13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3

General

Target

13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
Size

42KB
MD5

e946f874088bb866c3d02e0e2fa79daf
SHA1

cb476dbdd8242bfbf5ce54e9d1f2ba24b73ac693
SHA256

13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3
SHA512

158776939338a15897af7bc0cf62ad588ce96aa8db4308643a1bced8e460f3c4fcf92b16832b6981dc6f61908ede817108f5a1a29da3534a4bf85bc9ab7b088c
SSDEEP

768:gO1oR/LVS1RzK4wbs+D/SIJX+ZZ1SQQwZuIOPzDT6FhUxuSqA:gpS1FKnDtkuIme7AB

Score

9^/10

ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

1516 wbadmin.exe

pid	process
1516	wbadmin.exe

Drops file in Program Files directory 64 IoCs

Processes:

13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1220 vssadmin.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe

pid process

988 13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe

pid	process
1220	vssadmin.exe

pid	process
988	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

vssvc.exewbengine.exeWMIC.exe

description	pid	process
Token: SeBackupPrivilege	2044	vssvc.exe
Token: SeRestorePrivilege	2044	vssvc.exe
Token: SeAuditPrivilege	2044	vssvc.exe
Token: SeBackupPrivilege	1924	wbengine.exe
Token: SeRestorePrivilege	1924	wbengine.exe
Token: SeSecurityPrivilege	1924	wbengine.exe
Token: SeIncreaseQuotaPrivilege	1972	WMIC.exe
Token: SeSecurityPrivilege	1972	WMIC.exe
Token: SeTakeOwnershipPrivilege	1972	WMIC.exe
Token: SeLoadDriverPrivilege	1972	WMIC.exe
Token: SeSystemProfilePrivilege	1972	WMIC.exe
Token: SeSystemtimePrivilege	1972	WMIC.exe
Token: SeProfSingleProcessPrivilege	1972	WMIC.exe
Token: SeIncBasePriorityPrivilege	1972	WMIC.exe
Token: SeCreatePagefilePrivilege	1972	WMIC.exe
Token: SeBackupPrivilege	1972	WMIC.exe
Token: SeRestorePrivilege	1972	WMIC.exe
Token: SeShutdownPrivilege	1972	WMIC.exe
Token: SeDebugPrivilege	1972	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1972	WMIC.exe
Token: SeRemoteShutdownPrivilege	1972	WMIC.exe
Token: SeUndockPrivilege	1972	WMIC.exe
Token: SeManageVolumePrivilege	1972	WMIC.exe
Token: 33	1972	WMIC.exe
Token: 34	1972	WMIC.exe
Token: 35	1972	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1972	WMIC.exe
Token: SeSecurityPrivilege	1972	WMIC.exe
Token: SeTakeOwnershipPrivilege	1972	WMIC.exe
Token: SeLoadDriverPrivilege	1972	WMIC.exe
Token: SeSystemProfilePrivilege	1972	WMIC.exe
Token: SeSystemtimePrivilege	1972	WMIC.exe
Token: SeProfSingleProcessPrivilege	1972	WMIC.exe
Token: SeIncBasePriorityPrivilege	1972	WMIC.exe
Token: SeCreatePagefilePrivilege	1972	WMIC.exe
Token: SeBackupPrivilege	1972	WMIC.exe
Token: SeRestorePrivilege	1972	WMIC.exe
Token: SeShutdownPrivilege	1972	WMIC.exe
Token: SeDebugPrivilege	1972	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1972	WMIC.exe
Token: SeRemoteShutdownPrivilege	1972	WMIC.exe
Token: SeUndockPrivilege	1972	WMIC.exe
Token: SeManageVolumePrivilege	1972	WMIC.exe
Token: 33	1972	WMIC.exe
Token: 34	1972	WMIC.exe
Token: 35	1972	WMIC.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.execmd.exe

description	pid	process	target process
PID 988 wrote to memory of 1380	988	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe	cmd.exe
PID 988 wrote to memory of 1380	988	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe	cmd.exe
PID 988 wrote to memory of 1380	988	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe	cmd.exe
PID 988 wrote to memory of 1380	988	13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe	cmd.exe
PID 1380 wrote to memory of 1220	1380	cmd.exe	vssadmin.exe
PID 1380 wrote to memory of 1220	1380	cmd.exe	vssadmin.exe
PID 1380 wrote to memory of 1220	1380	cmd.exe	vssadmin.exe
PID 1380 wrote to memory of 1516	1380	cmd.exe	wbadmin.exe
PID 1380 wrote to memory of 1516	1380	cmd.exe	wbadmin.exe
PID 1380 wrote to memory of 1516	1380	cmd.exe	wbadmin.exe
PID 1380 wrote to memory of 1972	1380	cmd.exe	WMIC.exe
PID 1380 wrote to memory of 1972	1380	cmd.exe	WMIC.exe
PID 1380 wrote to memory of 1972	1380	cmd.exe	WMIC.exe

C:\Users\Admin\AppData\Local\Temp\13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
"C:\Users\Admin\AppData\Local\Temp\13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:988

C:\Users\Admin\AppData\Local\Temp\13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe
"C:\Users\Admin\AppData\Local\Temp\13c788ccaa70bca1746a8e35a2d9fda5a85b7a225703801baf927b02701886f3.exe" n988
2⤵
PID:888

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1380

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:1220

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
3⤵
- Deletes backup catalog
PID:1516

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1924

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1488

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1392

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:760

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

File Deletion

3

T1107

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

3

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/988-54-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download
memory/1220-57-0x0000000000000000-mapping.dmp

Download
memory/1380-56-0x0000000000000000-mapping.dmp

Download
memory/1516-58-0x0000000000000000-mapping.dmp

Download
memory/1516-59-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmp

Filesize
8KB

Download
memory/1972-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads