Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 07:03
Behavioral task
behavioral1
Sample
f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe
Resource
win10v2004-20220812-en
General
-
Target
f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe
-
Size
42KB
-
MD5
5884482db6adca2b8476c395c66805e7
-
SHA1
4c5b8b834d7d9e8b1316a1b8d2e7b9024022d4ce
-
SHA256
f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839
-
SHA512
4e1007fb311c474217b8dfb810d04c2b188deadf56dcd81ee532a48abeb5fc29ff0eae7628cda5aa78f690f46c2370dfb3379e270ee03e83025f7a872f99e52d
-
SSDEEP
768:AO1oR/RVS1RzK4wbs+D/SIJX+ZZ1SQQwZuIOPzDsUky5DuGMKKz0YnW:AXS1FKnDtkuImNNxFKU
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\+README-WARNING+.txt
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
pid Process 1856 wbadmin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\an.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\History.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File created C:\Program Files\7-Zip\Lang\+README-WARNING+.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\7z.sfx f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\readme.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 908 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1612 f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeBackupPrivilege 1960 vssvc.exe Token: SeRestorePrivilege 1960 vssvc.exe Token: SeAuditPrivilege 1960 vssvc.exe Token: SeBackupPrivilege 1412 wbengine.exe Token: SeRestorePrivilege 1412 wbengine.exe Token: SeSecurityPrivilege 1412 wbengine.exe Token: SeIncreaseQuotaPrivilege 1908 WMIC.exe Token: SeSecurityPrivilege 1908 WMIC.exe Token: SeTakeOwnershipPrivilege 1908 WMIC.exe Token: SeLoadDriverPrivilege 1908 WMIC.exe Token: SeSystemProfilePrivilege 1908 WMIC.exe Token: SeSystemtimePrivilege 1908 WMIC.exe Token: SeProfSingleProcessPrivilege 1908 WMIC.exe Token: SeIncBasePriorityPrivilege 1908 WMIC.exe Token: SeCreatePagefilePrivilege 1908 WMIC.exe Token: SeBackupPrivilege 1908 WMIC.exe Token: SeRestorePrivilege 1908 WMIC.exe Token: SeShutdownPrivilege 1908 WMIC.exe Token: SeDebugPrivilege 1908 WMIC.exe Token: SeSystemEnvironmentPrivilege 1908 WMIC.exe Token: SeRemoteShutdownPrivilege 1908 WMIC.exe Token: SeUndockPrivilege 1908 WMIC.exe Token: SeManageVolumePrivilege 1908 WMIC.exe Token: 33 1908 WMIC.exe Token: 34 1908 WMIC.exe Token: 35 1908 WMIC.exe Token: SeIncreaseQuotaPrivilege 1908 WMIC.exe Token: SeSecurityPrivilege 1908 WMIC.exe Token: SeTakeOwnershipPrivilege 1908 WMIC.exe Token: SeLoadDriverPrivilege 1908 WMIC.exe Token: SeSystemProfilePrivilege 1908 WMIC.exe Token: SeSystemtimePrivilege 1908 WMIC.exe Token: SeProfSingleProcessPrivilege 1908 WMIC.exe Token: SeIncBasePriorityPrivilege 1908 WMIC.exe Token: SeCreatePagefilePrivilege 1908 WMIC.exe Token: SeBackupPrivilege 1908 WMIC.exe Token: SeRestorePrivilege 1908 WMIC.exe Token: SeShutdownPrivilege 1908 WMIC.exe Token: SeDebugPrivilege 1908 WMIC.exe Token: SeSystemEnvironmentPrivilege 1908 WMIC.exe Token: SeRemoteShutdownPrivilege 1908 WMIC.exe Token: SeUndockPrivilege 1908 WMIC.exe Token: SeManageVolumePrivilege 1908 WMIC.exe Token: 33 1908 WMIC.exe Token: 34 1908 WMIC.exe Token: 35 1908 WMIC.exe Token: 33 316 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 316 AUDIODG.EXE Token: 33 316 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 316 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1612 wrote to memory of 1708 1612 f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe 27 PID 1612 wrote to memory of 1708 1612 f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe 27 PID 1612 wrote to memory of 1708 1612 f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe 27 PID 1612 wrote to memory of 1708 1612 f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe 27 PID 1708 wrote to memory of 908 1708 cmd.exe 29 PID 1708 wrote to memory of 908 1708 cmd.exe 29 PID 1708 wrote to memory of 908 1708 cmd.exe 29 PID 1708 wrote to memory of 1856 1708 cmd.exe 32 PID 1708 wrote to memory of 1856 1708 cmd.exe 32 PID 1708 wrote to memory of 1856 1708 cmd.exe 32 PID 1708 wrote to memory of 1908 1708 cmd.exe 36 PID 1708 wrote to memory of 1908 1708 cmd.exe 36 PID 1708 wrote to memory of 1908 1708 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe"C:\Users\Admin\AppData\Local\Temp\f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe"C:\Users\Admin\AppData\Local\Temp\f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe" n16122⤵PID:1952
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:908
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1856
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1908
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1960
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1412
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1736
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1988
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1208
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1744
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4541⤵
- Suspicious use of AdjustPrivilegeToken
PID:316