Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
18-10-2022 08:28
Behavioral task
behavioral1
Sample
8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe
-
Size
42KB
-
MD5
4a542b3b4d9160019cc5a76a881f787f
-
SHA1
87137f376a99baea1931fed024b76fc871590840
-
SHA256
8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661
-
SHA512
2b20847fc0fa830c3190b9084cd43fe36cae279b0e4e06760b50e16714fbaef2a4eb9634f30acad96781266a7bba74f7190d93812e3a129a0ff04d14704e68e1
-
SSDEEP
768:oO1oR/rVS1RzK4wbs+D/SIJX+ZZ1SQQwZuI6PzDf4rOcWNJLoYg:o5S1FKnDtkuIyjNJ8
Score
9/10
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
pid Process 1604 wbadmin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File created C:\Program Files\7-Zip\Lang\+README-WARNING+.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\readme.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1780 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1048 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeBackupPrivilege 1764 vssvc.exe Token: SeRestorePrivilege 1764 vssvc.exe Token: SeAuditPrivilege 1764 vssvc.exe Token: SeBackupPrivilege 764 wbengine.exe Token: SeRestorePrivilege 764 wbengine.exe Token: SeSecurityPrivilege 764 wbengine.exe Token: SeIncreaseQuotaPrivilege 992 WMIC.exe Token: SeSecurityPrivilege 992 WMIC.exe Token: SeTakeOwnershipPrivilege 992 WMIC.exe Token: SeLoadDriverPrivilege 992 WMIC.exe Token: SeSystemProfilePrivilege 992 WMIC.exe Token: SeSystemtimePrivilege 992 WMIC.exe Token: SeProfSingleProcessPrivilege 992 WMIC.exe Token: SeIncBasePriorityPrivilege 992 WMIC.exe Token: SeCreatePagefilePrivilege 992 WMIC.exe Token: SeBackupPrivilege 992 WMIC.exe Token: SeRestorePrivilege 992 WMIC.exe Token: SeShutdownPrivilege 992 WMIC.exe Token: SeDebugPrivilege 992 WMIC.exe Token: SeSystemEnvironmentPrivilege 992 WMIC.exe Token: SeRemoteShutdownPrivilege 992 WMIC.exe Token: SeUndockPrivilege 992 WMIC.exe Token: SeManageVolumePrivilege 992 WMIC.exe Token: 33 992 WMIC.exe Token: 34 992 WMIC.exe Token: 35 992 WMIC.exe Token: SeIncreaseQuotaPrivilege 992 WMIC.exe Token: SeSecurityPrivilege 992 WMIC.exe Token: SeTakeOwnershipPrivilege 992 WMIC.exe Token: SeLoadDriverPrivilege 992 WMIC.exe Token: SeSystemProfilePrivilege 992 WMIC.exe Token: SeSystemtimePrivilege 992 WMIC.exe Token: SeProfSingleProcessPrivilege 992 WMIC.exe Token: SeIncBasePriorityPrivilege 992 WMIC.exe Token: SeCreatePagefilePrivilege 992 WMIC.exe Token: SeBackupPrivilege 992 WMIC.exe Token: SeRestorePrivilege 992 WMIC.exe Token: SeShutdownPrivilege 992 WMIC.exe Token: SeDebugPrivilege 992 WMIC.exe Token: SeSystemEnvironmentPrivilege 992 WMIC.exe Token: SeRemoteShutdownPrivilege 992 WMIC.exe Token: SeUndockPrivilege 992 WMIC.exe Token: SeManageVolumePrivilege 992 WMIC.exe Token: 33 992 WMIC.exe Token: 34 992 WMIC.exe Token: 35 992 WMIC.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1048 wrote to memory of 1756 1048 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe 28 PID 1048 wrote to memory of 1756 1048 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe 28 PID 1048 wrote to memory of 1756 1048 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe 28 PID 1048 wrote to memory of 1756 1048 8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe 28 PID 1756 wrote to memory of 1780 1756 cmd.exe 30 PID 1756 wrote to memory of 1780 1756 cmd.exe 30 PID 1756 wrote to memory of 1780 1756 cmd.exe 30 PID 1756 wrote to memory of 1604 1756 cmd.exe 33 PID 1756 wrote to memory of 1604 1756 cmd.exe 33 PID 1756 wrote to memory of 1604 1756 cmd.exe 33 PID 1756 wrote to memory of 992 1756 cmd.exe 37 PID 1756 wrote to memory of 992 1756 cmd.exe 37 PID 1756 wrote to memory of 992 1756 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe"C:\Users\Admin\AppData\Local\Temp\8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe"C:\Users\Admin\AppData\Local\Temp\8d2c9a58915d4889b93a09df0917a774309a3976cb555a8a850530433d714661.exe" n10482⤵PID:1996
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1780
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1604
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:992
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1764
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:764
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1724
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1636
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:360