Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
10/11/2022, 05:18
Behavioral task
behavioral1
Sample
d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe
Resource
win10v2004-20220812-en
General
-
Target
d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe
-
Size
42KB
-
MD5
8d809510a9ae7b8ef6fc6a25e5feaa22
-
SHA1
eb0888326adbbbdf1537a965c4d26c71549d43f6
-
SHA256
d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043
-
SHA512
a9ed43be1285f73fda873ee0e39070d4cb3b4b5bd1e69b1506a42f4827f22d0d2f0ad2d25f204ea288f97f6eef787bf0133d0b3659bb8e815f55ff74210e557c
-
SSDEEP
768:PO1oR/UVS1RzK4wbs+D/SIJX+ZZ1SQQwZuIOPzDRufTwsylLO/Ov:PoS1FKnDtkuImTlLOe
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\376279340\+README-WARNING+.txt
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
pid Process 792 wbadmin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InputPersonalization.exe.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\descript.ion d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\History.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1332 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1228 d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeBackupPrivilege 864 vssvc.exe Token: SeRestorePrivilege 864 vssvc.exe Token: SeAuditPrivilege 864 vssvc.exe Token: SeBackupPrivilege 1612 wbengine.exe Token: SeRestorePrivilege 1612 wbengine.exe Token: SeSecurityPrivilege 1612 wbengine.exe Token: SeIncreaseQuotaPrivilege 1640 WMIC.exe Token: SeSecurityPrivilege 1640 WMIC.exe Token: SeTakeOwnershipPrivilege 1640 WMIC.exe Token: SeLoadDriverPrivilege 1640 WMIC.exe Token: SeSystemProfilePrivilege 1640 WMIC.exe Token: SeSystemtimePrivilege 1640 WMIC.exe Token: SeProfSingleProcessPrivilege 1640 WMIC.exe Token: SeIncBasePriorityPrivilege 1640 WMIC.exe Token: SeCreatePagefilePrivilege 1640 WMIC.exe Token: SeBackupPrivilege 1640 WMIC.exe Token: SeRestorePrivilege 1640 WMIC.exe Token: SeShutdownPrivilege 1640 WMIC.exe Token: SeDebugPrivilege 1640 WMIC.exe Token: SeSystemEnvironmentPrivilege 1640 WMIC.exe Token: SeRemoteShutdownPrivilege 1640 WMIC.exe Token: SeUndockPrivilege 1640 WMIC.exe Token: SeManageVolumePrivilege 1640 WMIC.exe Token: 33 1640 WMIC.exe Token: 34 1640 WMIC.exe Token: 35 1640 WMIC.exe Token: SeIncreaseQuotaPrivilege 1640 WMIC.exe Token: SeSecurityPrivilege 1640 WMIC.exe Token: SeTakeOwnershipPrivilege 1640 WMIC.exe Token: SeLoadDriverPrivilege 1640 WMIC.exe Token: SeSystemProfilePrivilege 1640 WMIC.exe Token: SeSystemtimePrivilege 1640 WMIC.exe Token: SeProfSingleProcessPrivilege 1640 WMIC.exe Token: SeIncBasePriorityPrivilege 1640 WMIC.exe Token: SeCreatePagefilePrivilege 1640 WMIC.exe Token: SeBackupPrivilege 1640 WMIC.exe Token: SeRestorePrivilege 1640 WMIC.exe Token: SeShutdownPrivilege 1640 WMIC.exe Token: SeDebugPrivilege 1640 WMIC.exe Token: SeSystemEnvironmentPrivilege 1640 WMIC.exe Token: SeRemoteShutdownPrivilege 1640 WMIC.exe Token: SeUndockPrivilege 1640 WMIC.exe Token: SeManageVolumePrivilege 1640 WMIC.exe Token: 33 1640 WMIC.exe Token: 34 1640 WMIC.exe Token: 35 1640 WMIC.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1228 wrote to memory of 992 1228 d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe 28 PID 1228 wrote to memory of 992 1228 d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe 28 PID 1228 wrote to memory of 992 1228 d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe 28 PID 1228 wrote to memory of 992 1228 d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe 28 PID 992 wrote to memory of 1332 992 cmd.exe 30 PID 992 wrote to memory of 1332 992 cmd.exe 30 PID 992 wrote to memory of 1332 992 cmd.exe 30 PID 992 wrote to memory of 792 992 cmd.exe 33 PID 992 wrote to memory of 792 992 cmd.exe 33 PID 992 wrote to memory of 792 992 cmd.exe 33 PID 992 wrote to memory of 1640 992 cmd.exe 37 PID 992 wrote to memory of 1640 992 cmd.exe 37 PID 992 wrote to memory of 1640 992 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe"C:\Users\Admin\AppData\Local\Temp\d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe"C:\Users\Admin\AppData\Local\Temp\d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe" n12282⤵PID:2020
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1332
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:792
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:864
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1612
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1520
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1916
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1900