0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245

Analysis

max time kernel
129s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 12:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe
Size

72KB
MD5

0889ab6d2b5c45c52ee7328b203a4713
SHA1

5dc97543e74b711c9e31b9900c9b81f475fe88ca
SHA256

0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245
SHA512

f8514327552ccbe22c186cdbcea143bf595ddd1357a8c2fd6e37301161617f4ef4022271feff58ab239bcaa8330128f49a03a600c7754d56bed26513f059078f
SSDEEP

384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2y:ipQNwC3BEddsEqOt/hyJF+x3BEJwRru

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 40 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe

Disables RegEdit via registry modification 64 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	data.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe

Executes dropped EXE 61 IoCs

pid	Process
884	backup.exe
1892	backup.exe
1868	backup.exe
268	data.exe
2032	backup.exe
344	backup.exe
1768	backup.exe
1568	backup.exe
1372	backup.exe
2028	backup.exe
1636	System Restore.exe
776	backup.exe
1884	backup.exe
1584	backup.exe
1488	backup.exe
560	backup.exe
1836	backup.exe
1692	data.exe
1732	backup.exe
1620	backup.exe
388	backup.exe
1876	backup.exe
1332	backup.exe
812	backup.exe
2032	backup.exe
1680	backup.exe
576	backup.exe
1144	backup.exe
628	backup.exe
1688	backup.exe
1888	backup.exe
1076	System Restore.exe
1504	backup.exe
1492	backup.exe
1784	backup.exe
588	backup.exe
1040	backup.exe
1560	backup.exe
996	backup.exe
1912	backup.exe
1164	backup.exe
808	backup.exe
1728	backup.exe
1368	update.exe
1824	backup.exe
776	backup.exe
984	backup.exe
680	backup.exe
1680	backup.exe
1952	backup.exe
820	backup.exe
564	backup.exe
928	backup.exe
1804	backup.exe
684	backup.exe
1828	backup.exe
1920	backup.exe
1500	backup.exe
1228	backup.exe
2012	backup.exe
1248	backup.exe

Loads dropped DLL 64 IoCs

pid	Process
1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe
1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe
1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe
1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe
1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe
1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe
1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe
1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe
1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe
1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe
1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe
1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe
1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe
1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe
344	backup.exe
344	backup.exe
1372	backup.exe
1372	backup.exe
344	backup.exe
344	backup.exe
1636	System Restore.exe
1636	System Restore.exe
344	backup.exe
344	backup.exe
1636	System Restore.exe
1636	System Restore.exe
1636	System Restore.exe
344	backup.exe
1636	System Restore.exe
344	backup.exe
776	backup.exe
776	backup.exe
1884	backup.exe
1884	backup.exe
1488	backup.exe
1488	backup.exe
560	backup.exe
560	backup.exe
1620	backup.exe
1620	backup.exe
1692	data.exe
1692	data.exe
1488	backup.exe
1488	backup.exe
1620	backup.exe
1620	backup.exe
1488	backup.exe
1488	backup.exe
388	backup.exe
388	backup.exe
1488	backup.exe
1488	backup.exe
1620	backup.exe
1620	backup.exe
388	backup.exe
388	backup.exe
1620	backup.exe
1620	backup.exe
628	backup.exe
628	backup.exe
1620	backup.exe
1620	backup.exe
1488	backup.exe
1488	backup.exe

Drops file in Program Files directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\backup.exe	System Restore.exe
File opened for modification	C:\Program Files\DVD Maker\backup.exe	System Restore.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe	data.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\de-DE\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Common Files\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\backup.exe	backup.exe
File opened for modification	C:\Program Files\Java\backup.exe	System Restore.exe
File opened for modification	C:\Program Files (x86)\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\en-US\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\es-ES\backup.exe	backup.exe
File opened for modification	C:\Program Files\Google\backup.exe	System Restore.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\backup.exe	backup.exe
File opened for modification	C:\Program Files\System Restore.exe	backup.exe
File opened for modification	C:\Program Files\7-Zip\Lang\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\it-IT\System Restore.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\fr-FR\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\ja-JP\backup.exe	backup.exe
File opened for modification	C:\Program Files\7-Zip\backup.exe	System Restore.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe	backup.exe
File opened for modification	C:\Program Files\Google\Chrome\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Google\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\data.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe	backup.exe
File opened for modification	C:\Program Files\Internet Explorer\backup.exe	System Restore.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\update.exe	backup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe

Suspicious use of SetWindowsHookEx 51 IoCs

pid	Process
1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe
884	backup.exe
1892	backup.exe
1868	backup.exe
268	data.exe
2032	backup.exe
344	backup.exe
1768	backup.exe
1372	backup.exe
1568	backup.exe
2028	backup.exe
1636	System Restore.exe
776	backup.exe
1884	backup.exe
1488	backup.exe
560	backup.exe
1836	backup.exe
1692	data.exe
1732	backup.exe
1620	backup.exe
388	backup.exe
1876	backup.exe
1332	backup.exe
1680	backup.exe
812	backup.exe
2032	backup.exe
576	backup.exe
1144	backup.exe
628	backup.exe
1688	backup.exe
1888	backup.exe
1504	backup.exe
1076	System Restore.exe
1492	backup.exe
1784	backup.exe
588	backup.exe
1040	backup.exe
1560	backup.exe
996	backup.exe
1912	backup.exe
1164	backup.exe
1824	backup.exe
776	backup.exe
1728	backup.exe
808	backup.exe
1680	backup.exe
680	backup.exe
1952	backup.exe
984	backup.exe
820	backup.exe
928	backup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 884	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	27
PID 1904 wrote to memory of 884	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	27
PID 1904 wrote to memory of 884	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	27
PID 1904 wrote to memory of 884	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	27
PID 1904 wrote to memory of 1892	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	28
PID 1904 wrote to memory of 1892	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	28
PID 1904 wrote to memory of 1892	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	28
PID 1904 wrote to memory of 1892	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	28
PID 1904 wrote to memory of 1868	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	29
PID 1904 wrote to memory of 1868	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	29
PID 1904 wrote to memory of 1868	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	29
PID 1904 wrote to memory of 1868	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	29
PID 1904 wrote to memory of 268	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	30
PID 1904 wrote to memory of 268	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	30
PID 1904 wrote to memory of 268	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	30
PID 1904 wrote to memory of 268	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	30
PID 1904 wrote to memory of 2032	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	31
PID 1904 wrote to memory of 2032	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	31
PID 1904 wrote to memory of 2032	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	31
PID 1904 wrote to memory of 2032	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	31
PID 884 wrote to memory of 344	884	backup.exe	32
PID 884 wrote to memory of 344	884	backup.exe	32
PID 884 wrote to memory of 344	884	backup.exe	32
PID 884 wrote to memory of 344	884	backup.exe	32
PID 1904 wrote to memory of 1768	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	33
PID 1904 wrote to memory of 1768	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	33
PID 1904 wrote to memory of 1768	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	33
PID 1904 wrote to memory of 1768	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	33
PID 1904 wrote to memory of 1568	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	34
PID 1904 wrote to memory of 1568	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	34
PID 1904 wrote to memory of 1568	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	34
PID 1904 wrote to memory of 1568	1904	0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe	34
PID 344 wrote to memory of 1372	344	backup.exe	35
PID 344 wrote to memory of 1372	344	backup.exe	35
PID 344 wrote to memory of 1372	344	backup.exe	35
PID 344 wrote to memory of 1372	344	backup.exe	35
PID 1372 wrote to memory of 2028	1372	backup.exe	36
PID 1372 wrote to memory of 2028	1372	backup.exe	36
PID 1372 wrote to memory of 2028	1372	backup.exe	36
PID 1372 wrote to memory of 2028	1372	backup.exe	36
PID 344 wrote to memory of 1636	344	backup.exe	37
PID 344 wrote to memory of 1636	344	backup.exe	37
PID 344 wrote to memory of 1636	344	backup.exe	37
PID 344 wrote to memory of 1636	344	backup.exe	37
PID 1636 wrote to memory of 776	1636	System Restore.exe	38
PID 1636 wrote to memory of 776	1636	System Restore.exe	38
PID 1636 wrote to memory of 776	1636	System Restore.exe	38
PID 1636 wrote to memory of 776	1636	System Restore.exe	38
PID 344 wrote to memory of 1884	344	backup.exe	39
PID 344 wrote to memory of 1884	344	backup.exe	39
PID 344 wrote to memory of 1884	344	backup.exe	39
PID 344 wrote to memory of 1884	344	backup.exe	39
PID 1636 wrote to memory of 1584	1636	System Restore.exe	40
PID 1636 wrote to memory of 1584	1636	System Restore.exe	40
PID 1636 wrote to memory of 1584	1636	System Restore.exe	40
PID 1636 wrote to memory of 1584	1636	System Restore.exe	40
PID 1636 wrote to memory of 1488	1636	System Restore.exe	41
PID 1636 wrote to memory of 1488	1636	System Restore.exe	41
PID 1636 wrote to memory of 1488	1636	System Restore.exe	41
PID 1636 wrote to memory of 1488	1636	System Restore.exe	41
PID 344 wrote to memory of 560	344	backup.exe	42
PID 344 wrote to memory of 560	344	backup.exe	42
PID 344 wrote to memory of 560	344	backup.exe	42
PID 344 wrote to memory of 560	344	backup.exe	42

System policy modification 1 TTPs 64 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	System Restore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	System Restore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	System Restore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	System Restore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	data.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	data.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe

C:\Users\Admin\AppData\Local\Temp\0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe
"C:\Users\Admin\AppData\Local\Temp\0fc11e71881fbf67f6906dde16e6587a72103fbe6ae7fe9804b9f241ffbf7245.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Local\Temp\1049630786\backup.exe
  C:\Users\Admin\AppData\Local\Temp\1049630786\backup.exe C:\Users\Admin\AppData\Local\Temp\1049630786\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:884
- - C:\backup.exe
    \backup.exe \
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:344
  - - C:\PerfLogs\backup.exe
      C:\PerfLogs\backup.exe C:\PerfLogs\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1372
    - - C:\PerfLogs\Admin\backup.exe
        
        C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2028
  - - C:\Program Files\System Restore.exe
      "C:\Program Files\System Restore.exe" C:\Program Files\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1636
    - - C:\Program Files\7-Zip\backup.exe
        
        "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:776
      - C:\Program Files\7-Zip\Lang\backup.exe
        
        "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1836
    - - C:\Program Files\Common Files\backup.exe
        
        "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
        5⤵
        Executes dropped EXE
        
        PID:1584
    - - C:\Program Files\DVD Maker\backup.exe
        
        "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1488
      - C:\Program Files\DVD Maker\de-DE\backup.exe
        
        "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1732
      - C:\Program Files\DVD Maker\en-US\backup.exe
        
        "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1332
      - C:\Program Files\DVD Maker\es-ES\backup.exe
        
        "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1680
      - C:\Program Files\DVD Maker\fr-FR\backup.exe
        
        "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:576
      - C:\Program Files\DVD Maker\it-IT\System Restore.exe
        
        "C:\Program Files\DVD Maker\it-IT\System Restore.exe" C:\Program Files\DVD Maker\it-IT\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1076
      - C:\Program Files\DVD Maker\ja-JP\backup.exe
        
        "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1492
      - C:\Program Files\DVD Maker\Shared\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1040
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
        7⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1728
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
        8⤵
        Executes dropped EXE
        
        PID:1804
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\
        8⤵
        Executes dropped EXE
        
        PID:1500
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\
        8⤵
        
        PID:1380
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\
        8⤵
        
        PID:1040
    - - C:\Program Files\Google\backup.exe
        
        "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1560
      - C:\Program Files\Google\Chrome\backup.exe
        
        "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:808
    - - C:\Program Files\Internet Explorer\backup.exe
        
        "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
        5⤵
        Executes dropped EXE
        
        PID:564
    - - C:\Program Files\Java\backup.exe
        
        "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
        5⤵
        Executes dropped EXE
        
        PID:1920
    - - C:\Program Files\Microsoft Games\backup.exe
        
        "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
        5⤵
        
        PID:1712
    - - C:\Program Files\Microsoft Office\backup.exe
        
        "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
        5⤵
        
        PID:1768
  - - C:\Program Files (x86)\backup.exe
      "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:1884
    - - C:\Program Files (x86)\Adobe\data.exe
        
        "C:\Program Files (x86)\Adobe\data.exe" C:\Program Files (x86)\Adobe\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1692
      - C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:388
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
        7⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2032
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
        7⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:628
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1888
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
        8⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1784
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
        8⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:588
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
        8⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:996
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
        9⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:928
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1680
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
        8⤵
        Executes dropped EXE
        
        PID:1248
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
        8⤵
        
        PID:1628
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
        8⤵
        
        PID:1088
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
        7⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1824
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
        8⤵
        Executes dropped EXE
        
        PID:684
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\
        8⤵
        
        PID:1716
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\
        8⤵
        
        PID:812
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1952
    - - C:\Program Files (x86)\Common Files\backup.exe
        
        "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1164
    - - C:\Program Files (x86)\Google\backup.exe
        
        "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:680
    - - C:\Program Files (x86)\Internet Explorer\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
        5⤵
        Executes dropped EXE
        
        PID:1828
    - - C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
        
        "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
        5⤵
        
        PID:1748
    - - C:\Program Files (x86)\Microsoft Office\backup.exe
        
        "C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
        5⤵
        
        PID:1796
  - - C:\Users\backup.exe
      C:\Users\backup.exe C:\Users\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:560
    - - C:\Users\Admin\backup.exe
        
        C:\Users\Admin\backup.exe C:\Users\Admin\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1620
      - C:\Users\Admin\Contacts\backup.exe
        
        C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1876
      - C:\Users\Admin\Desktop\backup.exe
        
        C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:812
      - C:\Users\Admin\Documents\backup.exe
        
        C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1144
      - C:\Users\Admin\Downloads\backup.exe
        
        C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1688
      - C:\Users\Admin\Favorites\backup.exe
        
        C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1504
      - C:\Users\Admin\Links\backup.exe
        
        C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:820
      - C:\Users\Admin\Music\backup.exe
        
        C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
        6⤵
        Executes dropped EXE
        
        PID:1228
      - C:\Users\Admin\Pictures\backup.exe
        
        C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
        6⤵
        
        PID:1956
      - C:\Users\Admin\Saved Games\backup.exe
        
        "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
        6⤵
        
        PID:1752
      - C:\Users\Admin\Searches\data.exe
        
        C:\Users\Admin\Searches\data.exe C:\Users\Admin\Searches\
        6⤵
        
        PID:916
    - - C:\Users\Public\backup.exe
        
        C:\Users\Public\backup.exe C:\Users\Public\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1912
      - C:\Users\Public\Documents\backup.exe
        
        C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:776
      - C:\Users\Public\Downloads\backup.exe
        
        C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:984
      - C:\Users\Public\Music\backup.exe
        
        C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
        6⤵
        Executes dropped EXE
        
        PID:2012
      - C:\Users\Public\Pictures\backup.exe
        
        C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
        6⤵
        
        PID:1556
      - C:\Users\Public\Recorded TV\backup.exe
        
        "C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\
        6⤵
        
        PID:1732
      - C:\Users\Public\Videos\backup.exe
        
        C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
        6⤵
        
        PID:560
  - - C:\Windows\update.exe
      C:\Windows\update.exe C:\Windows\
      4⤵
      Executes dropped EXE
      PID:1368
- C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1892
- C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1868
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:268
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:2032
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1768
- C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
  C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
df4510129900bcad6553033081b95133

SHA1
ca457f337ea6df06f0e82a26fb379686646325ae

SHA256
f704e213dcd8b102842d63cd8d4ee430fdf61072ebf48f743727d6bc2ae93262

SHA512
5897bc1e50b98590ab5146f1b172f5521619c9128a6be5525e149ecca986980f6b043f9adc21fcda50c4ec3d8eaf25d24e36617611967659d5eb9efbf94755c5

Download Submit
C:\PerfLogs\backup.exe

Filesize
72KB

MD5
d14846b5f05fdf5f504833d805deba5f

SHA1
d11a77d9b09f9be2a2a4be64b768bb6371b0f852

SHA256
13885769984b535f0582cbd8255186703ea9047894bbdff751ab109ce1afa1e3

SHA512
956e61e1dfb10398c30b30b265c662623f81f4443dca6fcea29199cbe017c782a5a7a50443e1cd3d7cb7b7cdc69511854b0d229e4fb40dd753188c5a5b92fbfa

Download Submit
C:\PerfLogs\backup.exe

Filesize
72KB

MD5
d14846b5f05fdf5f504833d805deba5f

SHA1
d11a77d9b09f9be2a2a4be64b768bb6371b0f852

SHA256
13885769984b535f0582cbd8255186703ea9047894bbdff751ab109ce1afa1e3

SHA512
956e61e1dfb10398c30b30b265c662623f81f4443dca6fcea29199cbe017c782a5a7a50443e1cd3d7cb7b7cdc69511854b0d229e4fb40dd753188c5a5b92fbfa

Download Submit
C:\Program Files (x86)\Adobe\data.exe

Filesize
72KB

MD5
8830ff1e425ffdeface0f4947fcaa27a

SHA1
d60f21a47993f2ceaa68250ad87af7bd995b5ea0

SHA256
a574ec7034296b3f60d8ef4bea364db2d271951066f6f7c02460fb63bf5851b9

SHA512
03ad2c3b1cdf316a8181bab61cab96e67cdfef3a73441f277d438b6744dbe193eba993892dee6b2f25dbb8b316ca508338b1cd1938d626ffd3dfd619be0d6252

Download Submit
C:\Program Files (x86)\backup.exe

Filesize
72KB

MD5
c9a472722c9ec1f6fcfa9888fb27be8e

SHA1
ab599aa7c53029412328a1ee4ee5d6b317799dda

SHA256
369f94b0a12272dccb599f13c50a01e58156b5b045ec1c1b8b6de3d845ed6184

SHA512
3145816a7c88e8fb609210c0c9d8e7ee4ff7e52900b38f4605217a5b1c29f2c08268f943f2fc9ea61421715f10dbe35fdd225532e9011dfebf3e7bb7e6a8383b

Download Submit
C:\Program Files (x86)\backup.exe

Filesize
72KB

MD5
c9a472722c9ec1f6fcfa9888fb27be8e

SHA1
ab599aa7c53029412328a1ee4ee5d6b317799dda

SHA256
369f94b0a12272dccb599f13c50a01e58156b5b045ec1c1b8b6de3d845ed6184

SHA512
3145816a7c88e8fb609210c0c9d8e7ee4ff7e52900b38f4605217a5b1c29f2c08268f943f2fc9ea61421715f10dbe35fdd225532e9011dfebf3e7bb7e6a8383b

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
106989c4fe1019576cef763bda95c5aa

SHA1
1ea01c88333f3ec570497e876f39536144a95ec7

SHA256
946e18989133d5c874aa765fae09656f11deee7a14d390980ea3699057bdfcc5

SHA512
428878639a9ebea8367125fcba101323bd05263ff3f12b9493741fd4741d24acbde792430face0082924c6bd7fe2d763d6d6fcfc754e57df99cd1357f8392f55

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
906941fcea9a7e1194ca939b501361aa

SHA1
3fb5fa36e4201378aa4eb19509f085aa172c4155

SHA256
6bd8d909d915a270244fd7e7831c1407a6bda9b0141cf9633c0db1ff17a743ce

SHA512
ce32eeb696775ced653af7e9d086d0f97fea9e29ef2ce4dc3a460983f175bc25adb8a0f9b2b3d32d3947d3244f6021b73d2af00524ef8c264c4a77462bcb2899

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
906941fcea9a7e1194ca939b501361aa

SHA1
3fb5fa36e4201378aa4eb19509f085aa172c4155

SHA256
6bd8d909d915a270244fd7e7831c1407a6bda9b0141cf9633c0db1ff17a743ce

SHA512
ce32eeb696775ced653af7e9d086d0f97fea9e29ef2ce4dc3a460983f175bc25adb8a0f9b2b3d32d3947d3244f6021b73d2af00524ef8c264c4a77462bcb2899

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
2bf4457f98da959d8fbf53c44f3ee120

SHA1
de84e0c5a31625218005ddb10c83c5b1ef05c6a3

SHA256
dd478ea05e7b46fea3a866eb6f6ecbc91c12a179c3acf03d7582f0a26d898c02

SHA512
8c74aec9565dff9c9a7638960976ee06a5a6183aff9e9bd74af2865fb262520c7b41d9f0a17d224b6517b0c07822b403b61f4b469763e4c001a9928f08e1bbbe

Download Submit
C:\Program Files\DVD Maker\backup.exe

Filesize
72KB

MD5
14dfb11b0d898de39cab946f454d5cc2

SHA1
c64ba141733faff1fbc17aba1e9f05d2de611026

SHA256
6747a46b6b12510305f75fec15f1f19d57e7570849e03b17c6f552826742dd67

SHA512
bd9c60781eb3362cf648f984f78b06b623ebdb2db918a46edf70af10b2cf111bbd5d4b27807343276ec5fe52aa7fcfdd2d86cce651d9edc96ff02e5293592156

Download Submit
C:\Program Files\DVD Maker\backup.exe

Filesize
72KB

MD5
14dfb11b0d898de39cab946f454d5cc2

SHA1
c64ba141733faff1fbc17aba1e9f05d2de611026

SHA256
6747a46b6b12510305f75fec15f1f19d57e7570849e03b17c6f552826742dd67

SHA512
bd9c60781eb3362cf648f984f78b06b623ebdb2db918a46edf70af10b2cf111bbd5d4b27807343276ec5fe52aa7fcfdd2d86cce651d9edc96ff02e5293592156

Download Submit
C:\Program Files\System Restore.exe

Filesize
72KB

MD5
4c4cd85b1ea929818ae01a70cf605216

SHA1
60d93b422e2f57646c0c09d549b936ae8ab87813

SHA256
779efd029a7d183c4c4a7b5ad818593766ef4f62cb5bd567afcefb086ffe4c1f

SHA512
1075108a0e73e3aa722055b4d0d167c971b4499c865bf49e003acde76bf606858ee0ddf585a5e291e47f753198bca0bcf74bfb4797e7a10fdf3aec776a22db36

Download Submit
C:\Program Files\System Restore.exe

Filesize
72KB

MD5
4c4cd85b1ea929818ae01a70cf605216

SHA1
60d93b422e2f57646c0c09d549b936ae8ab87813

SHA256
779efd029a7d183c4c4a7b5ad818593766ef4f62cb5bd567afcefb086ffe4c1f

SHA512
1075108a0e73e3aa722055b4d0d167c971b4499c865bf49e003acde76bf606858ee0ddf585a5e291e47f753198bca0bcf74bfb4797e7a10fdf3aec776a22db36

Download Submit
C:\Users\Admin\AppData\Local\Temp\1049630786\backup.exe

Filesize
72KB

MD5
ac7c1b87c2ee4764863b8dd105065cb0

SHA1
7735c62bdf037861b51c45b7b361ae8c9db7a853

SHA256
8dccc75f92db40b2b5b3224c44245dbd9f3727c2920e2ebc6914f84c6146223f

SHA512
49ad5e32f7e8af312b10e3cb1546b3de7c2e49d79883832d8e4114fe4dd91eed9da1075015f966bbae64d66a5f6c074a6a2bde9412d3917613b5a0d80eb139f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1049630786\backup.exe

Filesize
72KB

MD5
ac7c1b87c2ee4764863b8dd105065cb0

SHA1
7735c62bdf037861b51c45b7b361ae8c9db7a853

SHA256
8dccc75f92db40b2b5b3224c44245dbd9f3727c2920e2ebc6914f84c6146223f

SHA512
49ad5e32f7e8af312b10e3cb1546b3de7c2e49d79883832d8e4114fe4dd91eed9da1075015f966bbae64d66a5f6c074a6a2bde9412d3917613b5a0d80eb139f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
a81c1891323188bd2f2208ba6f81a92f

SHA1
0b53ea9b6ca3d798002a5719f894b20ebb1a62fe

SHA256
7b464688375e9552bac0c8a89ff3ca8a612825a07835ff0f7f272c03fdd87a07

SHA512
99cced45d555031665434cdaf95847bde0b718b875b4c30758c1419103a64cb1e7e4d0931c1194c57169f34ce68c6a1338c5c7a92d1e6471c9c56a5e2022737e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe

Filesize
72KB

MD5
a81c1891323188bd2f2208ba6f81a92f

SHA1
0b53ea9b6ca3d798002a5719f894b20ebb1a62fe

SHA256
7b464688375e9552bac0c8a89ff3ca8a612825a07835ff0f7f272c03fdd87a07

SHA512
99cced45d555031665434cdaf95847bde0b718b875b4c30758c1419103a64cb1e7e4d0931c1194c57169f34ce68c6a1338c5c7a92d1e6471c9c56a5e2022737e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
568bf3912019daec64ed71a8028007c3

SHA1
61f17a93ed05cf73ddc61d15aa87cdb9f5d72ac5

SHA256
bf774f3dd251083e46ab56c116b79275bfa83f4678d21016e9b20b2fc2c86ebc

SHA512
291b86357d7955a2506be3be9db6b8c903af37a63a50c042a874e89f9d538c09ddd9d4b1492dbe27331c099c6f4b3b2e5d985108948a3aafd6fdfa907677d39a

Download Submit
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
568bf3912019daec64ed71a8028007c3

SHA1
61f17a93ed05cf73ddc61d15aa87cdb9f5d72ac5

SHA256
bf774f3dd251083e46ab56c116b79275bfa83f4678d21016e9b20b2fc2c86ebc

SHA512
291b86357d7955a2506be3be9db6b8c903af37a63a50c042a874e89f9d538c09ddd9d4b1492dbe27331c099c6f4b3b2e5d985108948a3aafd6fdfa907677d39a

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
ac7c1b87c2ee4764863b8dd105065cb0

SHA1
7735c62bdf037861b51c45b7b361ae8c9db7a853

SHA256
8dccc75f92db40b2b5b3224c44245dbd9f3727c2920e2ebc6914f84c6146223f

SHA512
49ad5e32f7e8af312b10e3cb1546b3de7c2e49d79883832d8e4114fe4dd91eed9da1075015f966bbae64d66a5f6c074a6a2bde9412d3917613b5a0d80eb139f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
568bf3912019daec64ed71a8028007c3

SHA1
61f17a93ed05cf73ddc61d15aa87cdb9f5d72ac5

SHA256
bf774f3dd251083e46ab56c116b79275bfa83f4678d21016e9b20b2fc2c86ebc

SHA512
291b86357d7955a2506be3be9db6b8c903af37a63a50c042a874e89f9d538c09ddd9d4b1492dbe27331c099c6f4b3b2e5d985108948a3aafd6fdfa907677d39a

Download Submit
C:\Users\backup.exe

Filesize
72KB

MD5
ec761d369e7be2e561a02dce0d50fce2

SHA1
b5ea51b5b54a0ea98549d577181983f4d8c6bd50

SHA256
a8249b4e5459130beb5bb6c7c36ce7e1af1129c40177b359f9590be010591686

SHA512
1c764e15bf780e69d2827fc5dc34738e0b619df132d84786e70bdd9c08d44766db9b13111650695bb70ccdf8f34f76326177abf5d28a17711dcbc9e2546293e9

Download Submit
C:\Users\backup.exe

Filesize
72KB

MD5
ec761d369e7be2e561a02dce0d50fce2

SHA1
b5ea51b5b54a0ea98549d577181983f4d8c6bd50

SHA256
a8249b4e5459130beb5bb6c7c36ce7e1af1129c40177b359f9590be010591686

SHA512
1c764e15bf780e69d2827fc5dc34738e0b619df132d84786e70bdd9c08d44766db9b13111650695bb70ccdf8f34f76326177abf5d28a17711dcbc9e2546293e9

Download Submit
C:\backup.exe

Filesize
72KB

MD5
fcaf331b441135555e9e34c331223b4b

SHA1
8958d2c5bfe976263dfff7b9699d772a0b8cae85

SHA256
4290a348272107008b4fecf5956b52480cb2f005b51d860782228d12f56c106c

SHA512
a30111167b778c1ba5c2a354e0a00b4861e4a83f4ed1e45222c28b6d3f88bc0a2163ce76b652fa0bfa7ab4dbfd86dd17dd1d155f12d92a03dbd979a342efe506

Download Submit
C:\backup.exe

Filesize
72KB

MD5
fcaf331b441135555e9e34c331223b4b

SHA1
8958d2c5bfe976263dfff7b9699d772a0b8cae85

SHA256
4290a348272107008b4fecf5956b52480cb2f005b51d860782228d12f56c106c

SHA512
a30111167b778c1ba5c2a354e0a00b4861e4a83f4ed1e45222c28b6d3f88bc0a2163ce76b652fa0bfa7ab4dbfd86dd17dd1d155f12d92a03dbd979a342efe506

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
df4510129900bcad6553033081b95133

SHA1
ca457f337ea6df06f0e82a26fb379686646325ae

SHA256
f704e213dcd8b102842d63cd8d4ee430fdf61072ebf48f743727d6bc2ae93262

SHA512
5897bc1e50b98590ab5146f1b172f5521619c9128a6be5525e149ecca986980f6b043f9adc21fcda50c4ec3d8eaf25d24e36617611967659d5eb9efbf94755c5

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
df4510129900bcad6553033081b95133

SHA1
ca457f337ea6df06f0e82a26fb379686646325ae

SHA256
f704e213dcd8b102842d63cd8d4ee430fdf61072ebf48f743727d6bc2ae93262

SHA512
5897bc1e50b98590ab5146f1b172f5521619c9128a6be5525e149ecca986980f6b043f9adc21fcda50c4ec3d8eaf25d24e36617611967659d5eb9efbf94755c5

Download Submit
\PerfLogs\backup.exe

Filesize
72KB

MD5
d14846b5f05fdf5f504833d805deba5f

SHA1
d11a77d9b09f9be2a2a4be64b768bb6371b0f852

SHA256
13885769984b535f0582cbd8255186703ea9047894bbdff751ab109ce1afa1e3

SHA512
956e61e1dfb10398c30b30b265c662623f81f4443dca6fcea29199cbe017c782a5a7a50443e1cd3d7cb7b7cdc69511854b0d229e4fb40dd753188c5a5b92fbfa

Download Submit
\PerfLogs\backup.exe

Filesize
72KB

MD5
d14846b5f05fdf5f504833d805deba5f

SHA1
d11a77d9b09f9be2a2a4be64b768bb6371b0f852

SHA256
13885769984b535f0582cbd8255186703ea9047894bbdff751ab109ce1afa1e3

SHA512
956e61e1dfb10398c30b30b265c662623f81f4443dca6fcea29199cbe017c782a5a7a50443e1cd3d7cb7b7cdc69511854b0d229e4fb40dd753188c5a5b92fbfa

Download Submit
\Program Files (x86)\Adobe\data.exe

Filesize
72KB

MD5
8830ff1e425ffdeface0f4947fcaa27a

SHA1
d60f21a47993f2ceaa68250ad87af7bd995b5ea0

SHA256
a574ec7034296b3f60d8ef4bea364db2d271951066f6f7c02460fb63bf5851b9

SHA512
03ad2c3b1cdf316a8181bab61cab96e67cdfef3a73441f277d438b6744dbe193eba993892dee6b2f25dbb8b316ca508338b1cd1938d626ffd3dfd619be0d6252

Download Submit
\Program Files (x86)\Adobe\data.exe

Filesize
72KB

MD5
8830ff1e425ffdeface0f4947fcaa27a

SHA1
d60f21a47993f2ceaa68250ad87af7bd995b5ea0

SHA256
a574ec7034296b3f60d8ef4bea364db2d271951066f6f7c02460fb63bf5851b9

SHA512
03ad2c3b1cdf316a8181bab61cab96e67cdfef3a73441f277d438b6744dbe193eba993892dee6b2f25dbb8b316ca508338b1cd1938d626ffd3dfd619be0d6252

Download Submit
\Program Files (x86)\backup.exe

Filesize
72KB

MD5
c9a472722c9ec1f6fcfa9888fb27be8e

SHA1
ab599aa7c53029412328a1ee4ee5d6b317799dda

SHA256
369f94b0a12272dccb599f13c50a01e58156b5b045ec1c1b8b6de3d845ed6184

SHA512
3145816a7c88e8fb609210c0c9d8e7ee4ff7e52900b38f4605217a5b1c29f2c08268f943f2fc9ea61421715f10dbe35fdd225532e9011dfebf3e7bb7e6a8383b

Download Submit
\Program Files (x86)\backup.exe

Filesize
72KB

MD5
c9a472722c9ec1f6fcfa9888fb27be8e

SHA1
ab599aa7c53029412328a1ee4ee5d6b317799dda

SHA256
369f94b0a12272dccb599f13c50a01e58156b5b045ec1c1b8b6de3d845ed6184

SHA512
3145816a7c88e8fb609210c0c9d8e7ee4ff7e52900b38f4605217a5b1c29f2c08268f943f2fc9ea61421715f10dbe35fdd225532e9011dfebf3e7bb7e6a8383b

Download Submit
\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
106989c4fe1019576cef763bda95c5aa

SHA1
1ea01c88333f3ec570497e876f39536144a95ec7

SHA256
946e18989133d5c874aa765fae09656f11deee7a14d390980ea3699057bdfcc5

SHA512
428878639a9ebea8367125fcba101323bd05263ff3f12b9493741fd4741d24acbde792430face0082924c6bd7fe2d763d6d6fcfc754e57df99cd1357f8392f55

Download Submit
\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
106989c4fe1019576cef763bda95c5aa

SHA1
1ea01c88333f3ec570497e876f39536144a95ec7

SHA256
946e18989133d5c874aa765fae09656f11deee7a14d390980ea3699057bdfcc5

SHA512
428878639a9ebea8367125fcba101323bd05263ff3f12b9493741fd4741d24acbde792430face0082924c6bd7fe2d763d6d6fcfc754e57df99cd1357f8392f55

Download Submit
\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
906941fcea9a7e1194ca939b501361aa

SHA1
3fb5fa36e4201378aa4eb19509f085aa172c4155

SHA256
6bd8d909d915a270244fd7e7831c1407a6bda9b0141cf9633c0db1ff17a743ce

SHA512
ce32eeb696775ced653af7e9d086d0f97fea9e29ef2ce4dc3a460983f175bc25adb8a0f9b2b3d32d3947d3244f6021b73d2af00524ef8c264c4a77462bcb2899

Download Submit
\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
906941fcea9a7e1194ca939b501361aa

SHA1
3fb5fa36e4201378aa4eb19509f085aa172c4155

SHA256
6bd8d909d915a270244fd7e7831c1407a6bda9b0141cf9633c0db1ff17a743ce

SHA512
ce32eeb696775ced653af7e9d086d0f97fea9e29ef2ce4dc3a460983f175bc25adb8a0f9b2b3d32d3947d3244f6021b73d2af00524ef8c264c4a77462bcb2899

Download Submit
\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
2bf4457f98da959d8fbf53c44f3ee120

SHA1
de84e0c5a31625218005ddb10c83c5b1ef05c6a3

SHA256
dd478ea05e7b46fea3a866eb6f6ecbc91c12a179c3acf03d7582f0a26d898c02

SHA512
8c74aec9565dff9c9a7638960976ee06a5a6183aff9e9bd74af2865fb262520c7b41d9f0a17d224b6517b0c07822b403b61f4b469763e4c001a9928f08e1bbbe

Download Submit
\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
2bf4457f98da959d8fbf53c44f3ee120

SHA1
de84e0c5a31625218005ddb10c83c5b1ef05c6a3

SHA256
dd478ea05e7b46fea3a866eb6f6ecbc91c12a179c3acf03d7582f0a26d898c02

SHA512
8c74aec9565dff9c9a7638960976ee06a5a6183aff9e9bd74af2865fb262520c7b41d9f0a17d224b6517b0c07822b403b61f4b469763e4c001a9928f08e1bbbe

Download Submit
\Program Files\DVD Maker\backup.exe

Filesize
72KB

MD5
14dfb11b0d898de39cab946f454d5cc2

SHA1
c64ba141733faff1fbc17aba1e9f05d2de611026

SHA256
6747a46b6b12510305f75fec15f1f19d57e7570849e03b17c6f552826742dd67

SHA512
bd9c60781eb3362cf648f984f78b06b623ebdb2db918a46edf70af10b2cf111bbd5d4b27807343276ec5fe52aa7fcfdd2d86cce651d9edc96ff02e5293592156

Download Submit
\Program Files\DVD Maker\backup.exe

Filesize
72KB

MD5
14dfb11b0d898de39cab946f454d5cc2

SHA1
c64ba141733faff1fbc17aba1e9f05d2de611026

SHA256
6747a46b6b12510305f75fec15f1f19d57e7570849e03b17c6f552826742dd67

SHA512
bd9c60781eb3362cf648f984f78b06b623ebdb2db918a46edf70af10b2cf111bbd5d4b27807343276ec5fe52aa7fcfdd2d86cce651d9edc96ff02e5293592156

Download Submit
\Program Files\DVD Maker\de-DE\backup.exe

Filesize
72KB

MD5
cc103713e584602ba517d55609acb715

SHA1
84933f3101b427cbd921d11ff61a01525f2c467f

SHA256
e279c715e5c02cd0169e2b74c9184efd91df060ada907055dea95f2a4d4416e2

SHA512
f8b06028fd7d51a7e3429ad3d69ba5bddaffd81a3d413d5624addb0292e1f83291f673a07d633cb551dd32d9fdc8d0db4198f4e83b7be7e2e789e416bd5c9f2c

Download Submit
\Program Files\DVD Maker\de-DE\backup.exe

Filesize
72KB

MD5
cc103713e584602ba517d55609acb715

SHA1
84933f3101b427cbd921d11ff61a01525f2c467f

SHA256
e279c715e5c02cd0169e2b74c9184efd91df060ada907055dea95f2a4d4416e2

SHA512
f8b06028fd7d51a7e3429ad3d69ba5bddaffd81a3d413d5624addb0292e1f83291f673a07d633cb551dd32d9fdc8d0db4198f4e83b7be7e2e789e416bd5c9f2c

Download Submit
\Program Files\System Restore.exe

Filesize
72KB

MD5
4c4cd85b1ea929818ae01a70cf605216

SHA1
60d93b422e2f57646c0c09d549b936ae8ab87813

SHA256
779efd029a7d183c4c4a7b5ad818593766ef4f62cb5bd567afcefb086ffe4c1f

SHA512
1075108a0e73e3aa722055b4d0d167c971b4499c865bf49e003acde76bf606858ee0ddf585a5e291e47f753198bca0bcf74bfb4797e7a10fdf3aec776a22db36

Download Submit
\Program Files\System Restore.exe

Filesize
72KB

MD5
4c4cd85b1ea929818ae01a70cf605216

SHA1
60d93b422e2f57646c0c09d549b936ae8ab87813

SHA256
779efd029a7d183c4c4a7b5ad818593766ef4f62cb5bd567afcefb086ffe4c1f

SHA512
1075108a0e73e3aa722055b4d0d167c971b4499c865bf49e003acde76bf606858ee0ddf585a5e291e47f753198bca0bcf74bfb4797e7a10fdf3aec776a22db36

Download Submit
\Users\Admin\AppData\Local\Temp\1049630786\backup.exe

Filesize
72KB

MD5
ac7c1b87c2ee4764863b8dd105065cb0

SHA1
7735c62bdf037861b51c45b7b361ae8c9db7a853

SHA256
8dccc75f92db40b2b5b3224c44245dbd9f3727c2920e2ebc6914f84c6146223f

SHA512
49ad5e32f7e8af312b10e3cb1546b3de7c2e49d79883832d8e4114fe4dd91eed9da1075015f966bbae64d66a5f6c074a6a2bde9412d3917613b5a0d80eb139f4

Download Submit
\Users\Admin\AppData\Local\Temp\1049630786\backup.exe

Filesize
72KB

MD5
ac7c1b87c2ee4764863b8dd105065cb0

SHA1
7735c62bdf037861b51c45b7b361ae8c9db7a853

SHA256
8dccc75f92db40b2b5b3224c44245dbd9f3727c2920e2ebc6914f84c6146223f

SHA512
49ad5e32f7e8af312b10e3cb1546b3de7c2e49d79883832d8e4114fe4dd91eed9da1075015f966bbae64d66a5f6c074a6a2bde9412d3917613b5a0d80eb139f4

Download Submit
\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
a81c1891323188bd2f2208ba6f81a92f

SHA1
0b53ea9b6ca3d798002a5719f894b20ebb1a62fe

SHA256
7b464688375e9552bac0c8a89ff3ca8a612825a07835ff0f7f272c03fdd87a07

SHA512
99cced45d555031665434cdaf95847bde0b718b875b4c30758c1419103a64cb1e7e4d0931c1194c57169f34ce68c6a1338c5c7a92d1e6471c9c56a5e2022737e

Download Submit
\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
a81c1891323188bd2f2208ba6f81a92f

SHA1
0b53ea9b6ca3d798002a5719f894b20ebb1a62fe

SHA256
7b464688375e9552bac0c8a89ff3ca8a612825a07835ff0f7f272c03fdd87a07

SHA512
99cced45d555031665434cdaf95847bde0b718b875b4c30758c1419103a64cb1e7e4d0931c1194c57169f34ce68c6a1338c5c7a92d1e6471c9c56a5e2022737e

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe

Filesize
72KB

MD5
a81c1891323188bd2f2208ba6f81a92f

SHA1
0b53ea9b6ca3d798002a5719f894b20ebb1a62fe

SHA256
7b464688375e9552bac0c8a89ff3ca8a612825a07835ff0f7f272c03fdd87a07

SHA512
99cced45d555031665434cdaf95847bde0b718b875b4c30758c1419103a64cb1e7e4d0931c1194c57169f34ce68c6a1338c5c7a92d1e6471c9c56a5e2022737e

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe

Filesize
72KB

MD5
a81c1891323188bd2f2208ba6f81a92f

SHA1
0b53ea9b6ca3d798002a5719f894b20ebb1a62fe

SHA256
7b464688375e9552bac0c8a89ff3ca8a612825a07835ff0f7f272c03fdd87a07

SHA512
99cced45d555031665434cdaf95847bde0b718b875b4c30758c1419103a64cb1e7e4d0931c1194c57169f34ce68c6a1338c5c7a92d1e6471c9c56a5e2022737e

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
568bf3912019daec64ed71a8028007c3

SHA1
61f17a93ed05cf73ddc61d15aa87cdb9f5d72ac5

SHA256
bf774f3dd251083e46ab56c116b79275bfa83f4678d21016e9b20b2fc2c86ebc

SHA512
291b86357d7955a2506be3be9db6b8c903af37a63a50c042a874e89f9d538c09ddd9d4b1492dbe27331c099c6f4b3b2e5d985108948a3aafd6fdfa907677d39a

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
568bf3912019daec64ed71a8028007c3

SHA1
61f17a93ed05cf73ddc61d15aa87cdb9f5d72ac5

SHA256
bf774f3dd251083e46ab56c116b79275bfa83f4678d21016e9b20b2fc2c86ebc

SHA512
291b86357d7955a2506be3be9db6b8c903af37a63a50c042a874e89f9d538c09ddd9d4b1492dbe27331c099c6f4b3b2e5d985108948a3aafd6fdfa907677d39a

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
568bf3912019daec64ed71a8028007c3

SHA1
61f17a93ed05cf73ddc61d15aa87cdb9f5d72ac5

SHA256
bf774f3dd251083e46ab56c116b79275bfa83f4678d21016e9b20b2fc2c86ebc

SHA512
291b86357d7955a2506be3be9db6b8c903af37a63a50c042a874e89f9d538c09ddd9d4b1492dbe27331c099c6f4b3b2e5d985108948a3aafd6fdfa907677d39a

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
568bf3912019daec64ed71a8028007c3

SHA1
61f17a93ed05cf73ddc61d15aa87cdb9f5d72ac5

SHA256
bf774f3dd251083e46ab56c116b79275bfa83f4678d21016e9b20b2fc2c86ebc

SHA512
291b86357d7955a2506be3be9db6b8c903af37a63a50c042a874e89f9d538c09ddd9d4b1492dbe27331c099c6f4b3b2e5d985108948a3aafd6fdfa907677d39a

Download Submit
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
ac7c1b87c2ee4764863b8dd105065cb0

SHA1
7735c62bdf037861b51c45b7b361ae8c9db7a853

SHA256
8dccc75f92db40b2b5b3224c44245dbd9f3727c2920e2ebc6914f84c6146223f

SHA512
49ad5e32f7e8af312b10e3cb1546b3de7c2e49d79883832d8e4114fe4dd91eed9da1075015f966bbae64d66a5f6c074a6a2bde9412d3917613b5a0d80eb139f4

Download Submit
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
ac7c1b87c2ee4764863b8dd105065cb0

SHA1
7735c62bdf037861b51c45b7b361ae8c9db7a853

SHA256
8dccc75f92db40b2b5b3224c44245dbd9f3727c2920e2ebc6914f84c6146223f

SHA512
49ad5e32f7e8af312b10e3cb1546b3de7c2e49d79883832d8e4114fe4dd91eed9da1075015f966bbae64d66a5f6c074a6a2bde9412d3917613b5a0d80eb139f4

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
568bf3912019daec64ed71a8028007c3

SHA1
61f17a93ed05cf73ddc61d15aa87cdb9f5d72ac5

SHA256
bf774f3dd251083e46ab56c116b79275bfa83f4678d21016e9b20b2fc2c86ebc

SHA512
291b86357d7955a2506be3be9db6b8c903af37a63a50c042a874e89f9d538c09ddd9d4b1492dbe27331c099c6f4b3b2e5d985108948a3aafd6fdfa907677d39a

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
568bf3912019daec64ed71a8028007c3

SHA1
61f17a93ed05cf73ddc61d15aa87cdb9f5d72ac5

SHA256
bf774f3dd251083e46ab56c116b79275bfa83f4678d21016e9b20b2fc2c86ebc

SHA512
291b86357d7955a2506be3be9db6b8c903af37a63a50c042a874e89f9d538c09ddd9d4b1492dbe27331c099c6f4b3b2e5d985108948a3aafd6fdfa907677d39a

Download Submit
\Users\Admin\backup.exe

Filesize
72KB

MD5
0472814c88e091b2b316ac3dfbfebeb2

SHA1
5616dfbf76e387c1741fa10f1f358fd0ef6e77d7

SHA256
14af4d2d577d36ffc32f6832d56d709e7ab5b71d6ac77505b2ff562b2f3b99e2

SHA512
77b002ad4e26b6978e331c45e33cc259583647413f2339cb371312d110a7e90e0d82c0dd55e8c92f8b83a6e21802bc7e3fd1c920b21c630af6df2a19414f8e6a

Download Submit
\Users\Admin\backup.exe

Filesize
72KB

MD5
0472814c88e091b2b316ac3dfbfebeb2

SHA1
5616dfbf76e387c1741fa10f1f358fd0ef6e77d7

SHA256
14af4d2d577d36ffc32f6832d56d709e7ab5b71d6ac77505b2ff562b2f3b99e2

SHA512
77b002ad4e26b6978e331c45e33cc259583647413f2339cb371312d110a7e90e0d82c0dd55e8c92f8b83a6e21802bc7e3fd1c920b21c630af6df2a19414f8e6a

Download Submit
\Users\backup.exe

Filesize
72KB

MD5
ec761d369e7be2e561a02dce0d50fce2

SHA1
b5ea51b5b54a0ea98549d577181983f4d8c6bd50

SHA256
a8249b4e5459130beb5bb6c7c36ce7e1af1129c40177b359f9590be010591686

SHA512
1c764e15bf780e69d2827fc5dc34738e0b619df132d84786e70bdd9c08d44766db9b13111650695bb70ccdf8f34f76326177abf5d28a17711dcbc9e2546293e9

Download Submit
\Users\backup.exe

Filesize
72KB

MD5
ec761d369e7be2e561a02dce0d50fce2

SHA1
b5ea51b5b54a0ea98549d577181983f4d8c6bd50

SHA256
a8249b4e5459130beb5bb6c7c36ce7e1af1129c40177b359f9590be010591686

SHA512
1c764e15bf780e69d2827fc5dc34738e0b619df132d84786e70bdd9c08d44766db9b13111650695bb70ccdf8f34f76326177abf5d28a17711dcbc9e2546293e9

Download Submit
memory/1904-123-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/1904-208-0x0000000074501000-0x0000000074503000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads