Analysis
-
max time kernel
127s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04-01-2023 03:36
Static task
static1
Behavioral task
behavioral1
Sample
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
Resource
win10v2004-20220901-en
General
-
Target
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
-
Size
224KB
-
MD5
033acf3b0f699a39becdc71d3e2dddcc
-
SHA1
5949c404aee552fc8ce29e3bf77bd08e54d37c59
-
SHA256
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853
-
SHA512
604ba9e02ec18b8ad1005ec3d86970261925a1d2c198a975387beb62a9711012733b92e7641a5687af835cf1ddb5b6c6d732b33a12387a3a293ca08929f7fb50
-
SSDEEP
3072:xtsD+K6k7UXP6ih6XULC9GHJkmm8GxTyPGryXdEekUuIiMi:4D+33P6Y6XGpY8G5yore3u5Mi
Malware Config
Extracted
C:\readme.txt
meow
Signatures
-
Meow
A ransomware that wipes unsecured databases first seen in Mid 2020.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exedescription ioc process File renamed C:\Users\Admin\Pictures\SelectResize.tiff => C:\Users\Admin\Pictures\SelectResize.tiff.MEOW 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Pictures\ShowClose.tiff 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File renamed C:\Users\Admin\Pictures\ShowClose.tiff => C:\Users\Admin\Pictures\ShowClose.tiff.MEOW 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File renamed C:\Users\Admin\Pictures\UpdateSave.png => C:\Users\Admin\Pictures\UpdateSave.png.MEOW 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File renamed C:\Users\Admin\Pictures\DisconnectPing.crw => C:\Users\Admin\Pictures\DisconnectPing.crw.MEOW 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File renamed C:\Users\Admin\Pictures\SearchSelect.crw => C:\Users\Admin\Pictures\SearchSelect.crw.MEOW 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Pictures\SelectResize.tiff 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe -
Drops startup file 1 IoCs
Processes:
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 31 IoCs
Processes:
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Music\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Videos\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Links\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Music\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Documents\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe -
Drops file in Program Files directory 64 IoCs
Processes:
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exedescription ioc process File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\license.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\[email protected] 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\VideoLAN\VLC\locale\my\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_ja_4.4.0.v20140623020002.jar 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\Toast.svg 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fr-fr\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL012.XML 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_fr.properties 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-attach.xml 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\da_get.svg 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\BOMB.WAV 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\ext\jfxrt.jar 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-uisupport.xml 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nl-nl\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fi-fi\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-ma\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pt-br\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\cs-cz\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul-oob.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyoptionaltools.jar 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\email_all.gif 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\virgo_mycomputer_folder_icon.svg 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-focus.svg 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ind_prog.gif 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\de-de\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview.png 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hu-hu\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ppd.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\sa-jdi.jar 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filterselected-default_32.svg 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\VideoLAN\VLC\plugins\d3d11\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\main.css 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\cs.pak 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exepid process 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 2436 vssvc.exe Token: SeRestorePrivilege 2436 vssvc.exe Token: SeAuditPrivilege 2436 vssvc.exe Token: SeIncreaseQuotaPrivilege 632 WMIC.exe Token: SeSecurityPrivilege 632 WMIC.exe Token: SeTakeOwnershipPrivilege 632 WMIC.exe Token: SeLoadDriverPrivilege 632 WMIC.exe Token: SeSystemProfilePrivilege 632 WMIC.exe Token: SeSystemtimePrivilege 632 WMIC.exe Token: SeProfSingleProcessPrivilege 632 WMIC.exe Token: SeIncBasePriorityPrivilege 632 WMIC.exe Token: SeCreatePagefilePrivilege 632 WMIC.exe Token: SeBackupPrivilege 632 WMIC.exe Token: SeRestorePrivilege 632 WMIC.exe Token: SeShutdownPrivilege 632 WMIC.exe Token: SeDebugPrivilege 632 WMIC.exe Token: SeSystemEnvironmentPrivilege 632 WMIC.exe Token: SeRemoteShutdownPrivilege 632 WMIC.exe Token: SeUndockPrivilege 632 WMIC.exe Token: SeManageVolumePrivilege 632 WMIC.exe Token: 33 632 WMIC.exe Token: 34 632 WMIC.exe Token: 35 632 WMIC.exe Token: 36 632 WMIC.exe Token: SeIncreaseQuotaPrivilege 632 WMIC.exe Token: SeSecurityPrivilege 632 WMIC.exe Token: SeTakeOwnershipPrivilege 632 WMIC.exe Token: SeLoadDriverPrivilege 632 WMIC.exe Token: SeSystemProfilePrivilege 632 WMIC.exe Token: SeSystemtimePrivilege 632 WMIC.exe Token: SeProfSingleProcessPrivilege 632 WMIC.exe Token: SeIncBasePriorityPrivilege 632 WMIC.exe Token: SeCreatePagefilePrivilege 632 WMIC.exe Token: SeBackupPrivilege 632 WMIC.exe Token: SeRestorePrivilege 632 WMIC.exe Token: SeShutdownPrivilege 632 WMIC.exe Token: SeDebugPrivilege 632 WMIC.exe Token: SeSystemEnvironmentPrivilege 632 WMIC.exe Token: SeRemoteShutdownPrivilege 632 WMIC.exe Token: SeUndockPrivilege 632 WMIC.exe Token: SeManageVolumePrivilege 632 WMIC.exe Token: 33 632 WMIC.exe Token: 34 632 WMIC.exe Token: 35 632 WMIC.exe Token: 36 632 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.execmd.exedescription pid process target process PID 1980 wrote to memory of 5040 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe cmd.exe PID 1980 wrote to memory of 5040 1980 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe cmd.exe PID 5040 wrote to memory of 632 5040 cmd.exe WMIC.exe PID 5040 wrote to memory of 632 5040 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe"C:\Users\Admin\AppData\Local\Temp\222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{197EF8A3-6C0C-4392-9954-89785C32C0FB}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{197EF8A3-6C0C-4392-9954-89785C32C0FB}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:632
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2436