445ab3421fbfb7786ee2e2d8f5e09d919ce27392da08f35bbad07de05aed43c2

General

Target
VkDJ.exe
Size 1.8MB
Sample220618-lpwydaafa8
SHA256 445ab3421fbfb7786ee2e2d8f5e09d919ce27392da08f35bbad07de05aed43c2
MD5 748916e8ed91e8775b9d74c373c82a86
SHA1 effcba29e69944f2bcaee0f77b605fa628572f01
SHA512 e1fac71d13867970137d12edb4d149115424ed159030c11edb57e52f28f267602f8cf4b4b544c3aad0dd7a928554450defa495bd723b20ed27c7d3e1ad974734
MD5 SHA1 SHA512

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
2432	VkDJ.tmp
1880	7za.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3384	schtasks.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4580	taskkill.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	14	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2432	VkDJ.tmp
2432	VkDJ.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2432	VkDJ.tmp

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 2432	1564	VkDJ.exe	79
PID 1564 wrote to memory of 2432	1564	VkDJ.exe	79
PID 1564 wrote to memory of 2432	1564	VkDJ.exe	79
PID 2432 wrote to memory of 4580	2432	VkDJ.tmp	80
PID 2432 wrote to memory of 4580	2432	VkDJ.tmp	80
PID 2432 wrote to memory of 4580	2432	VkDJ.tmp	80
PID 2432 wrote to memory of 3384	2432	VkDJ.tmp	83
PID 2432 wrote to memory of 3384	2432	VkDJ.tmp	83
PID 2432 wrote to memory of 3384	2432	VkDJ.tmp	83
PID 2432 wrote to memory of 1880	2432	VkDJ.tmp	85
PID 2432 wrote to memory of 1880	2432	VkDJ.tmp	85
PID 2432 wrote to memory of 1880	2432	VkDJ.tmp	85

C:\Users\Admin\AppData\Local\Temp\VkDJ.exe
"C:\Users\Admin\AppData\Local\Temp\VkDJ.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Users\Admin\AppData\Local\Temp\is-7AEGB.tmp\VkDJ.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-7AEGB.tmp\VkDJ.tmp" /SL5="$7002C,1074986,831488,C:\Users\Admin\AppData\Local\Temp\VkDJ.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" https://setstat.ru/api/savePostback?chid=%s&guid=%s&type=vkdjbin.exe
    3⤵
    - Kills process with taskkill
    PID:4580
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Create /TN pleasure-porter /SC ONLOGON /TR "C:\ProgramData\polished-potter\bin.exe /H" /F /DELAY 0001:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3384
- - C:\Users\Admin\AppData\Local\Temp\is-K7F74.tmp\7za.exe
    "C:\Users\Admin\AppData\Local\Temp\is-K7F74.tmp\7za.exe" e "C:\Users\Admin\AppData\Local\Temp\is-K7F74.tmp\5.11.zip" -pvkd -y -oC:\ProgramData\polished-potter
    3⤵
    - Executes dropped EXE
    PID:1880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VkDJ.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-7AEGB.tmp\VkDJ.tmp
Size 3.0MB
SHA256 549aa7da6c2b75e76c43c490d451cc794fdf0922cf99e7b0670461234e62fadb
MD5 b45872a3211b103d734671d60cbf8a8c
SHA1 a1bb6bd73bfabb5d63f0b22d245526dcc8b896c7
SHA512 fefb6becc939614f9ef88ca36bdb74d9d4b0fca88a6bd311e976820e9207af803511fe055193d10820b4510832e0b6d588a17b769782f4b1be7c75530e74edcb
SSDEEP 49152:qEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTV+333TY:692bz2Eb6pd7B6bAGx7s333T
MD5 SHA1 SHA512 SSDEEP

Submit Download

VkDJ.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-7AEGB.tmp\VkDJ.tmp
Size 3.0MB
SHA256 549aa7da6c2b75e76c43c490d451cc794fdf0922cf99e7b0670461234e62fadb
MD5 b45872a3211b103d734671d60cbf8a8c
SHA1 a1bb6bd73bfabb5d63f0b22d245526dcc8b896c7
SHA512 fefb6becc939614f9ef88ca36bdb74d9d4b0fca88a6bd311e976820e9207af803511fe055193d10820b4510832e0b6d588a17b769782f4b1be7c75530e74edcb
SSDEEP 49152:qEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTV+333TY:692bz2Eb6pd7B6bAGx7s333T
MD5 SHA1 SHA512 SSDEEP

Submit Download

5.11.zip

Path C:\Users\Admin\AppData\Local\Temp\is-K7F74.tmp\5.11.zip
Size 5.8MB
SHA256 c82fe6de58ea295c650e87c47a1e78640e764f6098742a99e3f7097cff782b4a
MD5 a300175542c001e0f907d402fd5d597d
SHA1 6d0c479662e012ba37de5d2e42ebf493067f5795
SHA512 444898b5aa20582d7fc86ab6d080fe7a6b17a412abf8ee29c71c2542b2696f6f803c0858e21985eee27e1d5ab836d079f9aa8794c3db227fb224e35624c81468
SSDEEP 98304:cwkLLHCHeNzaUy+7/N4rh0LbxQR8tSI11IpfmJHB59EIz1FkKqRzhPoXUuvG:cNLIeNF97/N4rh8mR8tzIpfmxJhpFvUH
MD5 SHA1 SHA512 SSDEEP

Submit Download

7za.exe

Path C:\Users\Admin\AppData\Local\Temp\is-K7F74.tmp\7za.exe
Size 574KB
SHA256 c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf
MD5 42badc1d2f03a8b1e4875740d3d49336
SHA1 cee178da1fb05f99af7a3547093122893bd1eb46
SHA512 6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c
SSDEEP 12288:myyKdVnyNhXCV4EkP7AIfzNXZ0b5NrnkcAqIV0A1caRI:mKvyNhXCV4E8BXAfrnkcAqU0A
MD5 SHA1 SHA512 SSDEEP

Submit Download

7za.exe

Path C:\Users\Admin\AppData\Local\Temp\is-K7F74.tmp\7za.exe
Size 574KB
SHA256 c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf
MD5 42badc1d2f03a8b1e4875740d3d49336
SHA1 cee178da1fb05f99af7a3547093122893bd1eb46
SHA512 6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c
SSDEEP 12288:myyKdVnyNhXCV4EkP7AIfzNXZ0b5NrnkcAqIV0A1caRI:mKvyNhXCV4E8BXAfrnkcAqU0A
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1564-130-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/1564-134-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads