Analysis
-
max time kernel
152s -
max time network
53s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07-11-2022 18:04
Behavioral task
behavioral1
Sample
9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe
Resource
win7-20220901-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe
-
Size
42KB
-
MD5
f376b269b7947fbc0c0c7dd7ce41a9f2
-
SHA1
022cfe09fa5e385dabf2322a4a56ff3d2aee9bac
-
SHA256
9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3
-
SHA512
99e4c29dc536ea7c55172adc8843a520227c3d91a1dbf664a390a5191dce7c8403380c4166e86864079769054670b3de91f2d515ede3e83cfd359ade4a471d67
-
SSDEEP
768:EO1oR/DVS1RzK4wbs+D/SIJX+ZZ1SQQwZuIOPzDq1xTq3ZQJtCQ:EBS1FKnDtkuImq+3ZQX
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\908923315\+README-WARNING+.txt
Ransom Note
::: Greetings :::
Little FAQ:
.1.
Q: Whats Happen?
A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen.
.2.
Q: How to recover files?
A: If you wish to decrypt your files you will need to pay us.
.3.
Q: What about guarantees?
A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests.
To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.
.4.
Q: How to contact with you?
A: You can write us to our mailboxes: [email protected] or [email protected]
.5.
Q: How will the decryption process proceed after payment?
A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files.
.6.
Q: If I don�t want to pay bad people like you?
A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money.
:::BEWARE:::
DON'T try to change encrypted files by yourself!
If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files!
Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
pid Process 1604 wbadmin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File created C:\Program Files\7-Zip\Lang\+README-WARNING+.txt 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\AddInitialize.mpeg3 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\7-Zip\History.txt 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\ClosePush.M2TS 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 944 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1364 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeBackupPrivilege 472 vssvc.exe Token: SeRestorePrivilege 472 vssvc.exe Token: SeAuditPrivilege 472 vssvc.exe Token: SeBackupPrivilege 296 wbengine.exe Token: SeRestorePrivilege 296 wbengine.exe Token: SeSecurityPrivilege 296 wbengine.exe Token: SeIncreaseQuotaPrivilege 924 WMIC.exe Token: SeSecurityPrivilege 924 WMIC.exe Token: SeTakeOwnershipPrivilege 924 WMIC.exe Token: SeLoadDriverPrivilege 924 WMIC.exe Token: SeSystemProfilePrivilege 924 WMIC.exe Token: SeSystemtimePrivilege 924 WMIC.exe Token: SeProfSingleProcessPrivilege 924 WMIC.exe Token: SeIncBasePriorityPrivilege 924 WMIC.exe Token: SeCreatePagefilePrivilege 924 WMIC.exe Token: SeBackupPrivilege 924 WMIC.exe Token: SeRestorePrivilege 924 WMIC.exe Token: SeShutdownPrivilege 924 WMIC.exe Token: SeDebugPrivilege 924 WMIC.exe Token: SeSystemEnvironmentPrivilege 924 WMIC.exe Token: SeRemoteShutdownPrivilege 924 WMIC.exe Token: SeUndockPrivilege 924 WMIC.exe Token: SeManageVolumePrivilege 924 WMIC.exe Token: 33 924 WMIC.exe Token: 34 924 WMIC.exe Token: 35 924 WMIC.exe Token: SeIncreaseQuotaPrivilege 924 WMIC.exe Token: SeSecurityPrivilege 924 WMIC.exe Token: SeTakeOwnershipPrivilege 924 WMIC.exe Token: SeLoadDriverPrivilege 924 WMIC.exe Token: SeSystemProfilePrivilege 924 WMIC.exe Token: SeSystemtimePrivilege 924 WMIC.exe Token: SeProfSingleProcessPrivilege 924 WMIC.exe Token: SeIncBasePriorityPrivilege 924 WMIC.exe Token: SeCreatePagefilePrivilege 924 WMIC.exe Token: SeBackupPrivilege 924 WMIC.exe Token: SeRestorePrivilege 924 WMIC.exe Token: SeShutdownPrivilege 924 WMIC.exe Token: SeDebugPrivilege 924 WMIC.exe Token: SeSystemEnvironmentPrivilege 924 WMIC.exe Token: SeRemoteShutdownPrivilege 924 WMIC.exe Token: SeUndockPrivilege 924 WMIC.exe Token: SeManageVolumePrivilege 924 WMIC.exe Token: 33 924 WMIC.exe Token: 34 924 WMIC.exe Token: 35 924 WMIC.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1364 wrote to memory of 1932 1364 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe 27 PID 1364 wrote to memory of 1932 1364 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe 27 PID 1364 wrote to memory of 1932 1364 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe 27 PID 1364 wrote to memory of 1932 1364 9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe 27 PID 1932 wrote to memory of 944 1932 cmd.exe 29 PID 1932 wrote to memory of 944 1932 cmd.exe 29 PID 1932 wrote to memory of 944 1932 cmd.exe 29 PID 1932 wrote to memory of 1604 1932 cmd.exe 32 PID 1932 wrote to memory of 1604 1932 cmd.exe 32 PID 1932 wrote to memory of 1604 1932 cmd.exe 32 PID 1932 wrote to memory of 924 1932 cmd.exe 36 PID 1932 wrote to memory of 924 1932 cmd.exe 36 PID 1932 wrote to memory of 924 1932 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe"C:\Users\Admin\AppData\Local\Temp\9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe"C:\Users\Admin\AppData\Local\Temp\9afcd0047e30af167af749679454fea4a708beb783288e78e6301c85b1b329e3.exe" n13642⤵PID:820
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:944
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1604
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:924
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:472
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:296
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2028
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:2024
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1544