Analysis
-
max time kernel
186s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20-10-2022 08:15
Behavioral task
behavioral1
Sample
1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe
-
Size
42KB
-
MD5
ce36475e41157b1187801d6b663ab744
-
SHA1
70a4c1e77ab8c2de2cdf928dabd7fedfbd7a41c4
-
SHA256
1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808
-
SHA512
1526d76a12e6cb98630d711752281068daa9188d7aaccaf3049d28fc4b18a24eb6a81c161d616273b7e4deefa24f5481b8e4ff58a6c8491737763fc9e21bb521
-
SSDEEP
768:PO1oR/rVS1RzK4wbs+D/SIJX+ZZ1SQQwZuIOPzD04rOcWNJLoYg:P5S1FKnDtkuImKNJ8
Score
9/10
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
pid Process 1672 wbadmin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zCon.sfx 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\CloseDismount.pcx 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\descript.ion 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File created C:\Program Files\7-Zip\+README-WARNING+.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1736 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1492 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeBackupPrivilege 1184 vssvc.exe Token: SeRestorePrivilege 1184 vssvc.exe Token: SeAuditPrivilege 1184 vssvc.exe Token: SeBackupPrivilege 2016 wbengine.exe Token: SeRestorePrivilege 2016 wbengine.exe Token: SeSecurityPrivilege 2016 wbengine.exe Token: SeIncreaseQuotaPrivilege 556 WMIC.exe Token: SeSecurityPrivilege 556 WMIC.exe Token: SeTakeOwnershipPrivilege 556 WMIC.exe Token: SeLoadDriverPrivilege 556 WMIC.exe Token: SeSystemProfilePrivilege 556 WMIC.exe Token: SeSystemtimePrivilege 556 WMIC.exe Token: SeProfSingleProcessPrivilege 556 WMIC.exe Token: SeIncBasePriorityPrivilege 556 WMIC.exe Token: SeCreatePagefilePrivilege 556 WMIC.exe Token: SeBackupPrivilege 556 WMIC.exe Token: SeRestorePrivilege 556 WMIC.exe Token: SeShutdownPrivilege 556 WMIC.exe Token: SeDebugPrivilege 556 WMIC.exe Token: SeSystemEnvironmentPrivilege 556 WMIC.exe Token: SeRemoteShutdownPrivilege 556 WMIC.exe Token: SeUndockPrivilege 556 WMIC.exe Token: SeManageVolumePrivilege 556 WMIC.exe Token: 33 556 WMIC.exe Token: 34 556 WMIC.exe Token: 35 556 WMIC.exe Token: SeIncreaseQuotaPrivilege 556 WMIC.exe Token: SeSecurityPrivilege 556 WMIC.exe Token: SeTakeOwnershipPrivilege 556 WMIC.exe Token: SeLoadDriverPrivilege 556 WMIC.exe Token: SeSystemProfilePrivilege 556 WMIC.exe Token: SeSystemtimePrivilege 556 WMIC.exe Token: SeProfSingleProcessPrivilege 556 WMIC.exe Token: SeIncBasePriorityPrivilege 556 WMIC.exe Token: SeCreatePagefilePrivilege 556 WMIC.exe Token: SeBackupPrivilege 556 WMIC.exe Token: SeRestorePrivilege 556 WMIC.exe Token: SeShutdownPrivilege 556 WMIC.exe Token: SeDebugPrivilege 556 WMIC.exe Token: SeSystemEnvironmentPrivilege 556 WMIC.exe Token: SeRemoteShutdownPrivilege 556 WMIC.exe Token: SeUndockPrivilege 556 WMIC.exe Token: SeManageVolumePrivilege 556 WMIC.exe Token: 33 556 WMIC.exe Token: 34 556 WMIC.exe Token: 35 556 WMIC.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1492 wrote to memory of 1572 1492 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe 29 PID 1492 wrote to memory of 1572 1492 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe 29 PID 1492 wrote to memory of 1572 1492 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe 29 PID 1492 wrote to memory of 1572 1492 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe 29 PID 1572 wrote to memory of 1736 1572 cmd.exe 31 PID 1572 wrote to memory of 1736 1572 cmd.exe 31 PID 1572 wrote to memory of 1736 1572 cmd.exe 31 PID 1572 wrote to memory of 1672 1572 cmd.exe 34 PID 1572 wrote to memory of 1672 1572 cmd.exe 34 PID 1572 wrote to memory of 1672 1572 cmd.exe 34 PID 1572 wrote to memory of 556 1572 cmd.exe 38 PID 1572 wrote to memory of 556 1572 cmd.exe 38 PID 1572 wrote to memory of 556 1572 cmd.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe"C:\Users\Admin\AppData\Local\Temp\1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe"C:\Users\Admin\AppData\Local\Temp\1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe" n14922⤵PID:2028
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1736
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1672
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:556
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1184
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2016
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1684
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:840
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:984