Analysis
-
max time kernel
150s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
18-10-2022 08:27
Behavioral task
behavioral1
Sample
aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe
-
Size
42KB
-
MD5
485a9199578ab6219dce9435d4289071
-
SHA1
ab5431ec64d80fcf12f327200954a367f6466623
-
SHA256
aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da
-
SHA512
a7e78ce53fb008372f4878593b05b11ab6e48c2a3cde9f0266457688832ee5dae673b9f336f81d313665c04907615bd8468dfa3a95ff7dcb43187ca12a9e4dba
-
SSDEEP
768:vO1oR/rVS1RzK4wbs+D/SIJX+ZZ1SQQwZxMPPzDf4rOcWNJLoYg:v5S1FKnDtkxMfjNJ8
Score
9/10
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
pid Process 1784 wbadmin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\rtscom.dll.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\7-Zip\7z.sfx aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\7-Zip\descript.ion aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresslm.dat aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1284 940 WerFault.exe 27 -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1616 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1604 aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeBackupPrivilege 1584 vssvc.exe Token: SeRestorePrivilege 1584 vssvc.exe Token: SeAuditPrivilege 1584 vssvc.exe Token: SeBackupPrivilege 1456 wbengine.exe Token: SeRestorePrivilege 1456 wbengine.exe Token: SeSecurityPrivilege 1456 wbengine.exe Token: SeIncreaseQuotaPrivilege 1524 WMIC.exe Token: SeSecurityPrivilege 1524 WMIC.exe Token: SeTakeOwnershipPrivilege 1524 WMIC.exe Token: SeLoadDriverPrivilege 1524 WMIC.exe Token: SeSystemProfilePrivilege 1524 WMIC.exe Token: SeSystemtimePrivilege 1524 WMIC.exe Token: SeProfSingleProcessPrivilege 1524 WMIC.exe Token: SeIncBasePriorityPrivilege 1524 WMIC.exe Token: SeCreatePagefilePrivilege 1524 WMIC.exe Token: SeBackupPrivilege 1524 WMIC.exe Token: SeRestorePrivilege 1524 WMIC.exe Token: SeShutdownPrivilege 1524 WMIC.exe Token: SeDebugPrivilege 1524 WMIC.exe Token: SeSystemEnvironmentPrivilege 1524 WMIC.exe Token: SeRemoteShutdownPrivilege 1524 WMIC.exe Token: SeUndockPrivilege 1524 WMIC.exe Token: SeManageVolumePrivilege 1524 WMIC.exe Token: 33 1524 WMIC.exe Token: 34 1524 WMIC.exe Token: 35 1524 WMIC.exe Token: SeIncreaseQuotaPrivilege 1524 WMIC.exe Token: SeSecurityPrivilege 1524 WMIC.exe Token: SeTakeOwnershipPrivilege 1524 WMIC.exe Token: SeLoadDriverPrivilege 1524 WMIC.exe Token: SeSystemProfilePrivilege 1524 WMIC.exe Token: SeSystemtimePrivilege 1524 WMIC.exe Token: SeProfSingleProcessPrivilege 1524 WMIC.exe Token: SeIncBasePriorityPrivilege 1524 WMIC.exe Token: SeCreatePagefilePrivilege 1524 WMIC.exe Token: SeBackupPrivilege 1524 WMIC.exe Token: SeRestorePrivilege 1524 WMIC.exe Token: SeShutdownPrivilege 1524 WMIC.exe Token: SeDebugPrivilege 1524 WMIC.exe Token: SeSystemEnvironmentPrivilege 1524 WMIC.exe Token: SeRemoteShutdownPrivilege 1524 WMIC.exe Token: SeUndockPrivilege 1524 WMIC.exe Token: SeManageVolumePrivilege 1524 WMIC.exe Token: 33 1524 WMIC.exe Token: 34 1524 WMIC.exe Token: 35 1524 WMIC.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1604 wrote to memory of 896 1604 aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe 28 PID 1604 wrote to memory of 896 1604 aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe 28 PID 1604 wrote to memory of 896 1604 aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe 28 PID 1604 wrote to memory of 896 1604 aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe 28 PID 896 wrote to memory of 1616 896 cmd.exe 30 PID 896 wrote to memory of 1616 896 cmd.exe 30 PID 896 wrote to memory of 1616 896 cmd.exe 30 PID 940 wrote to memory of 1284 940 aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe 31 PID 940 wrote to memory of 1284 940 aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe 31 PID 940 wrote to memory of 1284 940 aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe 31 PID 940 wrote to memory of 1284 940 aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe 31 PID 896 wrote to memory of 1784 896 cmd.exe 34 PID 896 wrote to memory of 1784 896 cmd.exe 34 PID 896 wrote to memory of 1784 896 cmd.exe 34 PID 896 wrote to memory of 1524 896 cmd.exe 38 PID 896 wrote to memory of 1524 896 cmd.exe 38 PID 896 wrote to memory of 1524 896 cmd.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe"C:\Users\Admin\AppData\Local\Temp\aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe"C:\Users\Admin\AppData\Local\Temp\aa0073548e845d1119186ba77368adfd81dbe0d056ec1f258e83a7dd368972da.exe" n16042⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 1803⤵
- Program crash
PID:1284
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1616
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1784
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1524
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1584
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1456
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:824
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1336
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1652