Analysis
-
max time kernel
33s -
max time network
37s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
10-10-2024 08:25
Static task
static1
Behavioral task
behavioral1
Sample
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
Resource
win10v2004-20241007-en
General
-
Target
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
-
Size
224KB
-
MD5
033acf3b0f699a39becdc71d3e2dddcc
-
SHA1
5949c404aee552fc8ce29e3bf77bd08e54d37c59
-
SHA256
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853
-
SHA512
604ba9e02ec18b8ad1005ec3d86970261925a1d2c198a975387beb62a9711012733b92e7641a5687af835cf1ddb5b6c6d732b33a12387a3a293ca08929f7fb50
-
SSDEEP
3072:xtsD+K6k7UXP6ih6XULC9GHJkmm8GxTyPGryXdEekUuIiMi:4D+33P6Y6XGpY8G5yore3u5Mi
Malware Config
Signatures
-
Meow
A ransomware that wipes unsecured databases first seen in Mid 2020.
-
Renames multiple (8026) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
Processes:
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 46 IoCs
Processes:
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exedescription ioc Process File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Links\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Music\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\CBCNU6WZ\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RTJA0BV0\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Documents\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\25UY7HZX\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JMFEWY8E\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Videos\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Music\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe -
Drops file in Program Files directory 64 IoCs
Processes:
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exedescription ioc Process File opened for modification C:\Program Files\Java\jre7\bin\server\Xusage.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\THMBNAIL.PNG 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tongatapu 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00045_.WMF 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0281904.WMF 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN103.XML 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBBTN.XML 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yakutat 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107290.WMF 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\CASCADE.INF 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_zh_CN.jar 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\Microsoft Games\Purble Place\en-US\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCHKBRD.DPV 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02074_.GIF 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\vlc.mo 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00343_.WMF 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WEBPAGE.XML 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00735_.WMF 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7es.kic 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH02312_.WMF 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\Client.xml 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00683_.WMF 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\GIFT.XML 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Tokyo 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FORM.ICO 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCOUPON.XML 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18218_.WMF 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21481_.GIF 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\messageboxinfo.ico 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02748G.GIF 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL01041_.WMF 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\BOLDSTRI.ELM 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SPANISH.LNG 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0227419.JPG 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0211949.WMF 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert.css 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Sts2.css 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\PREVIEW.GIF 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18185_.WMF 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18226_.WMF 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zaporozhye 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CG1606.WMF 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_ja_4.4.0.v20140623020002.jar 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exepid Process 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid Process Token: SeBackupPrivilege 2912 vssvc.exe Token: SeRestorePrivilege 2912 vssvc.exe Token: SeAuditPrivilege 2912 vssvc.exe Token: SeIncreaseQuotaPrivilege 2740 WMIC.exe Token: SeSecurityPrivilege 2740 WMIC.exe Token: SeTakeOwnershipPrivilege 2740 WMIC.exe Token: SeLoadDriverPrivilege 2740 WMIC.exe Token: SeSystemProfilePrivilege 2740 WMIC.exe Token: SeSystemtimePrivilege 2740 WMIC.exe Token: SeProfSingleProcessPrivilege 2740 WMIC.exe Token: SeIncBasePriorityPrivilege 2740 WMIC.exe Token: SeCreatePagefilePrivilege 2740 WMIC.exe Token: SeBackupPrivilege 2740 WMIC.exe Token: SeRestorePrivilege 2740 WMIC.exe Token: SeShutdownPrivilege 2740 WMIC.exe Token: SeDebugPrivilege 2740 WMIC.exe Token: SeSystemEnvironmentPrivilege 2740 WMIC.exe Token: SeRemoteShutdownPrivilege 2740 WMIC.exe Token: SeUndockPrivilege 2740 WMIC.exe Token: SeManageVolumePrivilege 2740 WMIC.exe Token: 33 2740 WMIC.exe Token: 34 2740 WMIC.exe Token: 35 2740 WMIC.exe Token: SeIncreaseQuotaPrivilege 2740 WMIC.exe Token: SeSecurityPrivilege 2740 WMIC.exe Token: SeTakeOwnershipPrivilege 2740 WMIC.exe Token: SeLoadDriverPrivilege 2740 WMIC.exe Token: SeSystemProfilePrivilege 2740 WMIC.exe Token: SeSystemtimePrivilege 2740 WMIC.exe Token: SeProfSingleProcessPrivilege 2740 WMIC.exe Token: SeIncBasePriorityPrivilege 2740 WMIC.exe Token: SeCreatePagefilePrivilege 2740 WMIC.exe Token: SeBackupPrivilege 2740 WMIC.exe Token: SeRestorePrivilege 2740 WMIC.exe Token: SeShutdownPrivilege 2740 WMIC.exe Token: SeDebugPrivilege 2740 WMIC.exe Token: SeSystemEnvironmentPrivilege 2740 WMIC.exe Token: SeRemoteShutdownPrivilege 2740 WMIC.exe Token: SeUndockPrivilege 2740 WMIC.exe Token: SeManageVolumePrivilege 2740 WMIC.exe Token: 33 2740 WMIC.exe Token: 34 2740 WMIC.exe Token: 35 2740 WMIC.exe Token: SeIncreaseQuotaPrivilege 2904 WMIC.exe Token: SeSecurityPrivilege 2904 WMIC.exe Token: SeTakeOwnershipPrivilege 2904 WMIC.exe Token: SeLoadDriverPrivilege 2904 WMIC.exe Token: SeSystemProfilePrivilege 2904 WMIC.exe Token: SeSystemtimePrivilege 2904 WMIC.exe Token: SeProfSingleProcessPrivilege 2904 WMIC.exe Token: SeIncBasePriorityPrivilege 2904 WMIC.exe Token: SeCreatePagefilePrivilege 2904 WMIC.exe Token: SeBackupPrivilege 2904 WMIC.exe Token: SeRestorePrivilege 2904 WMIC.exe Token: SeShutdownPrivilege 2904 WMIC.exe Token: SeDebugPrivilege 2904 WMIC.exe Token: SeSystemEnvironmentPrivilege 2904 WMIC.exe Token: SeRemoteShutdownPrivilege 2904 WMIC.exe Token: SeUndockPrivilege 2904 WMIC.exe Token: SeManageVolumePrivilege 2904 WMIC.exe Token: 33 2904 WMIC.exe Token: 34 2904 WMIC.exe Token: 35 2904 WMIC.exe Token: SeIncreaseQuotaPrivilege 2904 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid Process procid_target PID 1760 wrote to memory of 2036 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 33 PID 1760 wrote to memory of 2036 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 33 PID 1760 wrote to memory of 2036 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 33 PID 1760 wrote to memory of 2036 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 33 PID 2036 wrote to memory of 2740 2036 cmd.exe 35 PID 2036 wrote to memory of 2740 2036 cmd.exe 35 PID 2036 wrote to memory of 2740 2036 cmd.exe 35 PID 1760 wrote to memory of 2820 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 36 PID 1760 wrote to memory of 2820 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 36 PID 1760 wrote to memory of 2820 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 36 PID 1760 wrote to memory of 2820 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 36 PID 2820 wrote to memory of 2904 2820 cmd.exe 38 PID 2820 wrote to memory of 2904 2820 cmd.exe 38 PID 2820 wrote to memory of 2904 2820 cmd.exe 38 PID 1760 wrote to memory of 2704 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 39 PID 1760 wrote to memory of 2704 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 39 PID 1760 wrote to memory of 2704 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 39 PID 1760 wrote to memory of 2704 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 39 PID 2704 wrote to memory of 1388 2704 cmd.exe 41 PID 2704 wrote to memory of 1388 2704 cmd.exe 41 PID 2704 wrote to memory of 1388 2704 cmd.exe 41 PID 1760 wrote to memory of 2232 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 42 PID 1760 wrote to memory of 2232 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 42 PID 1760 wrote to memory of 2232 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 42 PID 1760 wrote to memory of 2232 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 42 PID 2232 wrote to memory of 1172 2232 cmd.exe 44 PID 2232 wrote to memory of 1172 2232 cmd.exe 44 PID 2232 wrote to memory of 1172 2232 cmd.exe 44 PID 1760 wrote to memory of 2340 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 45 PID 1760 wrote to memory of 2340 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 45 PID 1760 wrote to memory of 2340 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 45 PID 1760 wrote to memory of 2340 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 45 PID 2340 wrote to memory of 900 2340 cmd.exe 47 PID 2340 wrote to memory of 900 2340 cmd.exe 47 PID 2340 wrote to memory of 900 2340 cmd.exe 47 PID 1760 wrote to memory of 1944 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 48 PID 1760 wrote to memory of 1944 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 48 PID 1760 wrote to memory of 1944 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 48 PID 1760 wrote to memory of 1944 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 48 PID 1944 wrote to memory of 1824 1944 cmd.exe 50 PID 1944 wrote to memory of 1824 1944 cmd.exe 50 PID 1944 wrote to memory of 1824 1944 cmd.exe 50 PID 1760 wrote to memory of 2628 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 51 PID 1760 wrote to memory of 2628 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 51 PID 1760 wrote to memory of 2628 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 51 PID 1760 wrote to memory of 2628 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 51 PID 2628 wrote to memory of 3068 2628 cmd.exe 53 PID 2628 wrote to memory of 3068 2628 cmd.exe 53 PID 2628 wrote to memory of 3068 2628 cmd.exe 53 PID 1760 wrote to memory of 2864 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 54 PID 1760 wrote to memory of 2864 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 54 PID 1760 wrote to memory of 2864 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 54 PID 1760 wrote to memory of 2864 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 54 PID 2864 wrote to memory of 2844 2864 cmd.exe 56 PID 2864 wrote to memory of 2844 2864 cmd.exe 56 PID 2864 wrote to memory of 2844 2864 cmd.exe 56 PID 1760 wrote to memory of 1596 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 57 PID 1760 wrote to memory of 1596 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 57 PID 1760 wrote to memory of 1596 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 57 PID 1760 wrote to memory of 1596 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 57 PID 1596 wrote to memory of 1524 1596 cmd.exe 59 PID 1596 wrote to memory of 1524 1596 cmd.exe 59 PID 1596 wrote to memory of 1524 1596 cmd.exe 59 PID 1760 wrote to memory of 3020 1760 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 60 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe"C:\Users\Admin\AppData\Local\Temp\222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E069A50B-4677-4EFC-BBA4-0B146896D635}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E069A50B-4677-4EFC-BBA4-0B146896D635}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D2AAF6AE-BF4D-45CD-A04C-0BEFD44E7053}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D2AAF6AE-BF4D-45CD-A04C-0BEFD44E7053}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2904
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C1326537-1510-4283-A8A8-5E899D2D7407}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C1326537-1510-4283-A8A8-5E899D2D7407}'" delete3⤵PID:1388
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EA740D83-F31E-4066-9A9F-562BB0076E47}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EA740D83-F31E-4066-9A9F-562BB0076E47}'" delete3⤵PID:1172
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{043869AD-442E-4953-A9F1-63B2631D10C7}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{043869AD-442E-4953-A9F1-63B2631D10C7}'" delete3⤵PID:900
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{77F6EAD6-2B79-4571-848B-E297C18B14D5}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{77F6EAD6-2B79-4571-848B-E297C18B14D5}'" delete3⤵PID:1824
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C9DEE5C4-A860-475A-8AF4-2E735A8E8E6A}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C9DEE5C4-A860-475A-8AF4-2E735A8E8E6A}'" delete3⤵PID:3068
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6285DFB1-A11D-43CD-8F8A-49E273581552}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6285DFB1-A11D-43CD-8F8A-49E273581552}'" delete3⤵PID:2844
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{76BA5318-71CC-44D0-9EB2-F1ADD3236F72}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{76BA5318-71CC-44D0-9EB2-F1ADD3236F72}'" delete3⤵PID:1524
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6A13D77C-3B8B-4D66-8EC9-78ECAE56EFC3}'" delete2⤵PID:3020
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6A13D77C-3B8B-4D66-8EC9-78ECAE56EFC3}'" delete3⤵PID:1848
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9FD587E5-6373-4ADB-A8B2-6478FE129FEB}'" delete2⤵PID:276
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9FD587E5-6373-4ADB-A8B2-6478FE129FEB}'" delete3⤵PID:588
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{908CFA86-110D-45AF-A880-8CC044D5BBF7}'" delete2⤵PID:2204
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{908CFA86-110D-45AF-A880-8CC044D5BBF7}'" delete3⤵PID:2180
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5707A7FF-F8CB-4410-A576-785888774343}'" delete2⤵PID:2376
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5707A7FF-F8CB-4410-A576-785888774343}'" delete3⤵PID:2188
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0B5E8C62-CCDF-452A-8F61-CD88FC678D52}'" delete2⤵PID:864
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0B5E8C62-CCDF-452A-8F61-CD88FC678D52}'" delete3⤵PID:2120
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6AAB0200-AA60-4E20-A6B0-C7BE2397087C}'" delete2⤵PID:2332
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6AAB0200-AA60-4E20-A6B0-C7BE2397087C}'" delete3⤵PID:1044
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E8CBA30E-CE08-4BCF-A683-18F009D44C60}'" delete2⤵PID:496
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E8CBA30E-CE08-4BCF-A683-18F009D44C60}'" delete3⤵PID:1488
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4BFC85ED-F021-42A1-BF3B-A27F2748F299}'" delete2⤵PID:1644
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4BFC85ED-F021-42A1-BF3B-A27F2748F299}'" delete3⤵PID:2268
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{68C97A87-5C3B-400A-A9A5-1A79E908C25E}'" delete2⤵PID:2576
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{68C97A87-5C3B-400A-A9A5-1A79E908C25E}'" delete3⤵PID:1548
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2912
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5a55db6906df9fce8c9143ae77667b484
SHA18ae0329ad3c6de786f63a830440adc084e02adff
SHA2566fa7bb1e97a6145c4f47634b092ace66bbb77085b23f95ebabf3dddbefef740a
SHA512a860225d86dc78bdbbb51aa1cee1372d10047e170468fb6796c50992645ca9253399d6e6374d39ea96a1983980684d2216aff1b0c32300e2eaf91cb3a3ef5953