Analysis
-
max time kernel
71s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27-10-2022 16:11
Static task
static1
Behavioral task
behavioral1
Sample
435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe
Resource
win10v2004-20220901-en
General
-
Target
435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe
-
Size
225KB
-
MD5
e86b3398333384aaffd32c1444dde9d0
-
SHA1
4ed7e2362fb149e5d5c3a261400f1e6e6f04628d
-
SHA256
435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33
-
SHA512
eb9c20f2610d2ff008dd3d7a0596ef5ada56b2c121bf635eb8247a049b829f947b0a514c0052399e47662a526325b3b9e8c916c009f42d5279e90040a28932ec
-
SSDEEP
3072:dieIAGyEGGmgvevzpxBt0uZ8z43gBVN2qvI6vQF5ovTsno:d5qedM43wVN2g3gno
Malware Config
Extracted
C:\readme.txt
meow
Signatures
-
Meow
A ransomware that wipes unsecured databases first seen in Mid 2020.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\SwitchSearch.tiff 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File renamed C:\Users\Admin\Pictures\SwitchSearch.tiff => C:\Users\Admin\Pictures\SwitchSearch.tiff.MEOW 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File renamed C:\Users\Admin\Pictures\UseAdd.crw => C:\Users\Admin\Pictures\UseAdd.crw.MEOW 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Pictures\MountMeasure.tiff 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File renamed C:\Users\Admin\Pictures\MountMeasure.tiff => C:\Users\Admin\Pictures\MountMeasure.tiff.MEOW 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File renamed C:\Users\Admin\Pictures\RequestProtect.crw => C:\Users\Admin\Pictures\RequestProtect.crw.MEOW 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe -
Drops startup file 1 IoCs
Processes:
435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 31 IoCs
Processes:
435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exedescription ioc process File opened for modification C:\Users\Public\Desktop\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Public\Documents\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Public\Videos\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Public\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Music\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Public\Music\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Links\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe -
Drops file in Program Files directory 64 IoCs
Processes:
435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\exportpdfupsell-app-selector.js 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\it-it\ui-strings.js 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\jce.jar 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\LogoDev.png 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-options.xml 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main-selector.css 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Common Files\System\ado\msado25.tlb 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sk-sk\ui-strings.js 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\tr.pak 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\cs_get.svg 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\QUAD.INF 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pt-br\ui-strings.js 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\ui-strings.js 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\uk-ua\ui-strings.js 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.commands_3.6.100.v20140528-1422.jar 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef.css 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files\VideoLAN\VLC\locale\br\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\mi.pak.DATA 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\it-it\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\eu-es\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ul-oob.xrm-ms 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\calendars.properties 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\eclipse.inf 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\cstm_brand_preview.png 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\COMPASS.INF 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\ui-strings.js 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\de-de\ui-strings.js 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\logging.properties 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-100.png 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\ui-strings.js 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\uk-ua\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\en-US\sqloledb.rll.mui 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\es-419.pak 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\qu.pak.DATA 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\BLUECALM.INF 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons_retina_thumb.png 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\css\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_it.properties 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\readme.txt 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-startup.xml 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\RECOVR32.CNV 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-oob.xrm-ms 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exepid process 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 2328 vssvc.exe Token: SeRestorePrivilege 2328 vssvc.exe Token: SeAuditPrivilege 2328 vssvc.exe Token: SeIncreaseQuotaPrivilege 3732 WMIC.exe Token: SeSecurityPrivilege 3732 WMIC.exe Token: SeTakeOwnershipPrivilege 3732 WMIC.exe Token: SeLoadDriverPrivilege 3732 WMIC.exe Token: SeSystemProfilePrivilege 3732 WMIC.exe Token: SeSystemtimePrivilege 3732 WMIC.exe Token: SeProfSingleProcessPrivilege 3732 WMIC.exe Token: SeIncBasePriorityPrivilege 3732 WMIC.exe Token: SeCreatePagefilePrivilege 3732 WMIC.exe Token: SeBackupPrivilege 3732 WMIC.exe Token: SeRestorePrivilege 3732 WMIC.exe Token: SeShutdownPrivilege 3732 WMIC.exe Token: SeDebugPrivilege 3732 WMIC.exe Token: SeSystemEnvironmentPrivilege 3732 WMIC.exe Token: SeRemoteShutdownPrivilege 3732 WMIC.exe Token: SeUndockPrivilege 3732 WMIC.exe Token: SeManageVolumePrivilege 3732 WMIC.exe Token: 33 3732 WMIC.exe Token: 34 3732 WMIC.exe Token: 35 3732 WMIC.exe Token: 36 3732 WMIC.exe Token: SeIncreaseQuotaPrivilege 3732 WMIC.exe Token: SeSecurityPrivilege 3732 WMIC.exe Token: SeTakeOwnershipPrivilege 3732 WMIC.exe Token: SeLoadDriverPrivilege 3732 WMIC.exe Token: SeSystemProfilePrivilege 3732 WMIC.exe Token: SeSystemtimePrivilege 3732 WMIC.exe Token: SeProfSingleProcessPrivilege 3732 WMIC.exe Token: SeIncBasePriorityPrivilege 3732 WMIC.exe Token: SeCreatePagefilePrivilege 3732 WMIC.exe Token: SeBackupPrivilege 3732 WMIC.exe Token: SeRestorePrivilege 3732 WMIC.exe Token: SeShutdownPrivilege 3732 WMIC.exe Token: SeDebugPrivilege 3732 WMIC.exe Token: SeSystemEnvironmentPrivilege 3732 WMIC.exe Token: SeRemoteShutdownPrivilege 3732 WMIC.exe Token: SeUndockPrivilege 3732 WMIC.exe Token: SeManageVolumePrivilege 3732 WMIC.exe Token: 33 3732 WMIC.exe Token: 34 3732 WMIC.exe Token: 35 3732 WMIC.exe Token: 36 3732 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.execmd.exedescription pid process target process PID 4932 wrote to memory of 1668 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 4932 wrote to memory of 1668 4932 435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe cmd.exe PID 1668 wrote to memory of 3732 1668 cmd.exe WMIC.exe PID 1668 wrote to memory of 3732 1668 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe"C:\Users\Admin\AppData\Local\Temp\435a917a2ad1adbe35e97247d7c2dc0d50be12b2d1a311d5b2a7b28dd315fc33.bin.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C8E5A4D4-6E8F-4ECA-830A-CA63F6A2AC4B}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C8E5A4D4-6E8F-4ECA-830A-CA63F6A2AC4B}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3732
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2328