aa9c86a823e654e20b42edc829a890f08b0ffffaaa4054ca0033e0b4fae5765b

Analysis

max time kernel
106s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2022, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e-dekont.html.exe
Size 1.2MB
Sample220920-mpdmgacgd8
SHA256 aa9c86a823e654e20b42edc829a890f08b0ffffaaa4054ca0033e0b4fae5765b
MD5 36a27b3829ee10c9e62d95f9e2179636
SHA1 ea35b945c7a9a0f40a4dd8695c5d669cdffe2bcb
SHA512 6a3e787833cbba825357efc6c5e848a027172c8d05bb866bcfe2b7a0e8db78f89223d16d6bc97f23749158094965898da93b743e0fc611e0a57c858368e5fb58
SSDEEP 24576:iAOcZXp0ii5IjX3+gcOJ/skVGfT8LMW7w84UopeOH+2UNUquptQZu:oR5Iz3+aZsc0wUUbJZupz
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4164	vutqkdh.pif

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	e-dekont.html.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4164 set thread context of 3380	4164	vutqkdh.pif	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4380	3380	WerFault.exe	92

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 4164	3852	e-dekont.html.exe	86
PID 3852 wrote to memory of 4164	3852	e-dekont.html.exe	86
PID 3852 wrote to memory of 4164	3852	e-dekont.html.exe	86
PID 4164 wrote to memory of 2716	4164	vutqkdh.pif	91
PID 4164 wrote to memory of 2716	4164	vutqkdh.pif	91
PID 4164 wrote to memory of 2716	4164	vutqkdh.pif	91
PID 4164 wrote to memory of 3380	4164	vutqkdh.pif	92
PID 4164 wrote to memory of 3380	4164	vutqkdh.pif	92
PID 4164 wrote to memory of 3380	4164	vutqkdh.pif	92
PID 4164 wrote to memory of 3380	4164	vutqkdh.pif	92

C:\Users\Admin\AppData\Local\Temp\e-dekont.html.exe
"C:\Users\Admin\AppData\Local\Temp\e-dekont.html.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Users\Admin\10_57\vutqkdh.pif
  "C:\Users\Admin\10_57\vutqkdh.pif" aboisp.kjb
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:2716
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:3380
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 80
      4⤵
      Program crash
      PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3380 -ip 3380
1⤵
PID:2216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aboisp.kjb

Path C:\Users\Admin\10_57\aboisp.kjb
Size 218.3MB
SHA256 fdb2f2718b356cce5918e5d8a39caf5f09638dc0b447c4cda585048d1f8940bf
MD5 de57714b498ade9c2e7b3d283f1f615f
SHA1 80f25dad84740d3e7b193a00f5bec501e6464922
SHA512 bada3805012b86213309a86d4f180f550bd87cb38cd304d35bc3a7d6df8aa8d7c27bbdee8b9b7cdb291ac9421b4ab38c82ff8467273ced8b7bd03322a10c2685
SSDEEP 393216:o0ooDp3s0n0cOHnhLvwRNuy7JKGJstEvuUgYDBbMYMRopT6CBq/e9C7+yBVgB9bq:k
MD5 SHA1 SHA512 SSDEEP

Submit Download

komsgoedgf.vsr

Path C:\Users\Admin\10_57\komsgoedgf.vsr
Size 371KB
SHA256 72ed4aa8c4ffc08dc12738f29bcf65917c13094f0ee8b432926f74ced10e7dda
MD5 e912cc79a69def034eb3c2edd136be36
SHA1 b6a83f4c70a0c8a64b3fd6847f134887c87aaa26
SHA512 25ab44ba66ae2012635099ec9cb713cc79ed3d148a61e6b608e39d6a09b636bb8826ebae78b6b09675bf9bf07e39efb594fe6b5ad6f879b3921178b599579638
SSDEEP 6144:nDttm2P0yEctgbe7dPK7bYPcq0E3ZR1rvlhzmq9f:n3PAagbeSK3pr9Jm+
MD5 SHA1 SHA512 SSDEEP

Submit Download

pbetw.xls

Path C:\Users\Admin\10_57\pbetw.xls
Size 39KB
SHA256 1be7f254a138a0a3254e4cf4230fccd90df362e063c77e195062e787b4452767
MD5 d64fb19f5d025795ab3fa4741ec37944
SHA1 6e576703123a9e5ed1a6f4863b8ce420a6ca7090
SHA512 0e5daedc5932a05ccf06fca767b5fc2325029efd0a1142e16fb67f897b7367b076d6ca7e3e1a071af677d06ce1cedd94f815d102d3e5be3fcd9b796b127c3109
SSDEEP 768:viMAj3s+dsFpHXi4FbElnDto8j7V7kelAcpa/eHzSR+9:vI8+dsF7FbUJL7VgCp2es+9
MD5 SHA1 SHA512 SSDEEP

Submit Download

vutqkdh.pif

Path C:\Users\Admin\10_57\vutqkdh.pif
Size 1.3MB
SHA256 21dd8e3960c9e3f987a40d30fdb7ebbe9139dfa9b5e5700e36cbd209f36269d0
MD5 92b9ea22338dcd34bc1d8bef60a635a4
SHA1 b7da7f7f1533e073463ba02f986e5c17e15d39c3
SHA512 ff8922aab4ef89f6c67921274a35c558f88e419e43312252a744123e25981f2f297c6bc00ac57d462f66cf99ce24cc642a2fbf84861c0875d30486271fb712f5
SSDEEP 12288:sBzZm7d9AZAYJVB7ii/XAvKxRJBnwvogSJ4M4G4aXrfZetgL5L6w5DGDt2:+cneJVBvXAvwRJdwvZ5a7Ww5DGR2
MD5 SHA1 SHA512 SSDEEP

Submit Download

vutqkdh.pif

Path C:\Users\Admin\10_57\vutqkdh.pif
Size 1.3MB
SHA256 21dd8e3960c9e3f987a40d30fdb7ebbe9139dfa9b5e5700e36cbd209f36269d0
MD5 92b9ea22338dcd34bc1d8bef60a635a4
SHA1 b7da7f7f1533e073463ba02f986e5c17e15d39c3
SHA512 ff8922aab4ef89f6c67921274a35c558f88e419e43312252a744123e25981f2f297c6bc00ac57d462f66cf99ce24cc642a2fbf84861c0875d30486271fb712f5
SSDEEP 12288:sBzZm7d9AZAYJVB7ii/XAvKxRJBnwvogSJ4M4G4aXrfZetgL5L6w5DGDt2:+cneJVBvXAvwRJdwvZ5a7Ww5DGR2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads