Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17-07-2023 14:17
Static task
static1
Behavioral task
behavioral1
Sample
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
Resource
win10v2004-20230703-en
General
-
Target
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
-
Size
224KB
-
MD5
033acf3b0f699a39becdc71d3e2dddcc
-
SHA1
5949c404aee552fc8ce29e3bf77bd08e54d37c59
-
SHA256
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853
-
SHA512
604ba9e02ec18b8ad1005ec3d86970261925a1d2c198a975387beb62a9711012733b92e7641a5687af835cf1ddb5b6c6d732b33a12387a3a293ca08929f7fb50
-
SSDEEP
3072:xtsD+K6k7UXP6ih6XULC9GHJkmm8GxTyPGryXdEekUuIiMi:4D+33P6Y6XGpY8G5yore3u5Mi
Malware Config
Signatures
-
Meow
A ransomware that wipes unsecured databases first seen in Mid 2020.
-
Renames multiple (8267) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 1 IoCs
Processes:
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 31 IoCs
Processes:
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exedescription ioc process File opened for modification C:\Users\Admin\Saved Games\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Videos\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Documents\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Links\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Music\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Music\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe -
Drops file in Program Files directory 64 IoCs
Processes:
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ko_135x40.svg 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Search.api 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\OWSHLP10.CHM 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\VBUI6.CHM 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ca-es\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\mobile_scan_logo.svg 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Mozilla Firefox\precomplete 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_ja.jar 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pt-br\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-fr\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\Reader_DC.helpcfg 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ppd.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\EDGE.INF 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\he-il\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\7-Zip\License.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\hu_get.svg 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-180.png 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\VideoLAN\VLC\plugins\lua\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\AppStore_icon.svg 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ro-ro\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pt-br\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\plugin.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL081.XML 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\uk-ua\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\VideoLAN\VLC\locale\km\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\css\main.css 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sl_get.svg 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ro-ro\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\caution.svg 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Common Files\Adobe\HelpCfg\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\send-email-16.png 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exepid process 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 3816 vssvc.exe Token: SeRestorePrivilege 3816 vssvc.exe Token: SeAuditPrivilege 3816 vssvc.exe Token: SeIncreaseQuotaPrivilege 2548 WMIC.exe Token: SeSecurityPrivilege 2548 WMIC.exe Token: SeTakeOwnershipPrivilege 2548 WMIC.exe Token: SeLoadDriverPrivilege 2548 WMIC.exe Token: SeSystemProfilePrivilege 2548 WMIC.exe Token: SeSystemtimePrivilege 2548 WMIC.exe Token: SeProfSingleProcessPrivilege 2548 WMIC.exe Token: SeIncBasePriorityPrivilege 2548 WMIC.exe Token: SeCreatePagefilePrivilege 2548 WMIC.exe Token: SeBackupPrivilege 2548 WMIC.exe Token: SeRestorePrivilege 2548 WMIC.exe Token: SeShutdownPrivilege 2548 WMIC.exe Token: SeDebugPrivilege 2548 WMIC.exe Token: SeSystemEnvironmentPrivilege 2548 WMIC.exe Token: SeRemoteShutdownPrivilege 2548 WMIC.exe Token: SeUndockPrivilege 2548 WMIC.exe Token: SeManageVolumePrivilege 2548 WMIC.exe Token: 33 2548 WMIC.exe Token: 34 2548 WMIC.exe Token: 35 2548 WMIC.exe Token: 36 2548 WMIC.exe Token: SeIncreaseQuotaPrivilege 2548 WMIC.exe Token: SeSecurityPrivilege 2548 WMIC.exe Token: SeTakeOwnershipPrivilege 2548 WMIC.exe Token: SeLoadDriverPrivilege 2548 WMIC.exe Token: SeSystemProfilePrivilege 2548 WMIC.exe Token: SeSystemtimePrivilege 2548 WMIC.exe Token: SeProfSingleProcessPrivilege 2548 WMIC.exe Token: SeIncBasePriorityPrivilege 2548 WMIC.exe Token: SeCreatePagefilePrivilege 2548 WMIC.exe Token: SeBackupPrivilege 2548 WMIC.exe Token: SeRestorePrivilege 2548 WMIC.exe Token: SeShutdownPrivilege 2548 WMIC.exe Token: SeDebugPrivilege 2548 WMIC.exe Token: SeSystemEnvironmentPrivilege 2548 WMIC.exe Token: SeRemoteShutdownPrivilege 2548 WMIC.exe Token: SeUndockPrivilege 2548 WMIC.exe Token: SeManageVolumePrivilege 2548 WMIC.exe Token: 33 2548 WMIC.exe Token: 34 2548 WMIC.exe Token: 35 2548 WMIC.exe Token: 36 2548 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.execmd.exedescription pid process target process PID 4408 wrote to memory of 2072 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe cmd.exe PID 4408 wrote to memory of 2072 4408 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe cmd.exe PID 2072 wrote to memory of 2548 2072 cmd.exe WMIC.exe PID 2072 wrote to memory of 2548 2072 cmd.exe WMIC.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe"C:\Users\Admin\AppData\Local\Temp\222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{639FD6EE-6EBF-4335-B304-22992C24BC49}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{639FD6EE-6EBF-4335-B304-22992C24BC49}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2548
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3816
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5a55db6906df9fce8c9143ae77667b484
SHA18ae0329ad3c6de786f63a830440adc084e02adff
SHA2566fa7bb1e97a6145c4f47634b092ace66bbb77085b23f95ebabf3dddbefef740a
SHA512a860225d86dc78bdbbb51aa1cee1372d10047e170468fb6796c50992645ca9253399d6e6374d39ea96a1983980684d2216aff1b0c32300e2eaf91cb3a3ef5953