Overview

overview

10

Static

static

3

222e2b91f5...53.exe

windows7-x64

10

222e2b91f5...53.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    129s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    17-07-2023 14:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe

  • Size

    224KB

  • MD5

    033acf3b0f699a39becdc71d3e2dddcc

  • SHA1

    5949c404aee552fc8ce29e3bf77bd08e54d37c59

  • SHA256

    222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853

  • SHA512

    604ba9e02ec18b8ad1005ec3d86970261925a1d2c198a975387beb62a9711012733b92e7641a5687af835cf1ddb5b6c6d732b33a12387a3a293ca08929f7fb50

  • SSDEEP

    3072:xtsD+K6k7UXP6ih6XULC9GHJkmm8GxTyPGryXdEekUuIiMi:4D+33P6Y6XGpY8G5yore3u5Mi

Score
10/10
meowransomwarespywarestealer

Malware Config

Signatures

  • Meow

    A ransomware that wipes unsecured databases first seen in Mid 2020.

    ransomwaremeow
  • Renames multiple (7913) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 46 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
    "C:\Users\Admin\AppData\Local\Temp\222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2680
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EB7E21B4-CFD7-4A08-A835-0D63CECC2618}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2868
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EB7E21B4-CFD7-4A08-A835-0D63CECC2618}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2732
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4ECFC5B3-6B36-4208-995D-F6BE2697A63C}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4ECFC5B3-6B36-4208-995D-F6BE2697A63C}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2820
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7B8BD7DA-F373-4F9A-BC20-4BF917847F9D}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2736
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7B8BD7DA-F373-4F9A-BC20-4BF917847F9D}'" delete
        3⤵
          PID:2828
      • C:\Windows\system32\cmd.exe
        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{963BBCC2-2CC7-43AF-8E8D-E8A83F92EA5F}'" delete
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2756
        • C:\Windows\System32\wbem\WMIC.exe
          C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{963BBCC2-2CC7-43AF-8E8D-E8A83F92EA5F}'" delete
          3⤵
            PID:1972
        • C:\Windows\system32\cmd.exe
          cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{37F64F62-399B-4036-BC36-8AA66C55CB45}'" delete
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2684
          • C:\Windows\System32\wbem\WMIC.exe
            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{37F64F62-399B-4036-BC36-8AA66C55CB45}'" delete
            3⤵
              PID:2032
          • C:\Windows\system32\cmd.exe
            cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4D9D1FD6-D0C4-4B9D-92E9-E41BC8E76E67}'" delete
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1492
            • C:\Windows\System32\wbem\WMIC.exe
              C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4D9D1FD6-D0C4-4B9D-92E9-E41BC8E76E67}'" delete
              3⤵
                PID:1852
            • C:\Windows\system32\cmd.exe
              cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{26437D44-E9F3-4151-AD6C-EF8747D26279}'" delete
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1600
              • C:\Windows\System32\wbem\WMIC.exe
                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{26437D44-E9F3-4151-AD6C-EF8747D26279}'" delete
                3⤵
                  PID:3052
              • C:\Windows\system32\cmd.exe
                cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5A3909E3-0349-4893-B620-8BF1FBB95C00}'" delete
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1312
                • C:\Windows\System32\wbem\WMIC.exe
                  C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5A3909E3-0349-4893-B620-8BF1FBB95C00}'" delete
                  3⤵
                    PID:2076
                • C:\Windows\system32\cmd.exe
                  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A48FA831-1B6A-4448-A7B1-1ADDB20FFC63}'" delete
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2940
                  • C:\Windows\System32\wbem\WMIC.exe
                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A48FA831-1B6A-4448-A7B1-1ADDB20FFC63}'" delete
                    3⤵
                      PID:1316
                  • C:\Windows\system32\cmd.exe
                    cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B3A24998-E021-4E26-A18A-01B195D5F6EF}'" delete
                    2⤵
                      PID:1280
                      • C:\Windows\System32\wbem\WMIC.exe
                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B3A24998-E021-4E26-A18A-01B195D5F6EF}'" delete
                        3⤵
                          PID:1788
                      • C:\Windows\system32\cmd.exe
                        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{176585F1-AE7A-41F8-A7E1-F9117E37A0F8}'" delete
                        2⤵
                          PID:1796
                          • C:\Windows\System32\wbem\WMIC.exe
                            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{176585F1-AE7A-41F8-A7E1-F9117E37A0F8}'" delete
                            3⤵
                              PID:3044
                          • C:\Windows\system32\cmd.exe
                            cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{59331556-E169-42CD-A82F-2AE360836DEE}'" delete
                            2⤵
                              PID:1540
                              • C:\Windows\System32\wbem\WMIC.exe
                                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{59331556-E169-42CD-A82F-2AE360836DEE}'" delete
                                3⤵
                                  PID:1984
                              • C:\Windows\system32\cmd.exe
                                cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{084A89D4-60D7-4F6B-A74E-4B3558D7498D}'" delete
                                2⤵
                                  PID:1592
                                  • C:\Windows\System32\wbem\WMIC.exe
                                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{084A89D4-60D7-4F6B-A74E-4B3558D7498D}'" delete
                                    3⤵
                                      PID:1824
                                  • C:\Windows\system32\cmd.exe
                                    cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{06FBC618-48E1-4903-83F0-5A90E551CB9A}'" delete
                                    2⤵
                                      PID:2132
                                      • C:\Windows\System32\wbem\WMIC.exe
                                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{06FBC618-48E1-4903-83F0-5A90E551CB9A}'" delete
                                        3⤵
                                          PID:1484
                                      • C:\Windows\system32\cmd.exe
                                        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E4862111-A029-4368-B24B-7FADEE78F6CC}'" delete
                                        2⤵
                                          PID:2888
                                          • C:\Windows\System32\wbem\WMIC.exe
                                            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E4862111-A029-4368-B24B-7FADEE78F6CC}'" delete
                                            3⤵
                                              PID:2400
                                          • C:\Windows\system32\cmd.exe
                                            cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0157020D-571F-47AB-8624-D78FF55B3145}'" delete
                                            2⤵
                                              PID:2284
                                              • C:\Windows\System32\wbem\WMIC.exe
                                                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0157020D-571F-47AB-8624-D78FF55B3145}'" delete
                                                3⤵
                                                  PID:2352
                                              • C:\Windows\system32\cmd.exe
                                                cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F839700D-1515-4D53-8CD4-583F0E6184D4}'" delete
                                                2⤵
                                                  PID:436
                                                  • C:\Windows\System32\wbem\WMIC.exe
                                                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F839700D-1515-4D53-8CD4-583F0E6184D4}'" delete
                                                    3⤵
                                                      PID:1744
                                                  • C:\Windows\system32\cmd.exe
                                                    cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{ABAE6547-21F1-4A49-BE04-32715E845736}'" delete
                                                    2⤵
                                                      PID:1548
                                                      • C:\Windows\System32\wbem\WMIC.exe
                                                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{ABAE6547-21F1-4A49-BE04-32715E845736}'" delete
                                                        3⤵
                                                          PID:1776
                                                    • C:\Windows\system32\vssvc.exe
                                                      C:\Windows\system32\vssvc.exe
                                                      1⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2976
                                                    • C:\Windows\system32\NOTEPAD.EXE
                                                      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme.txt
                                                      1⤵
                                                      • Opens file in notepad (likely ransom note)
                                                      PID:964

                                                    Network

                                                    MITRE ATT&CK Matrix ATT&CK v6

                                                    Initial Access

                                                    Execution

                                                    Persistence

                                                    Privilege Escalation

                                                    Defense Evasion

                                                    Credential Access

                                                    Credentials in Files

                                                    1
                                                    T1081

                                                    Discovery

                                                    Lateral Movement

                                                    Collection

                                                    Data from Local System

                                                    1
                                                    T1005

                                                    Exfiltration

                                                    Command and Control

                                                    Impact

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Program Files (x86)\readme.txt
                                                      Filesize

                                                      16KB

                                                      MD5

                                                      a55db6906df9fce8c9143ae77667b484

                                                      SHA1

                                                      8ae0329ad3c6de786f63a830440adc084e02adff

                                                      SHA256

                                                      6fa7bb1e97a6145c4f47634b092ace66bbb77085b23f95ebabf3dddbefef740a

                                                      SHA512

                                                      a860225d86dc78bdbbb51aa1cee1372d10047e170468fb6796c50992645ca9253399d6e6374d39ea96a1983980684d2216aff1b0c32300e2eaf91cb3a3ef5953

                                                      Download Submit
                                                    • C:\Users\Admin\Desktop\readme.txt
                                                      Filesize

                                                      16KB

                                                      MD5

                                                      a55db6906df9fce8c9143ae77667b484

                                                      SHA1

                                                      8ae0329ad3c6de786f63a830440adc084e02adff

                                                      SHA256

                                                      6fa7bb1e97a6145c4f47634b092ace66bbb77085b23f95ebabf3dddbefef740a

                                                      SHA512

                                                      a860225d86dc78bdbbb51aa1cee1372d10047e170468fb6796c50992645ca9253399d6e6374d39ea96a1983980684d2216aff1b0c32300e2eaf91cb3a3ef5953

                                                      Download Submit