Analysis
-
max time kernel
75s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-10-2022 16:11
Static task
static1
Behavioral task
behavioral1
Sample
435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe
Resource
win10v2004-20220901-en
General
-
Target
435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe
-
Size
225KB
-
MD5
e86b3398333384aaffd32c1444dde9d0
-
SHA1
4ed7e2362fb149e5d5c3a261400f1e6e6f04628d
-
SHA256
435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33
-
SHA512
eb9c20f2610d2ff008dd3d7a0596ef5ada56b2c121bf635eb8247a049b829f947b0a514c0052399e47662a526325b3b9e8c916c009f42d5279e90040a28932ec
-
SSDEEP
3072:dieIAGyEGGmgvevzpxBt0uZ8z43gBVN2qvI6vQF5ovTsno:d5qedM43wVN2g3gno
Malware Config
Extracted
C:\readme.txt
meow
Signatures
-
Meow
A ransomware that wipes unsecured databases first seen in Mid 2020.
-
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\ConfirmReset.tiff 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File renamed C:\Users\Admin\Pictures\ConfirmReset.tiff => C:\Users\Admin\Pictures\ConfirmReset.tiff.MEOW 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File renamed C:\Users\Admin\Pictures\GetOpen.raw => C:\Users\Admin\Pictures\GetOpen.raw.MEOW 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Pictures\RequestWatch.tiff 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File renamed C:\Users\Admin\Pictures\SubmitConfirm.raw => C:\Users\Admin\Pictures\SubmitConfirm.raw.MEOW 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File renamed C:\Users\Admin\Pictures\SubmitImport.crw => C:\Users\Admin\Pictures\SubmitImport.crw.MEOW 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File renamed C:\Users\Admin\Pictures\AddJoin.crw => C:\Users\Admin\Pictures\AddJoin.crw.MEOW 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File renamed C:\Users\Admin\Pictures\ConvertToMount.tif => C:\Users\Admin\Pictures\ConvertToMount.tif.MEOW 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File renamed C:\Users\Admin\Pictures\RequestWatch.tiff => C:\Users\Admin\Pictures\RequestWatch.tiff.MEOW 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 46 IoCs
Processes:
435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exedescription ioc process File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\UFPRKV05\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Public\Videos\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\UN1Y26T5\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Music\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Public\Music\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\C2EPRMM6\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Public\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Public\Documents\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\WZHASH05\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Links\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe -
Drops file in Program Files directory 64 IoCs
Processes:
435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exedescription ioc process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Soft Blue.htm 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.JP.XML 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\jhall-2.0_05.jar 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files\Microsoft Games\Hearts\en-US\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Macquarie 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files\Microsoft Games\Purble Place\ja-JP\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BS4BOXES.POC 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL048.XML 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18231_.WMF 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105336.WMF 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files\Mozilla Firefox\browser\features\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files\Reference Assemblies\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCHDRESN.CFG 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099148.JPG 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00034_.WMF 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\DOCS.ICO 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Minsk 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01164_.WMF 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_ja_4.4.0.v20140623020002.jar 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Majuro 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN02559_.WMF 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Adelaide 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files (x86)\Common Files\System\it-IT\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\WATER.INF 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_right_over.gif 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\MANIFEST.MF 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\ECLIPSE.INF 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Orange Circles.htm 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SUMER_01.MID 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\management.properties 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Melbourne 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107314.WMF 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files\Google\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN027.XML 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR9B.GIF 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\7-Zip\License.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01734_.GIF 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewAttachmentIconsMask.bmp 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185828.WMF 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02276_.WMF 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPAPERS.INI 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\drive.crx 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.ja_5.5.0.165303.jar 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02261_.WMF 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME44.CSS 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_zh_CN.jar 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files (x86)\Internet Explorer\es-ES\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exepid process 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1304 vssvc.exe Token: SeRestorePrivilege 1304 vssvc.exe Token: SeAuditPrivilege 1304 vssvc.exe Token: SeIncreaseQuotaPrivilege 1440 WMIC.exe Token: SeSecurityPrivilege 1440 WMIC.exe Token: SeTakeOwnershipPrivilege 1440 WMIC.exe Token: SeLoadDriverPrivilege 1440 WMIC.exe Token: SeSystemProfilePrivilege 1440 WMIC.exe Token: SeSystemtimePrivilege 1440 WMIC.exe Token: SeProfSingleProcessPrivilege 1440 WMIC.exe Token: SeIncBasePriorityPrivilege 1440 WMIC.exe Token: SeCreatePagefilePrivilege 1440 WMIC.exe Token: SeBackupPrivilege 1440 WMIC.exe Token: SeRestorePrivilege 1440 WMIC.exe Token: SeShutdownPrivilege 1440 WMIC.exe Token: SeDebugPrivilege 1440 WMIC.exe Token: SeSystemEnvironmentPrivilege 1440 WMIC.exe Token: SeRemoteShutdownPrivilege 1440 WMIC.exe Token: SeUndockPrivilege 1440 WMIC.exe Token: SeManageVolumePrivilege 1440 WMIC.exe Token: 33 1440 WMIC.exe Token: 34 1440 WMIC.exe Token: 35 1440 WMIC.exe Token: SeIncreaseQuotaPrivilege 1440 WMIC.exe Token: SeSecurityPrivilege 1440 WMIC.exe Token: SeTakeOwnershipPrivilege 1440 WMIC.exe Token: SeLoadDriverPrivilege 1440 WMIC.exe Token: SeSystemProfilePrivilege 1440 WMIC.exe Token: SeSystemtimePrivilege 1440 WMIC.exe Token: SeProfSingleProcessPrivilege 1440 WMIC.exe Token: SeIncBasePriorityPrivilege 1440 WMIC.exe Token: SeCreatePagefilePrivilege 1440 WMIC.exe Token: SeBackupPrivilege 1440 WMIC.exe Token: SeRestorePrivilege 1440 WMIC.exe Token: SeShutdownPrivilege 1440 WMIC.exe Token: SeDebugPrivilege 1440 WMIC.exe Token: SeSystemEnvironmentPrivilege 1440 WMIC.exe Token: SeRemoteShutdownPrivilege 1440 WMIC.exe Token: SeUndockPrivilege 1440 WMIC.exe Token: SeManageVolumePrivilege 1440 WMIC.exe Token: 33 1440 WMIC.exe Token: 34 1440 WMIC.exe Token: 35 1440 WMIC.exe Token: SeIncreaseQuotaPrivilege 1688 WMIC.exe Token: SeSecurityPrivilege 1688 WMIC.exe Token: SeTakeOwnershipPrivilege 1688 WMIC.exe Token: SeLoadDriverPrivilege 1688 WMIC.exe Token: SeSystemProfilePrivilege 1688 WMIC.exe Token: SeSystemtimePrivilege 1688 WMIC.exe Token: SeProfSingleProcessPrivilege 1688 WMIC.exe Token: SeIncBasePriorityPrivilege 1688 WMIC.exe Token: SeCreatePagefilePrivilege 1688 WMIC.exe Token: SeBackupPrivilege 1688 WMIC.exe Token: SeRestorePrivilege 1688 WMIC.exe Token: SeShutdownPrivilege 1688 WMIC.exe Token: SeDebugPrivilege 1688 WMIC.exe Token: SeSystemEnvironmentPrivilege 1688 WMIC.exe Token: SeRemoteShutdownPrivilege 1688 WMIC.exe Token: SeUndockPrivilege 1688 WMIC.exe Token: SeManageVolumePrivilege 1688 WMIC.exe Token: 33 1688 WMIC.exe Token: 34 1688 WMIC.exe Token: 35 1688 WMIC.exe Token: SeIncreaseQuotaPrivilege 1688 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1812 wrote to memory of 1068 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 1068 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 1068 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 1068 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1068 wrote to memory of 1440 1068 cmd.exe WMIC.exe PID 1068 wrote to memory of 1440 1068 cmd.exe WMIC.exe PID 1068 wrote to memory of 1440 1068 cmd.exe WMIC.exe PID 1812 wrote to memory of 828 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 828 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 828 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 828 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 828 wrote to memory of 1688 828 cmd.exe WMIC.exe PID 828 wrote to memory of 1688 828 cmd.exe WMIC.exe PID 828 wrote to memory of 1688 828 cmd.exe WMIC.exe PID 1812 wrote to memory of 340 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 340 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 340 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 340 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 340 wrote to memory of 712 340 cmd.exe WMIC.exe PID 340 wrote to memory of 712 340 cmd.exe WMIC.exe PID 340 wrote to memory of 712 340 cmd.exe WMIC.exe PID 1812 wrote to memory of 568 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 568 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 568 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 568 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 568 wrote to memory of 1596 568 cmd.exe WMIC.exe PID 568 wrote to memory of 1596 568 cmd.exe WMIC.exe PID 568 wrote to memory of 1596 568 cmd.exe WMIC.exe PID 1812 wrote to memory of 836 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 836 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 836 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 836 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 836 wrote to memory of 880 836 cmd.exe WMIC.exe PID 836 wrote to memory of 880 836 cmd.exe WMIC.exe PID 836 wrote to memory of 880 836 cmd.exe WMIC.exe PID 1812 wrote to memory of 1928 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 1928 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 1928 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 1928 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1928 wrote to memory of 1184 1928 cmd.exe WMIC.exe PID 1928 wrote to memory of 1184 1928 cmd.exe WMIC.exe PID 1928 wrote to memory of 1184 1928 cmd.exe WMIC.exe PID 1812 wrote to memory of 1016 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 1016 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 1016 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 1016 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1016 wrote to memory of 876 1016 cmd.exe WMIC.exe PID 1016 wrote to memory of 876 1016 cmd.exe WMIC.exe PID 1016 wrote to memory of 876 1016 cmd.exe WMIC.exe PID 1812 wrote to memory of 336 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 336 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 336 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 336 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 336 wrote to memory of 1068 336 cmd.exe WMIC.exe PID 336 wrote to memory of 1068 336 cmd.exe WMIC.exe PID 336 wrote to memory of 1068 336 cmd.exe WMIC.exe PID 1812 wrote to memory of 1592 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 1592 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 1592 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1812 wrote to memory of 1592 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1592 wrote to memory of 1360 1592 cmd.exe WMIC.exe PID 1592 wrote to memory of 1360 1592 cmd.exe WMIC.exe PID 1592 wrote to memory of 1360 1592 cmd.exe WMIC.exe PID 1812 wrote to memory of 1032 1812 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe"C:\Users\Admin\AppData\Local\Temp\435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{38F4F273-FD4E-40EE-A757-A0C4931FC7F9}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{38F4F273-FD4E-40EE-A757-A0C4931FC7F9}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1440
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{73136CA1-40E5-44A4-ACB1-1A381327A180}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{73136CA1-40E5-44A4-ACB1-1A381327A180}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1688
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5EA5ECFC-D39D-4BAD-AC73-64FFF00D3BA9}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5EA5ECFC-D39D-4BAD-AC73-64FFF00D3BA9}'" delete3⤵PID:712
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{46F85264-C264-422A-88E8-1CD66A062AA8}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{46F85264-C264-422A-88E8-1CD66A062AA8}'" delete3⤵PID:1596
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E4B344C6-B590-45A1-A54B-DC4FC8A495EF}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E4B344C6-B590-45A1-A54B-DC4FC8A495EF}'" delete3⤵PID:880
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0B869F6C-1033-47AA-B556-805661309D98}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0B869F6C-1033-47AA-B556-805661309D98}'" delete3⤵PID:1184
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7F8063EB-8604-4FF4-AE6D-251209D63015}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7F8063EB-8604-4FF4-AE6D-251209D63015}'" delete3⤵PID:876
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7FA0A99A-B76E-49F4-B158-A987EFAFE27D}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7FA0A99A-B76E-49F4-B158-A987EFAFE27D}'" delete3⤵PID:1068
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{88E37423-C82B-4EF4-B3FF-A2B73329B9F7}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{88E37423-C82B-4EF4-B3FF-A2B73329B9F7}'" delete3⤵PID:1360
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{008F9625-DDC3-4066-B788-49FC3657C4F6}'" delete2⤵PID:1032
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{008F9625-DDC3-4066-B788-49FC3657C4F6}'" delete3⤵PID:1120
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{97F00D85-BC71-4949-8703-1062C6D34D5C}'" delete2⤵PID:1680
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{97F00D85-BC71-4949-8703-1062C6D34D5C}'" delete3⤵PID:1988
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{53305AF2-5F9F-4D3C-8609-14DCE07400B8}'" delete2⤵PID:1936
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{53305AF2-5F9F-4D3C-8609-14DCE07400B8}'" delete3⤵PID:1804
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7DF6716E-9291-4F53-8EDA-9EBD48C35B06}'" delete2⤵PID:936
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7DF6716E-9291-4F53-8EDA-9EBD48C35B06}'" delete3⤵PID:1664
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{05D90694-70D7-4B6F-952F-C0123300DC18}'" delete2⤵PID:1588
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{05D90694-70D7-4B6F-952F-C0123300DC18}'" delete3⤵PID:1464
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1228787B-7BC4-4AA4-B53B-B657444EA523}'" delete2⤵PID:1692
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1228787B-7BC4-4AA4-B53B-B657444EA523}'" delete3⤵PID:1860
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1FF18028-010B-4686-87FE-19F7C952B49A}'" delete2⤵PID:1584
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1FF18028-010B-4686-87FE-19F7C952B49A}'" delete3⤵PID:1612
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0D947DC8-B3AF-433F-9761-1C6E86ECC81D}'" delete2⤵PID:916
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0D947DC8-B3AF-433F-9761-1C6E86ECC81D}'" delete3⤵PID:1780
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9856A742-F496-4BA5-9F17-06D883495F22}'" delete2⤵PID:1968
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9856A742-F496-4BA5-9F17-06D883495F22}'" delete3⤵PID:568
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1304