Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 18:05
Behavioral task
behavioral1
Sample
ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe
Resource
win10v2004-20220812-en
General
-
Target
ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe
-
Size
42KB
-
MD5
f3049a990188c25ec80626c4475521dd
-
SHA1
7c697f2c2dfa1f92bf8d51e2f17ed41fac9366e3
-
SHA256
ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb
-
SHA512
8caf5e5098079b0331ccd10f89bdd9e70c60f70fac41327bdfb121f6e09f3a298f9abc073258fbbf00822c2556c7aa0d4dd124b6099728d4dd24d7d38cbb5eec
-
SSDEEP
768:gO1oR/lVS1RzK4wbs+D/SIJX+ZZ1SQQwZuIOPzDEimA7tgA3WKi:gzS1FKnDtkuIm4ABPWD
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\2946489079\+README-WARNING+.txt
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
pid Process 988 wbadmin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\readme.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresslm.dat ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1472 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1816 ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeBackupPrivilege 1640 vssvc.exe Token: SeRestorePrivilege 1640 vssvc.exe Token: SeAuditPrivilege 1640 vssvc.exe Token: SeBackupPrivilege 1528 wbengine.exe Token: SeRestorePrivilege 1528 wbengine.exe Token: SeSecurityPrivilege 1528 wbengine.exe Token: SeIncreaseQuotaPrivilege 884 WMIC.exe Token: SeSecurityPrivilege 884 WMIC.exe Token: SeTakeOwnershipPrivilege 884 WMIC.exe Token: SeLoadDriverPrivilege 884 WMIC.exe Token: SeSystemProfilePrivilege 884 WMIC.exe Token: SeSystemtimePrivilege 884 WMIC.exe Token: SeProfSingleProcessPrivilege 884 WMIC.exe Token: SeIncBasePriorityPrivilege 884 WMIC.exe Token: SeCreatePagefilePrivilege 884 WMIC.exe Token: SeBackupPrivilege 884 WMIC.exe Token: SeRestorePrivilege 884 WMIC.exe Token: SeShutdownPrivilege 884 WMIC.exe Token: SeDebugPrivilege 884 WMIC.exe Token: SeSystemEnvironmentPrivilege 884 WMIC.exe Token: SeRemoteShutdownPrivilege 884 WMIC.exe Token: SeUndockPrivilege 884 WMIC.exe Token: SeManageVolumePrivilege 884 WMIC.exe Token: 33 884 WMIC.exe Token: 34 884 WMIC.exe Token: 35 884 WMIC.exe Token: SeIncreaseQuotaPrivilege 884 WMIC.exe Token: SeSecurityPrivilege 884 WMIC.exe Token: SeTakeOwnershipPrivilege 884 WMIC.exe Token: SeLoadDriverPrivilege 884 WMIC.exe Token: SeSystemProfilePrivilege 884 WMIC.exe Token: SeSystemtimePrivilege 884 WMIC.exe Token: SeProfSingleProcessPrivilege 884 WMIC.exe Token: SeIncBasePriorityPrivilege 884 WMIC.exe Token: SeCreatePagefilePrivilege 884 WMIC.exe Token: SeBackupPrivilege 884 WMIC.exe Token: SeRestorePrivilege 884 WMIC.exe Token: SeShutdownPrivilege 884 WMIC.exe Token: SeDebugPrivilege 884 WMIC.exe Token: SeSystemEnvironmentPrivilege 884 WMIC.exe Token: SeRemoteShutdownPrivilege 884 WMIC.exe Token: SeUndockPrivilege 884 WMIC.exe Token: SeManageVolumePrivilege 884 WMIC.exe Token: 33 884 WMIC.exe Token: 34 884 WMIC.exe Token: 35 884 WMIC.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1816 wrote to memory of 900 1816 ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe 28 PID 1816 wrote to memory of 900 1816 ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe 28 PID 1816 wrote to memory of 900 1816 ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe 28 PID 1816 wrote to memory of 900 1816 ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe 28 PID 900 wrote to memory of 1472 900 cmd.exe 30 PID 900 wrote to memory of 1472 900 cmd.exe 30 PID 900 wrote to memory of 1472 900 cmd.exe 30 PID 900 wrote to memory of 988 900 cmd.exe 33 PID 900 wrote to memory of 988 900 cmd.exe 33 PID 900 wrote to memory of 988 900 cmd.exe 33 PID 900 wrote to memory of 884 900 cmd.exe 37 PID 900 wrote to memory of 884 900 cmd.exe 37 PID 900 wrote to memory of 884 900 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe"C:\Users\Admin\AppData\Local\Temp\ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe"C:\Users\Admin\AppData\Local\Temp\ee7fa7fb7150d26c98b2e0f49dbf7cc29c3dcd647a4bc081f982292085978aeb.exe" n18162⤵PID:832
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1472
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:988
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:884
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1528
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:968
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1348
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1460