Analysis
-
max time kernel
150s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
10-11-2022 11:00
Behavioral task
behavioral1
Sample
d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe
Resource
win10v2004-20220812-en
General
-
Target
d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe
-
Size
42KB
-
MD5
8d809510a9ae7b8ef6fc6a25e5feaa22
-
SHA1
eb0888326adbbbdf1537a965c4d26c71549d43f6
-
SHA256
d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043
-
SHA512
a9ed43be1285f73fda873ee0e39070d4cb3b4b5bd1e69b1506a42f4827f22d0d2f0ad2d25f204ea288f97f6eef787bf0133d0b3659bb8e815f55ff74210e557c
-
SSDEEP
768:PO1oR/UVS1RzK4wbs+D/SIJX+ZZ1SQQwZuIOPzDRufTwsylLO/Ov:PoS1FKnDtkuImTlLOe
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\2864480368\+README-WARNING+.txt
Nergontr96@cyberfear.com
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Processes:
wbadmin.exepid process 788 wbadmin.exe -
Drops file in Program Files directory 64 IoCs
Processes:
d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7z.sfx d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\descript.ion d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File created C:\Program Files\7-Zip\Lang\+README-WARNING+.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InputPersonalization.exe.mui d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 768 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exepid process 1672 d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
vssvc.exewbengine.exeWMIC.exedescription pid process Token: SeBackupPrivilege 516 vssvc.exe Token: SeRestorePrivilege 516 vssvc.exe Token: SeAuditPrivilege 516 vssvc.exe Token: SeBackupPrivilege 1280 wbengine.exe Token: SeRestorePrivilege 1280 wbengine.exe Token: SeSecurityPrivilege 1280 wbengine.exe Token: SeIncreaseQuotaPrivilege 1304 WMIC.exe Token: SeSecurityPrivilege 1304 WMIC.exe Token: SeTakeOwnershipPrivilege 1304 WMIC.exe Token: SeLoadDriverPrivilege 1304 WMIC.exe Token: SeSystemProfilePrivilege 1304 WMIC.exe Token: SeSystemtimePrivilege 1304 WMIC.exe Token: SeProfSingleProcessPrivilege 1304 WMIC.exe Token: SeIncBasePriorityPrivilege 1304 WMIC.exe Token: SeCreatePagefilePrivilege 1304 WMIC.exe Token: SeBackupPrivilege 1304 WMIC.exe Token: SeRestorePrivilege 1304 WMIC.exe Token: SeShutdownPrivilege 1304 WMIC.exe Token: SeDebugPrivilege 1304 WMIC.exe Token: SeSystemEnvironmentPrivilege 1304 WMIC.exe Token: SeRemoteShutdownPrivilege 1304 WMIC.exe Token: SeUndockPrivilege 1304 WMIC.exe Token: SeManageVolumePrivilege 1304 WMIC.exe Token: 33 1304 WMIC.exe Token: 34 1304 WMIC.exe Token: 35 1304 WMIC.exe Token: SeIncreaseQuotaPrivilege 1304 WMIC.exe Token: SeSecurityPrivilege 1304 WMIC.exe Token: SeTakeOwnershipPrivilege 1304 WMIC.exe Token: SeLoadDriverPrivilege 1304 WMIC.exe Token: SeSystemProfilePrivilege 1304 WMIC.exe Token: SeSystemtimePrivilege 1304 WMIC.exe Token: SeProfSingleProcessPrivilege 1304 WMIC.exe Token: SeIncBasePriorityPrivilege 1304 WMIC.exe Token: SeCreatePagefilePrivilege 1304 WMIC.exe Token: SeBackupPrivilege 1304 WMIC.exe Token: SeRestorePrivilege 1304 WMIC.exe Token: SeShutdownPrivilege 1304 WMIC.exe Token: SeDebugPrivilege 1304 WMIC.exe Token: SeSystemEnvironmentPrivilege 1304 WMIC.exe Token: SeRemoteShutdownPrivilege 1304 WMIC.exe Token: SeUndockPrivilege 1304 WMIC.exe Token: SeManageVolumePrivilege 1304 WMIC.exe Token: 33 1304 WMIC.exe Token: 34 1304 WMIC.exe Token: 35 1304 WMIC.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.execmd.exedescription pid process target process PID 1672 wrote to memory of 1584 1672 d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe cmd.exe PID 1672 wrote to memory of 1584 1672 d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe cmd.exe PID 1672 wrote to memory of 1584 1672 d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe cmd.exe PID 1672 wrote to memory of 1584 1672 d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe cmd.exe PID 1584 wrote to memory of 768 1584 cmd.exe vssadmin.exe PID 1584 wrote to memory of 768 1584 cmd.exe vssadmin.exe PID 1584 wrote to memory of 768 1584 cmd.exe vssadmin.exe PID 1584 wrote to memory of 788 1584 cmd.exe wbadmin.exe PID 1584 wrote to memory of 788 1584 cmd.exe wbadmin.exe PID 1584 wrote to memory of 788 1584 cmd.exe wbadmin.exe PID 1584 wrote to memory of 1304 1584 cmd.exe WMIC.exe PID 1584 wrote to memory of 1304 1584 cmd.exe WMIC.exe PID 1584 wrote to memory of 1304 1584 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe"C:\Users\Admin\AppData\Local\Temp\d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe"C:\Users\Admin\AppData\Local\Temp\d0dd0f7658b938f9a3036ce308f5018ae0cf3bc516aaf3c18b947afee136c043.exe" n16722⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/768-57-0x0000000000000000-mapping.dmp
-
memory/788-58-0x0000000000000000-mapping.dmp
-
memory/788-59-0x000007FEFB7F1000-0x000007FEFB7F3000-memory.dmpFilesize
8KB
-
memory/1304-60-0x0000000000000000-mapping.dmp
-
memory/1584-56-0x0000000000000000-mapping.dmp
-
memory/1672-54-0x0000000075111000-0x0000000075113000-memory.dmpFilesize
8KB