meow | 3354eb021b78cf44f76a51fb31d640e6afd1c00812a14bc7e78b80998398ad8f

Analysis

max time kernel
75s
max time network
51s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-01-2023 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
Size

224KB
MD5

033acf3b0f699a39becdc71d3e2dddcc
SHA1

5949c404aee552fc8ce29e3bf77bd08e54d37c59
SHA256

222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853
SHA512

604ba9e02ec18b8ad1005ec3d86970261925a1d2c198a975387beb62a9711012733b92e7641a5687af835cf1ddb5b6c6d732b33a12387a3a293ca08929f7fb50
SSDEEP

3072:xtsD+K6k7UXP6ih6XULC9GHJkmm8GxTyPGryXdEekUuIiMi:4D+33P6Y6XGpY8G5yore3u5Mi

Score

10^/10

meow ransomware spyware stealer

Malware Config

Extracted

Path

C:\readme.txt

Family

meow

Ransom Note

MEOW! MEOW! MEOW! Your files has been encrypted! Need decrypt? Write to e-mail: [email protected] [email protected] [email protected] [email protected] or Telegram: @meowcorp2022 @meowcorp123 Uniq ID: 4d2942e6-49a6-410b-9a09-a02423f53e1c��

Emails

[email protected]

Signatures

Meow
A ransomware that wipes unsecured databases first seen in Mid 2020.
ransomware meow

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\FindHide.raw => C:\Users\Admin\Pictures\FindHide.raw.MEOW	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File renamed	C:\Users\Admin\Pictures\ResolveCompress.tif => C:\Users\Admin\Pictures\ResolveCompress.tif.MEOW	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File renamed	C:\Users\Admin\Pictures\CompareEnable.png => C:\Users\Admin\Pictures\CompareEnable.png.MEOW	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File renamed	C:\Users\Admin\Pictures\DismountExpand.raw => C:\Users\Admin\Pictures\DismountExpand.raw.MEOW	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 46 IoCs

Processes:

222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\WZHASH05\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\C2EPRMM6\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Public\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\UFPRKV05\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\UN1Y26T5\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe

Drops file in Program Files directory 64 IoCs

Processes:

222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\DiscussionToolIconImagesMask.bmp	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Seoul	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tarawa	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.concurrent_1.1.0.v20130327-1442.jar	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387604.JPG	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14793_.GIF	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME27.CSS	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106146.WMF	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0217872.WMF	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\readme.txt	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_hu.jar	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0304861.WMF	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SIGNL.ICO	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.pb_2.3.5.v201404071733.jar	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\vlc.mo	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME14.CSS	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_ja.jar	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.properties	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplate.html	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099155.JPG	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY01572_.WMF	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\soundcloud.luac	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01162_.WMF	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382965.JPG	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\APPLAUSE.WAV	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nn\readme.txt	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187839.WMF	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198234.WMF	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00168_.WMF	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_ja.jar	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Composite.thmx	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384895.JPG	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LTHD98.POC	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WORDREP.DPV	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Belgrade	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382968.JPG	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14869_.GIF	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Nicosia	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\CHECKBOX.JPG	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02810J.JPG	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14514_.GIF	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.properties	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_decreaseindent.gif	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\readme.txt	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\COMPASS.ELM	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\INDUST.INF	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\background.gif	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\readme.txt	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02752U.BMP	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02055_.GIF	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe

pid	process
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeBackupPrivilege	1492	vssvc.exe
Token: SeRestorePrivilege	1492	vssvc.exe
Token: SeAuditPrivilege	1492	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1684	WMIC.exe
Token: SeSecurityPrivilege	1684	WMIC.exe
Token: SeTakeOwnershipPrivilege	1684	WMIC.exe
Token: SeLoadDriverPrivilege	1684	WMIC.exe
Token: SeSystemProfilePrivilege	1684	WMIC.exe
Token: SeSystemtimePrivilege	1684	WMIC.exe
Token: SeProfSingleProcessPrivilege	1684	WMIC.exe
Token: SeIncBasePriorityPrivilege	1684	WMIC.exe
Token: SeCreatePagefilePrivilege	1684	WMIC.exe
Token: SeBackupPrivilege	1684	WMIC.exe
Token: SeRestorePrivilege	1684	WMIC.exe
Token: SeShutdownPrivilege	1684	WMIC.exe
Token: SeDebugPrivilege	1684	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1684	WMIC.exe
Token: SeRemoteShutdownPrivilege	1684	WMIC.exe
Token: SeUndockPrivilege	1684	WMIC.exe
Token: SeManageVolumePrivilege	1684	WMIC.exe
Token: 33	1684	WMIC.exe
Token: 34	1684	WMIC.exe
Token: 35	1684	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1684	WMIC.exe
Token: SeSecurityPrivilege	1684	WMIC.exe
Token: SeTakeOwnershipPrivilege	1684	WMIC.exe
Token: SeLoadDriverPrivilege	1684	WMIC.exe
Token: SeSystemProfilePrivilege	1684	WMIC.exe
Token: SeSystemtimePrivilege	1684	WMIC.exe
Token: SeProfSingleProcessPrivilege	1684	WMIC.exe
Token: SeIncBasePriorityPrivilege	1684	WMIC.exe
Token: SeCreatePagefilePrivilege	1684	WMIC.exe
Token: SeBackupPrivilege	1684	WMIC.exe
Token: SeRestorePrivilege	1684	WMIC.exe
Token: SeShutdownPrivilege	1684	WMIC.exe
Token: SeDebugPrivilege	1684	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1684	WMIC.exe
Token: SeRemoteShutdownPrivilege	1684	WMIC.exe
Token: SeUndockPrivilege	1684	WMIC.exe
Token: SeManageVolumePrivilege	1684	WMIC.exe
Token: 33	1684	WMIC.exe
Token: 34	1684	WMIC.exe
Token: 35	1684	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1548	WMIC.exe
Token: SeSecurityPrivilege	1548	WMIC.exe
Token: SeTakeOwnershipPrivilege	1548	WMIC.exe
Token: SeLoadDriverPrivilege	1548	WMIC.exe
Token: SeSystemProfilePrivilege	1548	WMIC.exe
Token: SeSystemtimePrivilege	1548	WMIC.exe
Token: SeProfSingleProcessPrivilege	1548	WMIC.exe
Token: SeIncBasePriorityPrivilege	1548	WMIC.exe
Token: SeCreatePagefilePrivilege	1548	WMIC.exe
Token: SeBackupPrivilege	1548	WMIC.exe
Token: SeRestorePrivilege	1548	WMIC.exe
Token: SeShutdownPrivilege	1548	WMIC.exe
Token: SeDebugPrivilege	1548	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1548	WMIC.exe
Token: SeRemoteShutdownPrivilege	1548	WMIC.exe
Token: SeUndockPrivilege	1548	WMIC.exe
Token: SeManageVolumePrivilege	1548	WMIC.exe
Token: 33	1548	WMIC.exe
Token: 34	1548	WMIC.exe
Token: 35	1548	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1548	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1404 wrote to memory of 1580	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 1580	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 1580	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 1580	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1580 wrote to memory of 1684	1580	cmd.exe	WMIC.exe
PID 1580 wrote to memory of 1684	1580	cmd.exe	WMIC.exe
PID 1580 wrote to memory of 1684	1580	cmd.exe	WMIC.exe
PID 1404 wrote to memory of 776	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 776	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 776	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 776	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 776 wrote to memory of 1548	776	cmd.exe	WMIC.exe
PID 776 wrote to memory of 1548	776	cmd.exe	WMIC.exe
PID 776 wrote to memory of 1548	776	cmd.exe	WMIC.exe
PID 1404 wrote to memory of 1380	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 1380	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 1380	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 1380	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1380 wrote to memory of 1544	1380	cmd.exe	WMIC.exe
PID 1380 wrote to memory of 1544	1380	cmd.exe	WMIC.exe
PID 1380 wrote to memory of 1544	1380	cmd.exe	WMIC.exe
PID 1404 wrote to memory of 368	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 368	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 368	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 368	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 368 wrote to memory of 2016	368	cmd.exe	WMIC.exe
PID 368 wrote to memory of 2016	368	cmd.exe	WMIC.exe
PID 368 wrote to memory of 2016	368	cmd.exe	WMIC.exe
PID 1404 wrote to memory of 332	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 332	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 332	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 332	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 332 wrote to memory of 1044	332	cmd.exe	WMIC.exe
PID 332 wrote to memory of 1044	332	cmd.exe	WMIC.exe
PID 332 wrote to memory of 1044	332	cmd.exe	WMIC.exe
PID 1404 wrote to memory of 1144	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 1144	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 1144	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 1144	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1144 wrote to memory of 1708	1144	cmd.exe	WMIC.exe
PID 1144 wrote to memory of 1708	1144	cmd.exe	WMIC.exe
PID 1144 wrote to memory of 1708	1144	cmd.exe	WMIC.exe
PID 1404 wrote to memory of 932	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 932	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 932	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 932	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 932 wrote to memory of 1392	932	cmd.exe	WMIC.exe
PID 932 wrote to memory of 1392	932	cmd.exe	WMIC.exe
PID 932 wrote to memory of 1392	932	cmd.exe	WMIC.exe
PID 1404 wrote to memory of 976	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 976	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 976	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 976	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 976 wrote to memory of 1580	976	cmd.exe	WMIC.exe
PID 976 wrote to memory of 1580	976	cmd.exe	WMIC.exe
PID 976 wrote to memory of 1580	976	cmd.exe	WMIC.exe
PID 1404 wrote to memory of 1692	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 1692	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 1692	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1404 wrote to memory of 1692	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe
PID 1692 wrote to memory of 756	1692	cmd.exe	WMIC.exe
PID 1692 wrote to memory of 756	1692	cmd.exe	WMIC.exe
PID 1692 wrote to memory of 756	1692	cmd.exe	WMIC.exe
PID 1404 wrote to memory of 1116	1404	222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
"C:\Users\Admin\AppData\Local\Temp\222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{38F4F273-FD4E-40EE-A757-A0C4931FC7F9}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{38F4F273-FD4E-40EE-A757-A0C4931FC7F9}'" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1684
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{73136CA1-40E5-44A4-ACB1-1A381327A180}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{73136CA1-40E5-44A4-ACB1-1A381327A180}'" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1548
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5EA5ECFC-D39D-4BAD-AC73-64FFF00D3BA9}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5EA5ECFC-D39D-4BAD-AC73-64FFF00D3BA9}'" delete
    3⤵
    PID:1544
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{46F85264-C264-422A-88E8-1CD66A062AA8}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{46F85264-C264-422A-88E8-1CD66A062AA8}'" delete
    3⤵
    PID:2016
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E4B344C6-B590-45A1-A54B-DC4FC8A495EF}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:332
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E4B344C6-B590-45A1-A54B-DC4FC8A495EF}'" delete
    3⤵
    PID:1044
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0B869F6C-1033-47AA-B556-805661309D98}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0B869F6C-1033-47AA-B556-805661309D98}'" delete
    3⤵
    PID:1708
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7F8063EB-8604-4FF4-AE6D-251209D63015}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7F8063EB-8604-4FF4-AE6D-251209D63015}'" delete
    3⤵
    PID:1392
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7FA0A99A-B76E-49F4-B158-A987EFAFE27D}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7FA0A99A-B76E-49F4-B158-A987EFAFE27D}'" delete
    3⤵
    PID:1580
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{88E37423-C82B-4EF4-B3FF-A2B73329B9F7}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{88E37423-C82B-4EF4-B3FF-A2B73329B9F7}'" delete
    3⤵
    PID:756
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{008F9625-DDC3-4066-B788-49FC3657C4F6}'" delete
  2⤵
  PID:1116
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{008F9625-DDC3-4066-B788-49FC3657C4F6}'" delete
    3⤵
    PID:1928
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{97F00D85-BC71-4949-8703-1062C6D34D5C}'" delete
  2⤵
  PID:1216
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{97F00D85-BC71-4949-8703-1062C6D34D5C}'" delete
    3⤵
    PID:1848
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{53305AF2-5F9F-4D3C-8609-14DCE07400B8}'" delete
  2⤵
  PID:1676
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{53305AF2-5F9F-4D3C-8609-14DCE07400B8}'" delete
    3⤵
    PID:364
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7DF6716E-9291-4F53-8EDA-9EBD48C35B06}'" delete
  2⤵
  PID:1704
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7DF6716E-9291-4F53-8EDA-9EBD48C35B06}'" delete
    3⤵
    PID:1020
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{05D90694-70D7-4B6F-952F-C0123300DC18}'" delete
  2⤵
  PID:1956
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{05D90694-70D7-4B6F-952F-C0123300DC18}'" delete
    3⤵
    PID:1172
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1228787B-7BC4-4AA4-B53B-B657444EA523}'" delete
  2⤵
  PID:840
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1228787B-7BC4-4AA4-B53B-B657444EA523}'" delete
    3⤵
    PID:1596
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1FF18028-010B-4686-87FE-19F7C952B49A}'" delete
  2⤵
  PID:976
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1FF18028-010B-4686-87FE-19F7C952B49A}'" delete
    3⤵
    PID:1048
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0D947DC8-B3AF-433F-9761-1C6E86ECC81D}'" delete
  2⤵
  PID:388
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0D947DC8-B3AF-433F-9761-1C6E86ECC81D}'" delete
    3⤵
    PID:1284
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9856A742-F496-4BA5-9F17-06D883495F22}'" delete
  2⤵
  PID:1116
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9856A742-F496-4BA5-9F17-06D883495F22}'" delete
    3⤵
    PID:368

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/332-63-0x0000000000000000-mapping.dmp

Download
memory/364-78-0x0000000000000000-mapping.dmp

Download
memory/368-61-0x0000000000000000-mapping.dmp

Download
memory/368-90-0x0000000000000000-mapping.dmp

Download
memory/388-87-0x0000000000000000-mapping.dmp

Download
memory/756-72-0x0000000000000000-mapping.dmp

Download
memory/776-57-0x0000000000000000-mapping.dmp

Download
memory/840-83-0x0000000000000000-mapping.dmp

Download
memory/932-67-0x0000000000000000-mapping.dmp

Download
memory/976-69-0x0000000000000000-mapping.dmp

Download
memory/976-85-0x0000000000000000-mapping.dmp

Download
memory/1020-80-0x0000000000000000-mapping.dmp

Download
memory/1044-64-0x0000000000000000-mapping.dmp

Download
memory/1048-86-0x0000000000000000-mapping.dmp

Download
memory/1116-89-0x0000000000000000-mapping.dmp

Download
memory/1116-73-0x0000000000000000-mapping.dmp

Download
memory/1144-65-0x0000000000000000-mapping.dmp

Download
memory/1172-82-0x0000000000000000-mapping.dmp

Download
memory/1216-75-0x0000000000000000-mapping.dmp

Download
memory/1284-88-0x0000000000000000-mapping.dmp

Download
memory/1380-59-0x0000000000000000-mapping.dmp

Download
memory/1392-68-0x0000000000000000-mapping.dmp

Download
memory/1404-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1544-60-0x0000000000000000-mapping.dmp

Download
memory/1548-58-0x0000000000000000-mapping.dmp

Download
memory/1580-70-0x0000000000000000-mapping.dmp

Download
memory/1580-55-0x0000000000000000-mapping.dmp

Download
memory/1596-84-0x0000000000000000-mapping.dmp

Download
memory/1676-77-0x0000000000000000-mapping.dmp

Download
memory/1684-56-0x0000000000000000-mapping.dmp

Download
memory/1692-71-0x0000000000000000-mapping.dmp

Download
memory/1704-79-0x0000000000000000-mapping.dmp

Download
memory/1708-66-0x0000000000000000-mapping.dmp

Download
memory/1848-76-0x0000000000000000-mapping.dmp

Download
memory/1928-74-0x0000000000000000-mapping.dmp

Download
memory/1956-81-0x0000000000000000-mapping.dmp

Download
memory/2016-62-0x0000000000000000-mapping.dmp

Download