Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
10-11-2022 00:00
Behavioral task
behavioral1
Sample
d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe
Resource
win10v2004-20220812-en
General
-
Target
d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe
-
Size
42KB
-
MD5
8d809510a9ae7b8ef6fc6a25e5feaa22
-
SHA1
eb0888326adbbbdf1537a965c4d26c71549d43f6
-
SHA256
d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043
-
SHA512
a9ed43be1285f73fda873ee0e39070d4cb3b4b5bd1e69b1506a42f4827f22d0d2f0ad2d25f204ea288f97f6eef787bf0133d0b3659bb8e815f55ff74210e557c
-
SSDEEP
768:PO1oR/UVS1RzK4wbs+D/SIJX+ZZ1SQQwZuIOPzDRufTwsylLO/Ov:PoS1FKnDtkuImTlLOe
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\+README-WARNING+.txt
Nergontr96@cyberfear.com
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Processes:
wbadmin.exepid process 1704 wbadmin.exe -
Drops file in Program Files directory 64 IoCs
Processes:
d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\License.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\readme.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File created C:\Program Files\7-Zip\Lang\+README-WARNING+.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1780 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exepid process 1048 d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
vssvc.exewbengine.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1764 vssvc.exe Token: SeRestorePrivilege 1764 vssvc.exe Token: SeAuditPrivilege 1764 vssvc.exe Token: SeBackupPrivilege 1580 wbengine.exe Token: SeRestorePrivilege 1580 wbengine.exe Token: SeSecurityPrivilege 1580 wbengine.exe Token: SeIncreaseQuotaPrivilege 1120 WMIC.exe Token: SeSecurityPrivilege 1120 WMIC.exe Token: SeTakeOwnershipPrivilege 1120 WMIC.exe Token: SeLoadDriverPrivilege 1120 WMIC.exe Token: SeSystemProfilePrivilege 1120 WMIC.exe Token: SeSystemtimePrivilege 1120 WMIC.exe Token: SeProfSingleProcessPrivilege 1120 WMIC.exe Token: SeIncBasePriorityPrivilege 1120 WMIC.exe Token: SeCreatePagefilePrivilege 1120 WMIC.exe Token: SeBackupPrivilege 1120 WMIC.exe Token: SeRestorePrivilege 1120 WMIC.exe Token: SeShutdownPrivilege 1120 WMIC.exe Token: SeDebugPrivilege 1120 WMIC.exe Token: SeSystemEnvironmentPrivilege 1120 WMIC.exe Token: SeRemoteShutdownPrivilege 1120 WMIC.exe Token: SeUndockPrivilege 1120 WMIC.exe Token: SeManageVolumePrivilege 1120 WMIC.exe Token: 33 1120 WMIC.exe Token: 34 1120 WMIC.exe Token: 35 1120 WMIC.exe Token: SeIncreaseQuotaPrivilege 1120 WMIC.exe Token: SeSecurityPrivilege 1120 WMIC.exe Token: SeTakeOwnershipPrivilege 1120 WMIC.exe Token: SeLoadDriverPrivilege 1120 WMIC.exe Token: SeSystemProfilePrivilege 1120 WMIC.exe Token: SeSystemtimePrivilege 1120 WMIC.exe Token: SeProfSingleProcessPrivilege 1120 WMIC.exe Token: SeIncBasePriorityPrivilege 1120 WMIC.exe Token: SeCreatePagefilePrivilege 1120 WMIC.exe Token: SeBackupPrivilege 1120 WMIC.exe Token: SeRestorePrivilege 1120 WMIC.exe Token: SeShutdownPrivilege 1120 WMIC.exe Token: SeDebugPrivilege 1120 WMIC.exe Token: SeSystemEnvironmentPrivilege 1120 WMIC.exe Token: SeRemoteShutdownPrivilege 1120 WMIC.exe Token: SeUndockPrivilege 1120 WMIC.exe Token: SeManageVolumePrivilege 1120 WMIC.exe Token: 33 1120 WMIC.exe Token: 34 1120 WMIC.exe Token: 35 1120 WMIC.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.execmd.exedescription pid process target process PID 1048 wrote to memory of 1756 1048 d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe cmd.exe PID 1048 wrote to memory of 1756 1048 d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe cmd.exe PID 1048 wrote to memory of 1756 1048 d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe cmd.exe PID 1048 wrote to memory of 1756 1048 d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe cmd.exe PID 1756 wrote to memory of 1780 1756 cmd.exe vssadmin.exe PID 1756 wrote to memory of 1780 1756 cmd.exe vssadmin.exe PID 1756 wrote to memory of 1780 1756 cmd.exe vssadmin.exe PID 1756 wrote to memory of 1704 1756 cmd.exe wbadmin.exe PID 1756 wrote to memory of 1704 1756 cmd.exe wbadmin.exe PID 1756 wrote to memory of 1704 1756 cmd.exe wbadmin.exe PID 1756 wrote to memory of 1120 1756 cmd.exe WMIC.exe PID 1756 wrote to memory of 1120 1756 cmd.exe WMIC.exe PID 1756 wrote to memory of 1120 1756 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe"C:\Users\Admin\AppData\Local\Temp\d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe"C:\Users\Admin\AppData\Local\Temp\d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe" n10482⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1048-54-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB
-
memory/1120-60-0x0000000000000000-mapping.dmp
-
memory/1704-58-0x0000000000000000-mapping.dmp
-
memory/1704-59-0x000007FEFC281000-0x000007FEFC283000-memory.dmpFilesize
8KB
-
memory/1756-56-0x0000000000000000-mapping.dmp
-
memory/1780-57-0x0000000000000000-mapping.dmp