09fedffc3b87d5aea8dcfe8dfc4e0f129d9f02e32dae764b8e6a08332b42386686

    • SSDEEP

      96:oCqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4iqndYHnxss:oCq+CP3uKrpyREs06Yx+dGn

    Score
    3/10
    behavioral13behavioral14

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks