Analysis
-
max time kernel
167s -
max time network
141s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 01:26
Static task
static1
Behavioral task
behavioral1
Sample
949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe
-
Size
66KB
-
MD5
b5f8b0a1e57ea0bebe817de50e3b34b7
-
SHA1
f2955890b2aef6f7ad29ed3a2efea425e1851fea
-
SHA256
949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65
-
SHA512
95e82028bc3de2885caaa316787eb056e06fa6b599d98b6e35505bd77a56a300c8bb5197cacf3332fe26008f432654aefc1fdcbbb6ddb5aa0b316d7f16f10899
Score
9/10
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\PingEnter.tiff 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\cs.txt 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADVCMP.DIC 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\SOLVER.XLAM 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSGR3EN.LEX 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\Windows Journal\Templates\Dotted_Line.jtp 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\Java\jre7\lib\alt-rt.jar 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\Windows Journal\Templates\Memo.jtp 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART8.BDR 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL065.XML 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\release 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLCPRTID.XML 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\M1033DSK.UDT 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\external_extensions.json 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\AddToViewArrow.jpg 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\JFONT.DAT 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ENGIDX.DAT 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\ant-javafx.jar 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPPT.OLB 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OCRVC.DAT 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\CAGCAT10.MML 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\PROCDB.XLAM 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\ConvertFromStop.mp2 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\LICENSE 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADVZIP.DIC 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\builtincontrolsschema.xsd 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10219_.GIF 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\Synchronization.rll 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.BusinessData.xml 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL001.XML 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\14\Built-In Building Blocks.dotx 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\M1033DSK.CRT 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL020.XML 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\setup.ini 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Graph.exe.manifest 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\Microsoft Office\Office14\VisioCustom.propdesc 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\SynchronizationEula.rtf 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CharSetTable.chr 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE.MANIFEST 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\LICENSE 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\DisconnectStop.zip 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\FormatOut.aiff 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\PushFind.sql 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\cs.pak 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_GreenTea.gif 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\FindReset.3g2 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDIRMV.XML 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\attention.gif 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\winamp2.xml 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 988 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe Token: SeImpersonatePrivilege 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe Token: SeBackupPrivilege 5968 vssvc.exe Token: SeRestorePrivilege 5968 vssvc.exe Token: SeAuditPrivilege 5968 vssvc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 864 wrote to memory of 988 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 29 PID 864 wrote to memory of 988 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 29 PID 864 wrote to memory of 988 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 29 PID 864 wrote to memory of 988 864 949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe"C:\Users\Admin\AppData\Local\Temp\949fae98b348c681b12e5aa825316313e1d161e7a4d93e3062d97be310404f65.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:988
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5968