Analysis
-
max time kernel
150s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-12-2022 06:01
Behavioral task
behavioral1
Sample
13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
-
Size
42KB
-
MD5
e946f874088bb866c3d02e0e2fa79daf
-
SHA1
cb476dbdd8242bfbf5ce54e9d1f2ba24b73ac693
-
SHA256
13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3
-
SHA512
158776939338a15897af7bc0cf62ad588ce96aa8db4308643a1bced8e460f3c4fcf92b16832b6981dc6f61908ede817108f5a1a29da3534a4bf85bc9ab7b088c
-
SSDEEP
768:gO1oR/LVS1RzK4wbs+D/SIJX+ZZ1SQQwZuIOPzDT6FhUxuSqA:gpS1FKnDtkuIme7AB
Score
9/10
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
pid Process 1460 wbadmin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\ku.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File created C:\Program Files\7-Zip\+README-WARNING+.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 904 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1424 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeBackupPrivilege 784 vssvc.exe Token: SeRestorePrivilege 784 vssvc.exe Token: SeAuditPrivilege 784 vssvc.exe Token: SeBackupPrivilege 1136 wbengine.exe Token: SeRestorePrivilege 1136 wbengine.exe Token: SeSecurityPrivilege 1136 wbengine.exe Token: SeIncreaseQuotaPrivilege 924 WMIC.exe Token: SeSecurityPrivilege 924 WMIC.exe Token: SeTakeOwnershipPrivilege 924 WMIC.exe Token: SeLoadDriverPrivilege 924 WMIC.exe Token: SeSystemProfilePrivilege 924 WMIC.exe Token: SeSystemtimePrivilege 924 WMIC.exe Token: SeProfSingleProcessPrivilege 924 WMIC.exe Token: SeIncBasePriorityPrivilege 924 WMIC.exe Token: SeCreatePagefilePrivilege 924 WMIC.exe Token: SeBackupPrivilege 924 WMIC.exe Token: SeRestorePrivilege 924 WMIC.exe Token: SeShutdownPrivilege 924 WMIC.exe Token: SeDebugPrivilege 924 WMIC.exe Token: SeSystemEnvironmentPrivilege 924 WMIC.exe Token: SeRemoteShutdownPrivilege 924 WMIC.exe Token: SeUndockPrivilege 924 WMIC.exe Token: SeManageVolumePrivilege 924 WMIC.exe Token: 33 924 WMIC.exe Token: 34 924 WMIC.exe Token: 35 924 WMIC.exe Token: SeIncreaseQuotaPrivilege 924 WMIC.exe Token: SeSecurityPrivilege 924 WMIC.exe Token: SeTakeOwnershipPrivilege 924 WMIC.exe Token: SeLoadDriverPrivilege 924 WMIC.exe Token: SeSystemProfilePrivilege 924 WMIC.exe Token: SeSystemtimePrivilege 924 WMIC.exe Token: SeProfSingleProcessPrivilege 924 WMIC.exe Token: SeIncBasePriorityPrivilege 924 WMIC.exe Token: SeCreatePagefilePrivilege 924 WMIC.exe Token: SeBackupPrivilege 924 WMIC.exe Token: SeRestorePrivilege 924 WMIC.exe Token: SeShutdownPrivilege 924 WMIC.exe Token: SeDebugPrivilege 924 WMIC.exe Token: SeSystemEnvironmentPrivilege 924 WMIC.exe Token: SeRemoteShutdownPrivilege 924 WMIC.exe Token: SeUndockPrivilege 924 WMIC.exe Token: SeManageVolumePrivilege 924 WMIC.exe Token: 33 924 WMIC.exe Token: 34 924 WMIC.exe Token: 35 924 WMIC.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1424 wrote to memory of 1204 1424 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe 27 PID 1424 wrote to memory of 1204 1424 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe 27 PID 1424 wrote to memory of 1204 1424 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe 27 PID 1424 wrote to memory of 1204 1424 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe 27 PID 1204 wrote to memory of 904 1204 cmd.exe 29 PID 1204 wrote to memory of 904 1204 cmd.exe 29 PID 1204 wrote to memory of 904 1204 cmd.exe 29 PID 1204 wrote to memory of 1460 1204 cmd.exe 32 PID 1204 wrote to memory of 1460 1204 cmd.exe 32 PID 1204 wrote to memory of 1460 1204 cmd.exe 32 PID 1204 wrote to memory of 924 1204 cmd.exe 36 PID 1204 wrote to memory of 924 1204 cmd.exe 36 PID 1204 wrote to memory of 924 1204 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe"C:\Users\Admin\AppData\Local\Temp\13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe"C:\Users\Admin\AppData\Local\Temp\13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe" n14242⤵PID:2008
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:904
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1460
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:924
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:784
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1136
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1696
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1108
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:768