Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 18:04
Behavioral task
behavioral1
Sample
57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe
-
Size
42KB
-
MD5
faf6a4458904d377205e066232f9bf6a
-
SHA1
c91c8cca87ae602a68729cffe42b8b51c1d85694
-
SHA256
57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb
-
SHA512
9f5b5935745e2b9e44b289ae1b345c80635f215b63af4386d77d341246cbbd79f03c28cc083896cc40377e5e46cee6b606ee5f02927ec448cdd8360622fffc4b
-
SSDEEP
768:FO1oR/sVS1RzK4wbs+D/SIJX+ZZ1SQQwZuIOPzDUZT21hDI+faNcuJ5E1:FQS1FKnDtkuImUVKDxfaiK5U
Score
9/10
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
pid Process 1980 wbadmin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\el.txt 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\AssertOut.au 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File created C:\Program Files\7-Zip\+README-WARNING+.txt 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1756 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1648 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeBackupPrivilege 1760 vssvc.exe Token: SeRestorePrivilege 1760 vssvc.exe Token: SeAuditPrivilege 1760 vssvc.exe Token: SeBackupPrivilege 560 wbengine.exe Token: SeRestorePrivilege 560 wbengine.exe Token: SeSecurityPrivilege 560 wbengine.exe Token: SeIncreaseQuotaPrivilege 808 WMIC.exe Token: SeSecurityPrivilege 808 WMIC.exe Token: SeTakeOwnershipPrivilege 808 WMIC.exe Token: SeLoadDriverPrivilege 808 WMIC.exe Token: SeSystemProfilePrivilege 808 WMIC.exe Token: SeSystemtimePrivilege 808 WMIC.exe Token: SeProfSingleProcessPrivilege 808 WMIC.exe Token: SeIncBasePriorityPrivilege 808 WMIC.exe Token: SeCreatePagefilePrivilege 808 WMIC.exe Token: SeBackupPrivilege 808 WMIC.exe Token: SeRestorePrivilege 808 WMIC.exe Token: SeShutdownPrivilege 808 WMIC.exe Token: SeDebugPrivilege 808 WMIC.exe Token: SeSystemEnvironmentPrivilege 808 WMIC.exe Token: SeRemoteShutdownPrivilege 808 WMIC.exe Token: SeUndockPrivilege 808 WMIC.exe Token: SeManageVolumePrivilege 808 WMIC.exe Token: 33 808 WMIC.exe Token: 34 808 WMIC.exe Token: 35 808 WMIC.exe Token: SeIncreaseQuotaPrivilege 808 WMIC.exe Token: SeSecurityPrivilege 808 WMIC.exe Token: SeTakeOwnershipPrivilege 808 WMIC.exe Token: SeLoadDriverPrivilege 808 WMIC.exe Token: SeSystemProfilePrivilege 808 WMIC.exe Token: SeSystemtimePrivilege 808 WMIC.exe Token: SeProfSingleProcessPrivilege 808 WMIC.exe Token: SeIncBasePriorityPrivilege 808 WMIC.exe Token: SeCreatePagefilePrivilege 808 WMIC.exe Token: SeBackupPrivilege 808 WMIC.exe Token: SeRestorePrivilege 808 WMIC.exe Token: SeShutdownPrivilege 808 WMIC.exe Token: SeDebugPrivilege 808 WMIC.exe Token: SeSystemEnvironmentPrivilege 808 WMIC.exe Token: SeRemoteShutdownPrivilege 808 WMIC.exe Token: SeUndockPrivilege 808 WMIC.exe Token: SeManageVolumePrivilege 808 WMIC.exe Token: 33 808 WMIC.exe Token: 34 808 WMIC.exe Token: 35 808 WMIC.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1648 wrote to memory of 272 1648 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe 29 PID 1648 wrote to memory of 272 1648 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe 29 PID 1648 wrote to memory of 272 1648 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe 29 PID 1648 wrote to memory of 272 1648 57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe 29 PID 272 wrote to memory of 1756 272 cmd.exe 31 PID 272 wrote to memory of 1756 272 cmd.exe 31 PID 272 wrote to memory of 1756 272 cmd.exe 31 PID 272 wrote to memory of 1980 272 cmd.exe 34 PID 272 wrote to memory of 1980 272 cmd.exe 34 PID 272 wrote to memory of 1980 272 cmd.exe 34 PID 272 wrote to memory of 808 272 cmd.exe 38 PID 272 wrote to memory of 808 272 cmd.exe 38 PID 272 wrote to memory of 808 272 cmd.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe"C:\Users\Admin\AppData\Local\Temp\57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe"C:\Users\Admin\AppData\Local\Temp\57973197f4b458aa290e70f6cd5384e0915cff54974cc632c54b2074a0c991bb.exe" n16482⤵PID:804
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:272 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1756
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1980
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:808
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1760
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:560
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1092
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:524
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1484