Analysis
-
max time kernel
104s -
max time network
85s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2023 09:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
Resource
win7-20231020-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
-
Size
224KB
-
MD5
033acf3b0f699a39becdc71d3e2dddcc
-
SHA1
5949c404aee552fc8ce29e3bf77bd08e54d37c59
-
SHA256
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853
-
SHA512
604ba9e02ec18b8ad1005ec3d86970261925a1d2c198a975387beb62a9711012733b92e7641a5687af835cf1ddb5b6c6d732b33a12387a3a293ca08929f7fb50
-
SSDEEP
3072:xtsD+K6k7UXP6ih6XULC9GHJkmm8GxTyPGryXdEekUuIiMi:4D+33P6Y6XGpY8G5yore3u5Mi
Score
10/10
Malware Config
Signatures
-
Meow
A ransomware that wipes unsecured databases first seen in Mid 2020.
-
Renames multiple (5368) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 31 IoCs
description ioc Process File opened for modification C:\Users\Admin\Music\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Links\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Videos\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Documents\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Music\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\end_review.gif 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\main-selector.css 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Mozilla Firefox\installation_telemetry.json 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ppd.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-pl.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ppd.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ms.pak.DATA 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ppd.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\WHOOSH.WAV 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\selector.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ro.pak.DATA 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\vlc.mo 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\hi.pak.DATA 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_folder-focus_32.svg 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\sql70.xsl 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN114.XML 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-It.otf 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugin.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_share_18.svg 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\vlc.mo 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\PREVIEW.GIF 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Mozilla Firefox\defaultagent_localized.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ppd.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_2x.png 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL120.XML 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-pl.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\s_shared_multi_filetype.svg 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\close_x.png 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_remove_18.svg 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\Content.xml 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2192 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 1924 vssvc.exe Token: SeRestorePrivilege 1924 vssvc.exe Token: SeAuditPrivilege 1924 vssvc.exe Token: SeIncreaseQuotaPrivilege 1504 WMIC.exe Token: SeSecurityPrivilege 1504 WMIC.exe Token: SeTakeOwnershipPrivilege 1504 WMIC.exe Token: SeLoadDriverPrivilege 1504 WMIC.exe Token: SeSystemProfilePrivilege 1504 WMIC.exe Token: SeSystemtimePrivilege 1504 WMIC.exe Token: SeProfSingleProcessPrivilege 1504 WMIC.exe Token: SeIncBasePriorityPrivilege 1504 WMIC.exe Token: SeCreatePagefilePrivilege 1504 WMIC.exe Token: SeBackupPrivilege 1504 WMIC.exe Token: SeRestorePrivilege 1504 WMIC.exe Token: SeShutdownPrivilege 1504 WMIC.exe Token: SeDebugPrivilege 1504 WMIC.exe Token: SeSystemEnvironmentPrivilege 1504 WMIC.exe Token: SeRemoteShutdownPrivilege 1504 WMIC.exe Token: SeUndockPrivilege 1504 WMIC.exe Token: SeManageVolumePrivilege 1504 WMIC.exe Token: 33 1504 WMIC.exe Token: 34 1504 WMIC.exe Token: 35 1504 WMIC.exe Token: 36 1504 WMIC.exe Token: SeIncreaseQuotaPrivilege 1504 WMIC.exe Token: SeSecurityPrivilege 1504 WMIC.exe Token: SeTakeOwnershipPrivilege 1504 WMIC.exe Token: SeLoadDriverPrivilege 1504 WMIC.exe Token: SeSystemProfilePrivilege 1504 WMIC.exe Token: SeSystemtimePrivilege 1504 WMIC.exe Token: SeProfSingleProcessPrivilege 1504 WMIC.exe Token: SeIncBasePriorityPrivilege 1504 WMIC.exe Token: SeCreatePagefilePrivilege 1504 WMIC.exe Token: SeBackupPrivilege 1504 WMIC.exe Token: SeRestorePrivilege 1504 WMIC.exe Token: SeShutdownPrivilege 1504 WMIC.exe Token: SeDebugPrivilege 1504 WMIC.exe Token: SeSystemEnvironmentPrivilege 1504 WMIC.exe Token: SeRemoteShutdownPrivilege 1504 WMIC.exe Token: SeUndockPrivilege 1504 WMIC.exe Token: SeManageVolumePrivilege 1504 WMIC.exe Token: 33 1504 WMIC.exe Token: 34 1504 WMIC.exe Token: 35 1504 WMIC.exe Token: 36 1504 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4520 wrote to memory of 1804 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 94 PID 4520 wrote to memory of 1804 4520 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 94 PID 1804 wrote to memory of 1504 1804 cmd.exe 96 PID 1804 wrote to memory of 1504 1804 cmd.exe 96 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe"C:\Users\Admin\AppData\Local\Temp\222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B1F1B88C-B024-4340-B1CA-B5B18E2D680C}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B1F1B88C-B024-4340-B1CA-B5B18E2D680C}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1504
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1924
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme.txt1⤵
- Opens file in notepad (likely ransom note)
PID:2192
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5a55db6906df9fce8c9143ae77667b484
SHA18ae0329ad3c6de786f63a830440adc084e02adff
SHA2566fa7bb1e97a6145c4f47634b092ace66bbb77085b23f95ebabf3dddbefef740a
SHA512a860225d86dc78bdbbb51aa1cee1372d10047e170468fb6796c50992645ca9253399d6e6374d39ea96a1983980684d2216aff1b0c32300e2eaf91cb3a3ef5953
-
Filesize
16KB
MD5a55db6906df9fce8c9143ae77667b484
SHA18ae0329ad3c6de786f63a830440adc084e02adff
SHA2566fa7bb1e97a6145c4f47634b092ace66bbb77085b23f95ebabf3dddbefef740a
SHA512a860225d86dc78bdbbb51aa1cee1372d10047e170468fb6796c50992645ca9253399d6e6374d39ea96a1983980684d2216aff1b0c32300e2eaf91cb3a3ef5953