Analysis
-
max time kernel
38s -
max time network
40s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2024 08:25
Static task
static1
Behavioral task
behavioral1
Sample
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
Resource
win10v2004-20241007-en
General
-
Target
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe
-
Size
224KB
-
MD5
033acf3b0f699a39becdc71d3e2dddcc
-
SHA1
5949c404aee552fc8ce29e3bf77bd08e54d37c59
-
SHA256
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853
-
SHA512
604ba9e02ec18b8ad1005ec3d86970261925a1d2c198a975387beb62a9711012733b92e7641a5687af835cf1ddb5b6c6d732b33a12387a3a293ca08929f7fb50
-
SSDEEP
3072:xtsD+K6k7UXP6ih6XULC9GHJkmm8GxTyPGryXdEekUuIiMi:4D+33P6Y6XGpY8G5yore3u5Mi
Malware Config
Signatures
-
Meow
A ransomware that wipes unsecured databases first seen in Mid 2020.
-
Renames multiple (7382) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
Processes:
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 31 IoCs
Processes:
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exedescription ioc Process File opened for modification C:\Users\Public\AccountPictures\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Links\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Music\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Music\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Videos\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\Documents\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Public\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe -
Drops file in Program Files directory 64 IoCs
Processes:
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exedescription ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\uk-ua\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL082.XML 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\da-dk\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ja-jp\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL022.XML 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\SmallLogo.png.DATA 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\S_IlluNoInternetConnection_120x80.svg 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-fr\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\bg_pattern_RHP.png 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\files_icons.png 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-pl.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\SLATE.ELM 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\README_en_CA.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\plugin.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\VideoLAN\VLC\plugins\meta_engine\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hu-hu\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\jce.jar 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ppd.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sk-sk\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\de-de\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fi-fi\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\Google\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-pl.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\VSTOFiles.cat 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\plugin.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-gb\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-ae\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ppd.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\rhp_world_icon_hover.png 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\uk-ua\ui-strings.js 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\reduced_mode-2x.png 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\readme.txt 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHPHN.DAT 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\et.pak.DATA 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exepid Process 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid Process Token: SeBackupPrivilege 4864 vssvc.exe Token: SeRestorePrivilege 4864 vssvc.exe Token: SeAuditPrivilege 4864 vssvc.exe Token: SeIncreaseQuotaPrivilege 3420 WMIC.exe Token: SeSecurityPrivilege 3420 WMIC.exe Token: SeTakeOwnershipPrivilege 3420 WMIC.exe Token: SeLoadDriverPrivilege 3420 WMIC.exe Token: SeSystemProfilePrivilege 3420 WMIC.exe Token: SeSystemtimePrivilege 3420 WMIC.exe Token: SeProfSingleProcessPrivilege 3420 WMIC.exe Token: SeIncBasePriorityPrivilege 3420 WMIC.exe Token: SeCreatePagefilePrivilege 3420 WMIC.exe Token: SeBackupPrivilege 3420 WMIC.exe Token: SeRestorePrivilege 3420 WMIC.exe Token: SeShutdownPrivilege 3420 WMIC.exe Token: SeDebugPrivilege 3420 WMIC.exe Token: SeSystemEnvironmentPrivilege 3420 WMIC.exe Token: SeRemoteShutdownPrivilege 3420 WMIC.exe Token: SeUndockPrivilege 3420 WMIC.exe Token: SeManageVolumePrivilege 3420 WMIC.exe Token: 33 3420 WMIC.exe Token: 34 3420 WMIC.exe Token: 35 3420 WMIC.exe Token: 36 3420 WMIC.exe Token: SeIncreaseQuotaPrivilege 3420 WMIC.exe Token: SeSecurityPrivilege 3420 WMIC.exe Token: SeTakeOwnershipPrivilege 3420 WMIC.exe Token: SeLoadDriverPrivilege 3420 WMIC.exe Token: SeSystemProfilePrivilege 3420 WMIC.exe Token: SeSystemtimePrivilege 3420 WMIC.exe Token: SeProfSingleProcessPrivilege 3420 WMIC.exe Token: SeIncBasePriorityPrivilege 3420 WMIC.exe Token: SeCreatePagefilePrivilege 3420 WMIC.exe Token: SeBackupPrivilege 3420 WMIC.exe Token: SeRestorePrivilege 3420 WMIC.exe Token: SeShutdownPrivilege 3420 WMIC.exe Token: SeDebugPrivilege 3420 WMIC.exe Token: SeSystemEnvironmentPrivilege 3420 WMIC.exe Token: SeRemoteShutdownPrivilege 3420 WMIC.exe Token: SeUndockPrivilege 3420 WMIC.exe Token: SeManageVolumePrivilege 3420 WMIC.exe Token: 33 3420 WMIC.exe Token: 34 3420 WMIC.exe Token: 35 3420 WMIC.exe Token: 36 3420 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.execmd.exedescription pid Process procid_target PID 1720 wrote to memory of 800 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 89 PID 1720 wrote to memory of 800 1720 222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe 89 PID 800 wrote to memory of 3420 800 cmd.exe 91 PID 800 wrote to memory of 3420 800 cmd.exe 91 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe"C:\Users\Admin\AppData\Local\Temp\222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B73E7983-AA33-419D-BAF8-A90C0C18FA26}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B73E7983-AA33-419D-BAF8-A90C0C18FA26}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3420
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4864
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5a55db6906df9fce8c9143ae77667b484
SHA18ae0329ad3c6de786f63a830440adc084e02adff
SHA2566fa7bb1e97a6145c4f47634b092ace66bbb77085b23f95ebabf3dddbefef740a
SHA512a860225d86dc78bdbbb51aa1cee1372d10047e170468fb6796c50992645ca9253399d6e6374d39ea96a1983980684d2216aff1b0c32300e2eaf91cb3a3ef5953