Analysis
-
max time kernel
151s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07-11-2022 18:05
Behavioral task
behavioral1
Sample
3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe
Resource
win10v2004-20220812-en
General
-
Target
3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe
-
Size
42KB
-
MD5
00d684cb99990cb945126dcfbec26a8b
-
SHA1
fad3d5bb25b763f5e5ef5e12489ca4337bf5242c
-
SHA256
3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1
-
SHA512
643ed41c1d656c6a7fb964c018862698dcd7cc1a2fd23fd9bcc2f1d91e8678e61e02a4db103998854a5d1177f15d8630aa812ace23d03f6f4b610bb126bcd02e
-
SSDEEP
768:tO1oR/IVS1RzK4wbs+D/SIJX+ZZ1SQQwZuIOPzDZVgoelP54qWk:tkS1FKnDtkuImYom2qWk
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\3336253277\+README-WARNING+.txt
Trebaler@goat.si
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Processes:
wbadmin.exepid process 1544 wbadmin.exe -
Drops file in Program Files directory 64 IoCs
Processes:
3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresslm.dat 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\7-Zip\License.txt 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1412 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exepid process 1464 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
vssvc.exewbengine.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1132 vssvc.exe Token: SeRestorePrivilege 1132 vssvc.exe Token: SeAuditPrivilege 1132 vssvc.exe Token: SeBackupPrivilege 1216 wbengine.exe Token: SeRestorePrivilege 1216 wbengine.exe Token: SeSecurityPrivilege 1216 wbengine.exe Token: SeIncreaseQuotaPrivilege 1980 WMIC.exe Token: SeSecurityPrivilege 1980 WMIC.exe Token: SeTakeOwnershipPrivilege 1980 WMIC.exe Token: SeLoadDriverPrivilege 1980 WMIC.exe Token: SeSystemProfilePrivilege 1980 WMIC.exe Token: SeSystemtimePrivilege 1980 WMIC.exe Token: SeProfSingleProcessPrivilege 1980 WMIC.exe Token: SeIncBasePriorityPrivilege 1980 WMIC.exe Token: SeCreatePagefilePrivilege 1980 WMIC.exe Token: SeBackupPrivilege 1980 WMIC.exe Token: SeRestorePrivilege 1980 WMIC.exe Token: SeShutdownPrivilege 1980 WMIC.exe Token: SeDebugPrivilege 1980 WMIC.exe Token: SeSystemEnvironmentPrivilege 1980 WMIC.exe Token: SeRemoteShutdownPrivilege 1980 WMIC.exe Token: SeUndockPrivilege 1980 WMIC.exe Token: SeManageVolumePrivilege 1980 WMIC.exe Token: 33 1980 WMIC.exe Token: 34 1980 WMIC.exe Token: 35 1980 WMIC.exe Token: SeIncreaseQuotaPrivilege 1980 WMIC.exe Token: SeSecurityPrivilege 1980 WMIC.exe Token: SeTakeOwnershipPrivilege 1980 WMIC.exe Token: SeLoadDriverPrivilege 1980 WMIC.exe Token: SeSystemProfilePrivilege 1980 WMIC.exe Token: SeSystemtimePrivilege 1980 WMIC.exe Token: SeProfSingleProcessPrivilege 1980 WMIC.exe Token: SeIncBasePriorityPrivilege 1980 WMIC.exe Token: SeCreatePagefilePrivilege 1980 WMIC.exe Token: SeBackupPrivilege 1980 WMIC.exe Token: SeRestorePrivilege 1980 WMIC.exe Token: SeShutdownPrivilege 1980 WMIC.exe Token: SeDebugPrivilege 1980 WMIC.exe Token: SeSystemEnvironmentPrivilege 1980 WMIC.exe Token: SeRemoteShutdownPrivilege 1980 WMIC.exe Token: SeUndockPrivilege 1980 WMIC.exe Token: SeManageVolumePrivilege 1980 WMIC.exe Token: 33 1980 WMIC.exe Token: 34 1980 WMIC.exe Token: 35 1980 WMIC.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.execmd.exedescription pid process target process PID 1464 wrote to memory of 1212 1464 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe cmd.exe PID 1464 wrote to memory of 1212 1464 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe cmd.exe PID 1464 wrote to memory of 1212 1464 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe cmd.exe PID 1464 wrote to memory of 1212 1464 3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe cmd.exe PID 1212 wrote to memory of 1412 1212 cmd.exe vssadmin.exe PID 1212 wrote to memory of 1412 1212 cmd.exe vssadmin.exe PID 1212 wrote to memory of 1412 1212 cmd.exe vssadmin.exe PID 1212 wrote to memory of 1544 1212 cmd.exe wbadmin.exe PID 1212 wrote to memory of 1544 1212 cmd.exe wbadmin.exe PID 1212 wrote to memory of 1544 1212 cmd.exe wbadmin.exe PID 1212 wrote to memory of 1980 1212 cmd.exe WMIC.exe PID 1212 wrote to memory of 1980 1212 cmd.exe WMIC.exe PID 1212 wrote to memory of 1980 1212 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe"C:\Users\Admin\AppData\Local\Temp\3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe"C:\Users\Admin\AppData\Local\Temp\3138f8369ad54442f46d786bde4ebf38a18e93b05fe8acf34f537129e41270c1.exe" n14642⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1212-55-0x0000000000000000-mapping.dmp
-
memory/1412-57-0x0000000000000000-mapping.dmp
-
memory/1464-54-0x00000000758B1000-0x00000000758B3000-memory.dmpFilesize
8KB
-
memory/1544-58-0x0000000000000000-mapping.dmp
-
memory/1544-59-0x000007FEFB9E1000-0x000007FEFB9E3000-memory.dmpFilesize
8KB
-
memory/1980-60-0x0000000000000000-mapping.dmp