Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23/12/2022, 07:31
Behavioral task
behavioral1
Sample
13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
-
Size
42KB
-
MD5
e946f874088bb866c3d02e0e2fa79daf
-
SHA1
cb476dbdd8242bfbf5ce54e9d1f2ba24b73ac693
-
SHA256
13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3
-
SHA512
158776939338a15897af7bc0cf62ad588ce96aa8db4308643a1bced8e460f3c4fcf92b16832b6981dc6f61908ede817108f5a1a29da3534a4bf85bc9ab7b088c
-
SSDEEP
768:gO1oR/LVS1RzK4wbs+D/SIJX+ZZ1SQQwZuIOPzDT6FhUxuSqA:gpS1FKnDtkuIme7AB
Score
9/10
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
pid Process 1608 wbadmin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tabskb.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\ShapeCollector.exe.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2036 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1412 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeBackupPrivilege 2028 vssvc.exe Token: SeRestorePrivilege 2028 vssvc.exe Token: SeAuditPrivilege 2028 vssvc.exe Token: SeBackupPrivilege 1496 wbengine.exe Token: SeRestorePrivilege 1496 wbengine.exe Token: SeSecurityPrivilege 1496 wbengine.exe Token: SeIncreaseQuotaPrivilege 1992 WMIC.exe Token: SeSecurityPrivilege 1992 WMIC.exe Token: SeTakeOwnershipPrivilege 1992 WMIC.exe Token: SeLoadDriverPrivilege 1992 WMIC.exe Token: SeSystemProfilePrivilege 1992 WMIC.exe Token: SeSystemtimePrivilege 1992 WMIC.exe Token: SeProfSingleProcessPrivilege 1992 WMIC.exe Token: SeIncBasePriorityPrivilege 1992 WMIC.exe Token: SeCreatePagefilePrivilege 1992 WMIC.exe Token: SeBackupPrivilege 1992 WMIC.exe Token: SeRestorePrivilege 1992 WMIC.exe Token: SeShutdownPrivilege 1992 WMIC.exe Token: SeDebugPrivilege 1992 WMIC.exe Token: SeSystemEnvironmentPrivilege 1992 WMIC.exe Token: SeRemoteShutdownPrivilege 1992 WMIC.exe Token: SeUndockPrivilege 1992 WMIC.exe Token: SeManageVolumePrivilege 1992 WMIC.exe Token: 33 1992 WMIC.exe Token: 34 1992 WMIC.exe Token: 35 1992 WMIC.exe Token: SeIncreaseQuotaPrivilege 1992 WMIC.exe Token: SeSecurityPrivilege 1992 WMIC.exe Token: SeTakeOwnershipPrivilege 1992 WMIC.exe Token: SeLoadDriverPrivilege 1992 WMIC.exe Token: SeSystemProfilePrivilege 1992 WMIC.exe Token: SeSystemtimePrivilege 1992 WMIC.exe Token: SeProfSingleProcessPrivilege 1992 WMIC.exe Token: SeIncBasePriorityPrivilege 1992 WMIC.exe Token: SeCreatePagefilePrivilege 1992 WMIC.exe Token: SeBackupPrivilege 1992 WMIC.exe Token: SeRestorePrivilege 1992 WMIC.exe Token: SeShutdownPrivilege 1992 WMIC.exe Token: SeDebugPrivilege 1992 WMIC.exe Token: SeSystemEnvironmentPrivilege 1992 WMIC.exe Token: SeRemoteShutdownPrivilege 1992 WMIC.exe Token: SeUndockPrivilege 1992 WMIC.exe Token: SeManageVolumePrivilege 1992 WMIC.exe Token: 33 1992 WMIC.exe Token: 34 1992 WMIC.exe Token: 35 1992 WMIC.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1412 wrote to memory of 1320 1412 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe 28 PID 1412 wrote to memory of 1320 1412 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe 28 PID 1412 wrote to memory of 1320 1412 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe 28 PID 1412 wrote to memory of 1320 1412 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe 28 PID 1320 wrote to memory of 2036 1320 cmd.exe 30 PID 1320 wrote to memory of 2036 1320 cmd.exe 30 PID 1320 wrote to memory of 2036 1320 cmd.exe 30 PID 1320 wrote to memory of 1608 1320 cmd.exe 33 PID 1320 wrote to memory of 1608 1320 cmd.exe 33 PID 1320 wrote to memory of 1608 1320 cmd.exe 33 PID 1320 wrote to memory of 1992 1320 cmd.exe 37 PID 1320 wrote to memory of 1992 1320 cmd.exe 37 PID 1320 wrote to memory of 1992 1320 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe"C:\Users\Admin\AppData\Local\Temp\13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe"C:\Users\Admin\AppData\Local\Temp\13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe" n14122⤵PID:1800
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2036
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1608
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1992
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1496
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1188
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1944
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1932