Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 08:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3f543414b87fbc9cc6084d811984dd332e3fabaaeec3c5dedcd253589a478c2f.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
3f543414b87fbc9cc6084d811984dd332e3fabaaeec3c5dedcd253589a478c2f.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
3f543414b87fbc9cc6084d811984dd332e3fabaaeec3c5dedcd253589a478c2f.exe
-
Size
92KB
-
MD5
fea241bd6e97fa49cdfc05a585941aaf
-
SHA1
29f93d66848c5d999caf526e5a3e687caebc83a5
-
SHA256
3f543414b87fbc9cc6084d811984dd332e3fabaaeec3c5dedcd253589a478c2f
-
SHA512
ca7161d0228d6bb4c7361a74f46a0740f9988d19f4507cc05752e4fc93d72a42cc1877a15b524512fd7064aedfef5d15b865ee080277d3bcc772e8bbb01082cd
-
SSDEEP
1536:n7zwOO0FEJ6kri7hwj4Pnv/rvyvJvSvbvfv3yPHpPGaE:7zwOOW1mmyPpPE
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
meowo.exedescription ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" meowo.exe -
Executes dropped EXE 1 IoCs
Processes:
meowo.exepid Process 1336 meowo.exe -
Loads dropped DLL 2 IoCs
Processes:
3f543414b87fbc9cc6084d811984dd332e3fabaaeec3c5dedcd253589a478c2f.exepid Process 2124 3f543414b87fbc9cc6084d811984dd332e3fabaaeec3c5dedcd253589a478c2f.exe 2124 3f543414b87fbc9cc6084d811984dd332e3fabaaeec3c5dedcd253589a478c2f.exe -
Adds Run key to start application 2 TTPs 50 IoCs
Processes:
meowo.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /L" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /K" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /G" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /l" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /a" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /D" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /W" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /N" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /b" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /h" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /C" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /I" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /S" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /o" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /Y" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /T" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /r" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /g" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /f" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /n" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /q" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /Z" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /A" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /i" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /H" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /U" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /u" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /e" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /Q" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /v" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /X" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /x" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /P" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /d" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /F" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /M" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /E" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /B" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /w" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /y" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /V" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /z" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /m" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /j" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /p" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /O" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /R" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /k" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /J" meowo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\meowo = "C:\\Users\\Admin\\meowo.exe /c" meowo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
meowo.exe3f543414b87fbc9cc6084d811984dd332e3fabaaeec3c5dedcd253589a478c2f.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meowo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3f543414b87fbc9cc6084d811984dd332e3fabaaeec3c5dedcd253589a478c2f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
meowo.exepid Process 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe 1336 meowo.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
3f543414b87fbc9cc6084d811984dd332e3fabaaeec3c5dedcd253589a478c2f.exemeowo.exepid Process 2124 3f543414b87fbc9cc6084d811984dd332e3fabaaeec3c5dedcd253589a478c2f.exe 1336 meowo.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
3f543414b87fbc9cc6084d811984dd332e3fabaaeec3c5dedcd253589a478c2f.exedescription pid Process procid_target PID 2124 wrote to memory of 1336 2124 3f543414b87fbc9cc6084d811984dd332e3fabaaeec3c5dedcd253589a478c2f.exe 31 PID 2124 wrote to memory of 1336 2124 3f543414b87fbc9cc6084d811984dd332e3fabaaeec3c5dedcd253589a478c2f.exe 31 PID 2124 wrote to memory of 1336 2124 3f543414b87fbc9cc6084d811984dd332e3fabaaeec3c5dedcd253589a478c2f.exe 31 PID 2124 wrote to memory of 1336 2124 3f543414b87fbc9cc6084d811984dd332e3fabaaeec3c5dedcd253589a478c2f.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f543414b87fbc9cc6084d811984dd332e3fabaaeec3c5dedcd253589a478c2f.exe"C:\Users\Admin\AppData\Local\Temp\3f543414b87fbc9cc6084d811984dd332e3fabaaeec3c5dedcd253589a478c2f.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\meowo.exe"C:\Users\Admin\meowo.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1336
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5d83aa070280d5da1ce6d82457f5c058f
SHA1f9870ff97f467b7eaddd66e3a3f95b60e6b1b24a
SHA2568139ec5f4b83c92f7272ad72ec1336b74c32acb2309cc8ed67983637413790bb
SHA5126c53d040be13fd01f24be4078c4113f714e09ce3edc2aafab75c5cf01dfa527f90e6fe644accb92008aba6fbd203d4ddecb89f48029fa1bfcf8bbacc73733a06