Analysis
-
max time kernel
152s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07-11-2022 18:04
Behavioral task
behavioral1
Sample
1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe
Resource
win7-20220901-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe
-
Size
42KB
-
MD5
ce36475e41157b1187801d6b663ab744
-
SHA1
70a4c1e77ab8c2de2cdf928dabd7fedfbd7a41c4
-
SHA256
1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808
-
SHA512
1526d76a12e6cb98630d711752281068daa9188d7aaccaf3049d28fc4b18a24eb6a81c161d616273b7e4deefa24f5481b8e4ff58a6c8491737763fc9e21bb521
-
SSDEEP
768:PO1oR/rVS1RzK4wbs+D/SIJX+ZZ1SQQwZuIOPzD04rOcWNJLoYg:P5S1FKnDtkuImKNJ8
Score
9/10
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
pid Process 848 wbadmin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\cs.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\descript.ion 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\ClearSave.png 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1720 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1128 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeBackupPrivilege 1072 vssvc.exe Token: SeRestorePrivilege 1072 vssvc.exe Token: SeAuditPrivilege 1072 vssvc.exe Token: SeBackupPrivilege 1220 wbengine.exe Token: SeRestorePrivilege 1220 wbengine.exe Token: SeSecurityPrivilege 1220 wbengine.exe Token: SeIncreaseQuotaPrivilege 1000 WMIC.exe Token: SeSecurityPrivilege 1000 WMIC.exe Token: SeTakeOwnershipPrivilege 1000 WMIC.exe Token: SeLoadDriverPrivilege 1000 WMIC.exe Token: SeSystemProfilePrivilege 1000 WMIC.exe Token: SeSystemtimePrivilege 1000 WMIC.exe Token: SeProfSingleProcessPrivilege 1000 WMIC.exe Token: SeIncBasePriorityPrivilege 1000 WMIC.exe Token: SeCreatePagefilePrivilege 1000 WMIC.exe Token: SeBackupPrivilege 1000 WMIC.exe Token: SeRestorePrivilege 1000 WMIC.exe Token: SeShutdownPrivilege 1000 WMIC.exe Token: SeDebugPrivilege 1000 WMIC.exe Token: SeSystemEnvironmentPrivilege 1000 WMIC.exe Token: SeRemoteShutdownPrivilege 1000 WMIC.exe Token: SeUndockPrivilege 1000 WMIC.exe Token: SeManageVolumePrivilege 1000 WMIC.exe Token: 33 1000 WMIC.exe Token: 34 1000 WMIC.exe Token: 35 1000 WMIC.exe Token: SeIncreaseQuotaPrivilege 1000 WMIC.exe Token: SeSecurityPrivilege 1000 WMIC.exe Token: SeTakeOwnershipPrivilege 1000 WMIC.exe Token: SeLoadDriverPrivilege 1000 WMIC.exe Token: SeSystemProfilePrivilege 1000 WMIC.exe Token: SeSystemtimePrivilege 1000 WMIC.exe Token: SeProfSingleProcessPrivilege 1000 WMIC.exe Token: SeIncBasePriorityPrivilege 1000 WMIC.exe Token: SeCreatePagefilePrivilege 1000 WMIC.exe Token: SeBackupPrivilege 1000 WMIC.exe Token: SeRestorePrivilege 1000 WMIC.exe Token: SeShutdownPrivilege 1000 WMIC.exe Token: SeDebugPrivilege 1000 WMIC.exe Token: SeSystemEnvironmentPrivilege 1000 WMIC.exe Token: SeRemoteShutdownPrivilege 1000 WMIC.exe Token: SeUndockPrivilege 1000 WMIC.exe Token: SeManageVolumePrivilege 1000 WMIC.exe Token: 33 1000 WMIC.exe Token: 34 1000 WMIC.exe Token: 35 1000 WMIC.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1128 wrote to memory of 1788 1128 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe 28 PID 1128 wrote to memory of 1788 1128 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe 28 PID 1128 wrote to memory of 1788 1128 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe 28 PID 1128 wrote to memory of 1788 1128 1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe 28 PID 1788 wrote to memory of 1720 1788 cmd.exe 30 PID 1788 wrote to memory of 1720 1788 cmd.exe 30 PID 1788 wrote to memory of 1720 1788 cmd.exe 30 PID 1788 wrote to memory of 848 1788 cmd.exe 33 PID 1788 wrote to memory of 848 1788 cmd.exe 33 PID 1788 wrote to memory of 848 1788 cmd.exe 33 PID 1788 wrote to memory of 1000 1788 cmd.exe 37 PID 1788 wrote to memory of 1000 1788 cmd.exe 37 PID 1788 wrote to memory of 1000 1788 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe"C:\Users\Admin\AppData\Local\Temp\1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe"C:\Users\Admin\AppData\Local\Temp\1ec36906942f364c760a7d1704faaa3dfcd7d52bcd1678e8c7a2c434ca785808.exe" n11282⤵PID:1780
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1720
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:848
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1000
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1072
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1220
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2008
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1472
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:544