Analysis
-
max time kernel
40s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
07-12-2022 11:46
Static task
static1
Behavioral task
behavioral1
Sample
e-dekont.html.exe
Resource
win7-20221111-en
General
-
Target
e-dekont.html.exe
-
Size
322KB
-
MD5
55118de0c492e1425cb3ef8f27ed7124
-
SHA1
2d7a0eee423509129264dce5266c13e0c67e21d3
-
SHA256
6e8de74475e365bdd0f573a03266f447a13f30a76cc2c71d14c1fc5607e1ae5d
-
SHA512
b14b1a918f1760558c5cc4437c1d1626f0c77aa28c3f2fae89985dda4f64f426d0a28b9ccee8e6687472f29a914ccf8e710950898ba0f09e484189e1e7bfd407
-
SSDEEP
6144:QBn1X1benXIzx6/7YMovhl5nqvEQqVX8QYaTttAFvnkU/Vdcf757dpqXbUA0hO:gX1aF/7YZ35n4EQq9zyvz/aVZpqXD04
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
lfjebdgdht.exelfjebdgdht.exepid process 1376 lfjebdgdht.exe 768 lfjebdgdht.exe -
Loads dropped DLL 5 IoCs
Processes:
e-dekont.html.exelfjebdgdht.exeWerFault.exepid process 2028 e-dekont.html.exe 1376 lfjebdgdht.exe 1908 WerFault.exe 1908 WerFault.exe 1908 WerFault.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
lfjebdgdht.exedescription pid process target process PID 1376 set thread context of 768 1376 lfjebdgdht.exe lfjebdgdht.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1908 768 WerFault.exe lfjebdgdht.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
lfjebdgdht.exepid process 1376 lfjebdgdht.exe 1376 lfjebdgdht.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
e-dekont.html.exelfjebdgdht.exelfjebdgdht.exedescription pid process target process PID 2028 wrote to memory of 1376 2028 e-dekont.html.exe lfjebdgdht.exe PID 2028 wrote to memory of 1376 2028 e-dekont.html.exe lfjebdgdht.exe PID 2028 wrote to memory of 1376 2028 e-dekont.html.exe lfjebdgdht.exe PID 2028 wrote to memory of 1376 2028 e-dekont.html.exe lfjebdgdht.exe PID 1376 wrote to memory of 768 1376 lfjebdgdht.exe lfjebdgdht.exe PID 1376 wrote to memory of 768 1376 lfjebdgdht.exe lfjebdgdht.exe PID 1376 wrote to memory of 768 1376 lfjebdgdht.exe lfjebdgdht.exe PID 1376 wrote to memory of 768 1376 lfjebdgdht.exe lfjebdgdht.exe PID 1376 wrote to memory of 768 1376 lfjebdgdht.exe lfjebdgdht.exe PID 768 wrote to memory of 1908 768 lfjebdgdht.exe WerFault.exe PID 768 wrote to memory of 1908 768 lfjebdgdht.exe WerFault.exe PID 768 wrote to memory of 1908 768 lfjebdgdht.exe WerFault.exe PID 768 wrote to memory of 1908 768 lfjebdgdht.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e-dekont.html.exe"C:\Users\Admin\AppData\Local\Temp\e-dekont.html.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lfjebdgdht.exe"C:\Users\Admin\AppData\Local\Temp\lfjebdgdht.exe" C:\Users\Admin\AppData\Local\Temp\neylxsdg.s2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lfjebdgdht.exe"C:\Users\Admin\AppData\Local\Temp\lfjebdgdht.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 364⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\lfjebdgdht.exeFilesize
267KB
MD506663976b57ecf3104bfce3ef0ad9145
SHA1721a0946e77b3a1bdb5a38c574cdcf4fb651aae0
SHA25689a921ca7915d2755043e124b9f90ca9d6580f99f5b14d9325f7efc1077217d3
SHA5128be81a0088b0144999f87a22ad41f175417771e49c261ff0db2c01604b4b04b6038b1750949ab18da33f54b56ae5570874ce75bd9457785fb2814eeb3aec19ee
-
C:\Users\Admin\AppData\Local\Temp\lfjebdgdht.exeFilesize
267KB
MD506663976b57ecf3104bfce3ef0ad9145
SHA1721a0946e77b3a1bdb5a38c574cdcf4fb651aae0
SHA25689a921ca7915d2755043e124b9f90ca9d6580f99f5b14d9325f7efc1077217d3
SHA5128be81a0088b0144999f87a22ad41f175417771e49c261ff0db2c01604b4b04b6038b1750949ab18da33f54b56ae5570874ce75bd9457785fb2814eeb3aec19ee
-
C:\Users\Admin\AppData\Local\Temp\lfjebdgdht.exeFilesize
267KB
MD506663976b57ecf3104bfce3ef0ad9145
SHA1721a0946e77b3a1bdb5a38c574cdcf4fb651aae0
SHA25689a921ca7915d2755043e124b9f90ca9d6580f99f5b14d9325f7efc1077217d3
SHA5128be81a0088b0144999f87a22ad41f175417771e49c261ff0db2c01604b4b04b6038b1750949ab18da33f54b56ae5570874ce75bd9457785fb2814eeb3aec19ee
-
C:\Users\Admin\AppData\Local\Temp\neylxsdg.sFilesize
5KB
MD56129ce51566021467204240af3cac6fa
SHA11bc7e72bd7f1a5fb31e2f70d90f4e3d3d3d8ea24
SHA2563917b4d440bb0ee2ba8f2842a524240a4a84007e0a0ae0b521aeb7dec3b2b35a
SHA5128dc6f7916e107322cd2d25b6f2094816484bf2367dfe3d2b1e1577d09b604539e8c82d54ea3bfebb3ab44b44bb34d3b1da54905710e8353de4930c5f801607ce
-
C:\Users\Admin\AppData\Local\Temp\thiayyv.kvuFilesize
185KB
MD5492e12d6214232a2cf8b202b0d0bdef0
SHA1ba082a23e4e5ae05b648763dc4f65ed612f08e50
SHA2565f5a8c0f4c4e538f7a102ecae8bfb0700a2f3b2198766fd6efedb365d4d1ad11
SHA5128e5625472ec098a301e328b0fb827a77bf3e30f66c4aa0af8fa6e3735b43c655a84bc6fe7e427a0cd0fbd8cb3da6e5a1acee9e577c3f2a5d0c571074485d8d83
-
\Users\Admin\AppData\Local\Temp\lfjebdgdht.exeFilesize
267KB
MD506663976b57ecf3104bfce3ef0ad9145
SHA1721a0946e77b3a1bdb5a38c574cdcf4fb651aae0
SHA25689a921ca7915d2755043e124b9f90ca9d6580f99f5b14d9325f7efc1077217d3
SHA5128be81a0088b0144999f87a22ad41f175417771e49c261ff0db2c01604b4b04b6038b1750949ab18da33f54b56ae5570874ce75bd9457785fb2814eeb3aec19ee
-
\Users\Admin\AppData\Local\Temp\lfjebdgdht.exeFilesize
267KB
MD506663976b57ecf3104bfce3ef0ad9145
SHA1721a0946e77b3a1bdb5a38c574cdcf4fb651aae0
SHA25689a921ca7915d2755043e124b9f90ca9d6580f99f5b14d9325f7efc1077217d3
SHA5128be81a0088b0144999f87a22ad41f175417771e49c261ff0db2c01604b4b04b6038b1750949ab18da33f54b56ae5570874ce75bd9457785fb2814eeb3aec19ee
-
\Users\Admin\AppData\Local\Temp\lfjebdgdht.exeFilesize
267KB
MD506663976b57ecf3104bfce3ef0ad9145
SHA1721a0946e77b3a1bdb5a38c574cdcf4fb651aae0
SHA25689a921ca7915d2755043e124b9f90ca9d6580f99f5b14d9325f7efc1077217d3
SHA5128be81a0088b0144999f87a22ad41f175417771e49c261ff0db2c01604b4b04b6038b1750949ab18da33f54b56ae5570874ce75bd9457785fb2814eeb3aec19ee
-
\Users\Admin\AppData\Local\Temp\lfjebdgdht.exeFilesize
267KB
MD506663976b57ecf3104bfce3ef0ad9145
SHA1721a0946e77b3a1bdb5a38c574cdcf4fb651aae0
SHA25689a921ca7915d2755043e124b9f90ca9d6580f99f5b14d9325f7efc1077217d3
SHA5128be81a0088b0144999f87a22ad41f175417771e49c261ff0db2c01604b4b04b6038b1750949ab18da33f54b56ae5570874ce75bd9457785fb2814eeb3aec19ee
-
\Users\Admin\AppData\Local\Temp\lfjebdgdht.exeFilesize
267KB
MD506663976b57ecf3104bfce3ef0ad9145
SHA1721a0946e77b3a1bdb5a38c574cdcf4fb651aae0
SHA25689a921ca7915d2755043e124b9f90ca9d6580f99f5b14d9325f7efc1077217d3
SHA5128be81a0088b0144999f87a22ad41f175417771e49c261ff0db2c01604b4b04b6038b1750949ab18da33f54b56ae5570874ce75bd9457785fb2814eeb3aec19ee
-
memory/768-62-0x000000000009F020-mapping.dmp
-
memory/1376-56-0x0000000000000000-mapping.dmp
-
memory/1908-64-0x0000000000000000-mapping.dmp
-
memory/2028-54-0x0000000075881000-0x0000000075883000-memory.dmpFilesize
8KB