Overview

overview

10

Static

static

3

222e2b91f5...53.exe

windows7-x64

10

222e2b91f5...53.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    96s
  • max time network
    53s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2023 09:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe

  • Size

    224KB

  • MD5

    033acf3b0f699a39becdc71d3e2dddcc

  • SHA1

    5949c404aee552fc8ce29e3bf77bd08e54d37c59

  • SHA256

    222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853

  • SHA512

    604ba9e02ec18b8ad1005ec3d86970261925a1d2c198a975387beb62a9711012733b92e7641a5687af835cf1ddb5b6c6d732b33a12387a3a293ca08929f7fb50

  • SSDEEP

    3072:xtsD+K6k7UXP6ih6XULC9GHJkmm8GxTyPGryXdEekUuIiMi:4D+33P6Y6XGpY8G5yore3u5Mi

Score
10/10
meowransomwarespywarestealer

Malware Config

Signatures

  • Meow

    A ransomware that wipes unsecured databases first seen in Mid 2020.

    ransomwaremeow
  • Renames multiple (7958) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 46 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
    "C:\Users\Admin\AppData\Local\Temp\222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1196
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F909CC29-6A0D-4306-8F72-48F9446B3F73}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2468
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{18B66D0F-8735-448D-8927-3494BBB97405}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2008
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{18B66D0F-8735-448D-8927-3494BBB97405}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2568
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F4769EC3-C880-4DFE-BEA3-1DE52D07928F}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2616
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F4769EC3-C880-4DFE-BEA3-1DE52D07928F}'" delete
        3⤵
          PID:3036
      • C:\Windows\system32\cmd.exe
        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7BE8D073-24DB-459F-A66A-FBE9739E576F}'" delete
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2476
        • C:\Windows\System32\wbem\WMIC.exe
          C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7BE8D073-24DB-459F-A66A-FBE9739E576F}'" delete
          3⤵
            PID:1816
        • C:\Windows\system32\cmd.exe
          cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EADC2311-5ECB-447F-9166-2EF749E62DE4}'" delete
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2876
          • C:\Windows\System32\wbem\WMIC.exe
            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EADC2311-5ECB-447F-9166-2EF749E62DE4}'" delete
            3⤵
              PID:380
          • C:\Windows\system32\cmd.exe
            cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0C714119-74FA-4C57-84AA-F79E2B11DBF5}'" delete
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2904
            • C:\Windows\System32\wbem\WMIC.exe
              C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0C714119-74FA-4C57-84AA-F79E2B11DBF5}'" delete
              3⤵
                PID:324
            • C:\Windows\system32\cmd.exe
              cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B5111B61-F84A-43EA-B248-F48EB6BEE883}'" delete
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1728
              • C:\Windows\System32\wbem\WMIC.exe
                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B5111B61-F84A-43EA-B248-F48EB6BEE883}'" delete
                3⤵
                  PID:1616
              • C:\Windows\system32\cmd.exe
                cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{710803CC-7795-432B-B994-2A98F50FAA7E}'" delete
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:2028
                • C:\Windows\System32\wbem\WMIC.exe
                  C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{710803CC-7795-432B-B994-2A98F50FAA7E}'" delete
                  3⤵
                    PID:2192
                • C:\Windows\system32\cmd.exe
                  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4A0E70B3-2325-4D59-B1AB-A220B1499C47}'" delete
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2484
                  • C:\Windows\System32\wbem\WMIC.exe
                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4A0E70B3-2325-4D59-B1AB-A220B1499C47}'" delete
                    3⤵
                      PID:1952
                  • C:\Windows\system32\cmd.exe
                    cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EB479BBB-2806-4C36-83BE-182896C0102C}'" delete
                    2⤵
                      PID:588
                      • C:\Windows\System32\wbem\WMIC.exe
                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EB479BBB-2806-4C36-83BE-182896C0102C}'" delete
                        3⤵
                          PID:1484
                      • C:\Windows\system32\cmd.exe
                        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B4C91BD2-EB74-4C30-999A-BBEC31C47694}'" delete
                        2⤵
                          PID:1624
                          • C:\Windows\System32\wbem\WMIC.exe
                            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B4C91BD2-EB74-4C30-999A-BBEC31C47694}'" delete
                            3⤵
                              PID:1072
                          • C:\Windows\system32\cmd.exe
                            cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AD46389-74DC-4D6A-8596-F5A6EE8346DE}'" delete
                            2⤵
                              PID:1508
                              • C:\Windows\System32\wbem\WMIC.exe
                                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AD46389-74DC-4D6A-8596-F5A6EE8346DE}'" delete
                                3⤵
                                  PID:320
                              • C:\Windows\system32\cmd.exe
                                cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{78AB9CC1-0E99-4DB2-8B2E-82890F8FD751}'" delete
                                2⤵
                                  PID:1760
                                  • C:\Windows\System32\wbem\WMIC.exe
                                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{78AB9CC1-0E99-4DB2-8B2E-82890F8FD751}'" delete
                                    3⤵
                                      PID:2016
                                  • C:\Windows\system32\cmd.exe
                                    cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B923A9C7-05C7-4262-B327-8C1534FB6C8B}'" delete
                                    2⤵
                                      PID:796
                                      • C:\Windows\System32\wbem\WMIC.exe
                                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B923A9C7-05C7-4262-B327-8C1534FB6C8B}'" delete
                                        3⤵
                                          PID:2068
                                      • C:\Windows\system32\cmd.exe
                                        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{ED9EACAF-BB6B-4178-B2C9-56624D81E2A5}'" delete
                                        2⤵
                                          PID:2152
                                          • C:\Windows\System32\wbem\WMIC.exe
                                            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{ED9EACAF-BB6B-4178-B2C9-56624D81E2A5}'" delete
                                            3⤵
                                              PID:2308
                                          • C:\Windows\system32\cmd.exe
                                            cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D91086CD-3BF1-41A5-A939-FFBEFEAFB03F}'" delete
                                            2⤵
                                              PID:1864
                                              • C:\Windows\System32\wbem\WMIC.exe
                                                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D91086CD-3BF1-41A5-A939-FFBEFEAFB03F}'" delete
                                                3⤵
                                                  PID:1892
                                              • C:\Windows\system32\cmd.exe
                                                cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3BE296C3-B6F9-4FB2-885A-C5FB3C1A1318}'" delete
                                                2⤵
                                                  PID:2268
                                                  • C:\Windows\System32\wbem\WMIC.exe
                                                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3BE296C3-B6F9-4FB2-885A-C5FB3C1A1318}'" delete
                                                    3⤵
                                                      PID:2388
                                                  • C:\Windows\system32\cmd.exe
                                                    cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CBB1EE14-7011-4BE8-85A5-326A60F0C359}'" delete
                                                    2⤵
                                                      PID:1428
                                                      • C:\Windows\System32\wbem\WMIC.exe
                                                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CBB1EE14-7011-4BE8-85A5-326A60F0C359}'" delete
                                                        3⤵
                                                          PID:1780
                                                    • C:\Windows\system32\vssvc.exe
                                                      C:\Windows\system32\vssvc.exe
                                                      1⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2820
                                                    • C:\Windows\System32\wbem\WMIC.exe
                                                      C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F909CC29-6A0D-4306-8F72-48F9446B3F73}'" delete
                                                      1⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2588

                                                    Network

                                                    MITRE ATT&CK Matrix ATT&CK v13

                                                    Initial Access

                                                    Execution

                                                    Persistence

                                                    Privilege Escalation

                                                    Defense Evasion

                                                    Credential Access

                                                    Unsecured Credentials

                                                    1
                                                    T1552

                                                    Credentials In Files

                                                    1
                                                    T1552.001

                                                    Discovery

                                                    Lateral Movement

                                                    Collection

                                                    Data from Local System

                                                    1
                                                    T1005

                                                    Exfiltration

                                                    Command and Control

                                                    Impact

                                                    Resource Development

                                                    Reconnaissance

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Program Files (x86)\readme.txt
                                                      Filesize

                                                      16KB

                                                      MD5

                                                      a55db6906df9fce8c9143ae77667b484

                                                      SHA1

                                                      8ae0329ad3c6de786f63a830440adc084e02adff

                                                      SHA256

                                                      6fa7bb1e97a6145c4f47634b092ace66bbb77085b23f95ebabf3dddbefef740a

                                                      SHA512

                                                      a860225d86dc78bdbbb51aa1cee1372d10047e170468fb6796c50992645ca9253399d6e6374d39ea96a1983980684d2216aff1b0c32300e2eaf91cb3a3ef5953

                                                      Download Submit