146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b

Analysis

max time kernel
140s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 17:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe
Size

72KB
MD5

0f123100a8193dee80c5f0208966530b
SHA1

2d81f41bca69365eca598f629af878a170d3b710
SHA256

146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b
SHA512

1ec19fc9d0e64afc2b494aca552228bcc2604a1fcf9d72e978944149fc022d93152e84a6de9b602e309a9dcb980c2df42b2d1a3300d594bfd505ac052a691e57
SSDEEP

384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2s:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrA

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 36 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe

Disables RegEdit via registry modification 64 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	data.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe

Executes dropped EXE 60 IoCs

pid	Process
1396	backup.exe
1128	backup.exe
1076	backup.exe
548	backup.exe
1468	backup.exe
1312	System Restore.exe
1796	backup.exe
636	backup.exe
1744	backup.exe
2036	backup.exe
1680	backup.exe
812	backup.exe
1616	backup.exe
1576	backup.exe
276	backup.exe
852	update.exe
1932	update.exe
840	backup.exe
2040	backup.exe
660	backup.exe
620	backup.exe
1488	backup.exe
1164	backup.exe
1640	backup.exe
1484	backup.exe
540	backup.exe
1040	backup.exe
676	backup.exe
1112	backup.exe
556	backup.exe
1148	backup.exe
288	backup.exe
1204	backup.exe
2012	backup.exe
1952	backup.exe
1616	backup.exe
1720	backup.exe
1464	backup.exe
1108	backup.exe
1568	backup.exe
1468	backup.exe
1876	data.exe
1808	backup.exe
760	backup.exe
1332	backup.exe
1880	backup.exe
1700	backup.exe
552	data.exe
816	backup.exe
1724	backup.exe
856	backup.exe
812	backup.exe
1968	backup.exe
1952	backup.exe
1400	backup.exe
1748	backup.exe
1476	System Restore.exe
756	backup.exe
2020	backup.exe
1192	backup.exe

Loads dropped DLL 64 IoCs

pid	Process
1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe
1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe
1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe
1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe
1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe
1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe
1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe
1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe
1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe
1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe
1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe
1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe
1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe
1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe
1796	backup.exe
1796	backup.exe
1744	backup.exe
1744	backup.exe
1796	backup.exe
1796	backup.exe
1680	backup.exe
1680	backup.exe
812	backup.exe
812	backup.exe
1796	backup.exe
1680	backup.exe
1680	backup.exe
1796	backup.exe
276	backup.exe
852	update.exe
852	update.exe
852	update.exe
852	update.exe
1932	update.exe
1932	update.exe
1932	update.exe
1932	update.exe
1932	update.exe
840	backup.exe
840	backup.exe
840	backup.exe
1932	update.exe
1932	update.exe
2040	backup.exe
2040	backup.exe
2040	backup.exe
2040	backup.exe
2040	backup.exe
660	backup.exe
660	backup.exe
660	backup.exe
2040	backup.exe
2040	backup.exe
620	backup.exe
620	backup.exe
620	backup.exe
2040	backup.exe
1932	update.exe
1932	update.exe
2040	backup.exe
276	backup.exe
276	backup.exe
1796	backup.exe
1796	backup.exe

Drops file in Program Files directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DVD Maker\es-ES\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Google\backup.exe	backup.exe
File opened for modification	C:\Program Files\Internet Explorer\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe	backup.exe
File opened for modification	C:\Program Files\Google\data.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe	backup.exe
File opened for modification	C:\Program Files\Google\Chrome\backup.exe	data.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\update.exe	update.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Common Files\DESIGNER\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe	update.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\data.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe	backup.exe
File opened for modification	C:\Program Files\backup.exe	backup.exe
File opened for modification	C:\Program Files\7-Zip\Lang\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe	update.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\it-IT\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\fr-FR\backup.exe	backup.exe
File opened for modification	C:\Program Files\7-Zip\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Common Files\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\de-DE\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe	update.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe	update.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\update.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe	backup.exe
File opened for modification	C:\Program Files\Java\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\en-US\backup.exe	backup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\backup.exe	backup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe

Suspicious use of SetWindowsHookEx 48 IoCs

pid	Process
1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe
1396	backup.exe
1128	backup.exe
1076	backup.exe
548	backup.exe
1468	backup.exe
1312	System Restore.exe
1796	backup.exe
636	backup.exe
1744	backup.exe
2036	backup.exe
1680	backup.exe
812	backup.exe
1616	backup.exe
276	backup.exe
852	update.exe
1932	update.exe
840	backup.exe
2040	backup.exe
660	backup.exe
620	backup.exe
1488	backup.exe
1484	backup.exe
1164	backup.exe
1640	backup.exe
540	backup.exe
1040	backup.exe
556	backup.exe
676	backup.exe
1112	backup.exe
288	backup.exe
1952	backup.exe
1204	backup.exe
2012	backup.exe
1616	backup.exe
1464	backup.exe
1720	backup.exe
1568	backup.exe
1108	backup.exe
1876	data.exe
760	backup.exe
1808	backup.exe
1468	backup.exe
1700	backup.exe
856	backup.exe
1332	backup.exe
1880	backup.exe
816	backup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 1396	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	28
PID 1296 wrote to memory of 1396	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	28
PID 1296 wrote to memory of 1396	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	28
PID 1296 wrote to memory of 1396	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	28
PID 1296 wrote to memory of 1128	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	29
PID 1296 wrote to memory of 1128	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	29
PID 1296 wrote to memory of 1128	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	29
PID 1296 wrote to memory of 1128	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	29
PID 1296 wrote to memory of 1076	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	30
PID 1296 wrote to memory of 1076	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	30
PID 1296 wrote to memory of 1076	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	30
PID 1296 wrote to memory of 1076	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	30
PID 1296 wrote to memory of 548	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	31
PID 1296 wrote to memory of 548	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	31
PID 1296 wrote to memory of 548	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	31
PID 1296 wrote to memory of 548	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	31
PID 1296 wrote to memory of 1468	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	32
PID 1296 wrote to memory of 1468	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	32
PID 1296 wrote to memory of 1468	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	32
PID 1296 wrote to memory of 1468	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	32
PID 1296 wrote to memory of 1312	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	33
PID 1296 wrote to memory of 1312	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	33
PID 1296 wrote to memory of 1312	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	33
PID 1296 wrote to memory of 1312	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	33
PID 1396 wrote to memory of 1796	1396	backup.exe	34
PID 1396 wrote to memory of 1796	1396	backup.exe	34
PID 1396 wrote to memory of 1796	1396	backup.exe	34
PID 1396 wrote to memory of 1796	1396	backup.exe	34
PID 1296 wrote to memory of 636	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	35
PID 1296 wrote to memory of 636	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	35
PID 1296 wrote to memory of 636	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	35
PID 1296 wrote to memory of 636	1296	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe	35
PID 1796 wrote to memory of 1744	1796	backup.exe	36
PID 1796 wrote to memory of 1744	1796	backup.exe	36
PID 1796 wrote to memory of 1744	1796	backup.exe	36
PID 1796 wrote to memory of 1744	1796	backup.exe	36
PID 1744 wrote to memory of 2036	1744	backup.exe	37
PID 1744 wrote to memory of 2036	1744	backup.exe	37
PID 1744 wrote to memory of 2036	1744	backup.exe	37
PID 1744 wrote to memory of 2036	1744	backup.exe	37
PID 1796 wrote to memory of 1680	1796	backup.exe	38
PID 1796 wrote to memory of 1680	1796	backup.exe	38
PID 1796 wrote to memory of 1680	1796	backup.exe	38
PID 1796 wrote to memory of 1680	1796	backup.exe	38
PID 1680 wrote to memory of 812	1680	backup.exe	39
PID 1680 wrote to memory of 812	1680	backup.exe	39
PID 1680 wrote to memory of 812	1680	backup.exe	39
PID 1680 wrote to memory of 812	1680	backup.exe	39
PID 812 wrote to memory of 1616	812	backup.exe	40
PID 812 wrote to memory of 1616	812	backup.exe	40
PID 812 wrote to memory of 1616	812	backup.exe	40
PID 812 wrote to memory of 1616	812	backup.exe	40
PID 1680 wrote to memory of 1576	1680	backup.exe	42
PID 1680 wrote to memory of 1576	1680	backup.exe	42
PID 1680 wrote to memory of 1576	1680	backup.exe	42
PID 1680 wrote to memory of 1576	1680	backup.exe	42
PID 1796 wrote to memory of 276	1796	backup.exe	41
PID 1796 wrote to memory of 276	1796	backup.exe	41
PID 1796 wrote to memory of 276	1796	backup.exe	41
PID 1796 wrote to memory of 276	1796	backup.exe	41
PID 276 wrote to memory of 852	276	backup.exe	43
PID 276 wrote to memory of 852	276	backup.exe	43
PID 276 wrote to memory of 852	276	backup.exe	43
PID 276 wrote to memory of 852	276	backup.exe	43

System policy modification 1 TTPs 64 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	System Restore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	data.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	data.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe

C:\Users\Admin\AppData\Local\Temp\146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe
"C:\Users\Admin\AppData\Local\Temp\146aa91c71482bf8d49e030e5e91c48741e920f83af9fac2831fb32f6596008b.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1296
- C:\Users\Admin\AppData\Local\Temp\2266124903\backup.exe
  C:\Users\Admin\AppData\Local\Temp\2266124903\backup.exe C:\Users\Admin\AppData\Local\Temp\2266124903\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1396
- - C:\backup.exe
    \backup.exe \
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1796
  - - C:\PerfLogs\backup.exe
      C:\PerfLogs\backup.exe C:\PerfLogs\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1744
    - - C:\PerfLogs\Admin\backup.exe
        
        C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2036
  - - C:\Program Files\backup.exe
      "C:\Program Files\backup.exe" C:\Program Files\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1680
    - - C:\Program Files\7-Zip\backup.exe
        
        "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:812
      - C:\Program Files\7-Zip\Lang\backup.exe
        
        "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1616
    - - C:\Program Files\Common Files\backup.exe
        
        "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
        5⤵
        Executes dropped EXE
        
        PID:1576
    - - C:\Program Files\DVD Maker\backup.exe
        
        "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:540
      - C:\Program Files\DVD Maker\de-DE\backup.exe
        
        "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1040
      - C:\Program Files\DVD Maker\en-US\backup.exe
        
        "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
        6⤵
        Executes dropped EXE
        
        PID:1148
      - C:\Program Files\DVD Maker\es-ES\backup.exe
        
        "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:760
      - C:\Program Files\DVD Maker\fr-FR\backup.exe
        
        "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
        6⤵
        Executes dropped EXE
        
        PID:1952
      - C:\Program Files\DVD Maker\it-IT\backup.exe
        
        "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
        6⤵
        Executes dropped EXE
        
        PID:1192
      - C:\Program Files\DVD Maker\ja-JP\backup.exe
        
        "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
        6⤵
        
        PID:1044
      - C:\Program Files\DVD Maker\Shared\data.exe
        
        "C:\Program Files\DVD Maker\Shared\data.exe" C:\Program Files\DVD Maker\Shared\
        6⤵
        
        PID:636
    - - C:\Program Files\Google\data.exe
        
        "C:\Program Files\Google\data.exe" C:\Program Files\Google\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1876
      - C:\Program Files\Google\Chrome\backup.exe
        
        "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
        6⤵
        Executes dropped EXE
        
        PID:1724
    - - C:\Program Files\Internet Explorer\backup.exe
        
        "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
        5⤵
        Executes dropped EXE
        
        PID:1968
    - - C:\Program Files\Java\backup.exe
        
        "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
        5⤵
        
        PID:988
    - - C:\Program Files\Microsoft Games\backup.exe
        
        "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
        5⤵
        
        PID:1552
    - - C:\Program Files\Microsoft Office\backup.exe
        
        "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
        5⤵
        
        PID:1016
    - - C:\Program Files\Mozilla Firefox\backup.exe
        
        "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
        5⤵
        
        PID:840
  - - C:\Program Files (x86)\backup.exe
      "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:276
    - - C:\Program Files (x86)\Adobe\update.exe
        
        "C:\Program Files (x86)\Adobe\update.exe" C:\Program Files (x86)\Adobe\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:852
      - C:\Program Files (x86)\Adobe\Reader 9.0\update.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1932
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
        7⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:840
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
        7⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2040
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
        8⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:660
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
        8⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:620
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
        8⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1164
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
        8⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1112
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
        9⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1616
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:816
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
        8⤵
        Executes dropped EXE
        
        PID:756
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\System Restore.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
        8⤵
        
        PID:1156
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
        8⤵
        
        PID:1920
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\
        8⤵
        
        PID:1600
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
        7⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1488
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
        8⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:288
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\
        9⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2012
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1464
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1332
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\
        8⤵
        Executes dropped EXE
        
        PID:1748
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\
        8⤵
        
        PID:1616
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1700
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\
        8⤵
        
        PID:1008
    - - C:\Program Files (x86)\Common Files\backup.exe
        
        "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1484
      - C:\Program Files (x86)\Common Files\Adobe\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:676
        
        C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
        7⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1952
        
        C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1720
        
        C:\Program Files (x86)\Common Files\Adobe\Help\en_US\update.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\update.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\
        8⤵
        
        PID:672
        
        C:\Program Files (x86)\Common Files\Adobe\Updater6\data.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Updater6\data.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\
        7⤵
        Executes dropped EXE
        
        PID:552
      - C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1880
        
        C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\
        7⤵
        
        PID:852
      - C:\Program Files (x86)\Common Files\DESIGNER\backup.exe
        
        "C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\
        6⤵
        Executes dropped EXE
        
        PID:1400
      - C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
        
        "C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
        6⤵
        
        PID:1112
      - C:\Program Files (x86)\Common Files\Services\backup.exe
        
        "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
        6⤵
        
        PID:1828
      - C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe
        
        "C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\
        6⤵
        
        PID:1648
    - - C:\Program Files (x86)\Google\backup.exe
        
        "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1108
    - - C:\Program Files (x86)\Internet Explorer\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:856
      - C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
        6⤵
        
        PID:964
      - C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
        6⤵
        
        PID:1712
      - C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
        6⤵
        
        PID:1212
    - - C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
        
        "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
        5⤵
        Executes dropped EXE
        
        PID:2020
    - - C:\Program Files (x86)\Microsoft Office\System Restore.exe
        
        "C:\Program Files (x86)\Microsoft Office\System Restore.exe" C:\Program Files (x86)\Microsoft Office\
        5⤵
        
        PID:1080
    - - C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
        
        "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
        5⤵
        
        PID:2016
    - - C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
        
        "C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
        5⤵
        
        PID:1272
  - - C:\Users\backup.exe
      C:\Users\backup.exe C:\Users\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:1640
    - - C:\Users\Admin\backup.exe
        
        C:\Users\Admin\backup.exe C:\Users\Admin\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:556
      - C:\Users\Admin\Contacts\backup.exe
        
        C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1204
      - C:\Users\Admin\Desktop\backup.exe
        
        C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1568
      - C:\Users\Admin\Documents\backup.exe
        
        C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
        6⤵
        Executes dropped EXE
        
        PID:812
      - C:\Users\Admin\Downloads\System Restore.exe
        
        "C:\Users\Admin\Downloads\System Restore.exe" C:\Users\Admin\Downloads\
        6⤵
        Executes dropped EXE
        
        PID:1476
      - C:\Users\Admin\Favorites\backup.exe
        
        C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
        6⤵
        
        PID:1928
      - C:\Users\Admin\Links\backup.exe
        
        C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
        6⤵
        
        PID:904
      - C:\Users\Admin\Music\backup.exe
        
        C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
        6⤵
        
        PID:1972
    - - C:\Users\Public\backup.exe
        
        C:\Users\Public\backup.exe C:\Users\Public\
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1808
  - - C:\Windows\backup.exe
      C:\Windows\backup.exe C:\Windows\
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1468
- C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1128
- C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1076
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:548
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1468
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe
  "C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1312
- C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
  C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:636

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
ec079420db78a1c338afb57597d68bd0

SHA1
73fc395b312789adfe39d6e5adb389a3b0bd6a9e

SHA256
489fa5451f92f129a6224b0d6de128e4969285111a10fb08df2a5b99eec7f6df

SHA512
8aaabff61342f6a4ad2d850a5d0c9828b37493d4b55f69e7a1e0418c2af3194162bc5ea82a61e3716d44d6cb8601ab08445494c7e6548dd88693217a3db178d4

Download Submit
C:\PerfLogs\backup.exe

Filesize
72KB

MD5
796b78d973aaa229de70df1cabdda966

SHA1
452c9915675d5d2b0f10a54fc07d7820323d312a

SHA256
5c14ec91b4c99940c30fdc0437ecca0fd505f55c37199326d3f5d239cb90d8d2

SHA512
bddd868a0d19ec7a989dbfe5e336d703e59ca4d8d4971e6be1a070e36fa574483b728ee858ea2c272126b44ebe2f00a11525051dbb563f31ce35b1e10c0f384b

Download Submit
C:\PerfLogs\backup.exe

Filesize
72KB

MD5
796b78d973aaa229de70df1cabdda966

SHA1
452c9915675d5d2b0f10a54fc07d7820323d312a

SHA256
5c14ec91b4c99940c30fdc0437ecca0fd505f55c37199326d3f5d239cb90d8d2

SHA512
bddd868a0d19ec7a989dbfe5e336d703e59ca4d8d4971e6be1a070e36fa574483b728ee858ea2c272126b44ebe2f00a11525051dbb563f31ce35b1e10c0f384b

Download Submit
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe

Filesize
72KB

MD5
0ee0dbcf5d5119abdfa8b948fe254171

SHA1
4debde63f439de450655b57bd10eb9b86c857888

SHA256
888c0e0703911aa9f94e5a2a4f19bd8578f3601c563db79008a33ab2585dffdf

SHA512
aa43b78f34642112ce93c464227477803f11c77201390a19025d7fb042bb2456b9c0aa226e892ce0ef24c93cde702762b98244ea5205d809c5eacc26385de5f5

Download Submit
C:\Program Files (x86)\Adobe\Reader 9.0\update.exe

Filesize
72KB

MD5
53d23b53471718d96f2a68cd5b57eea9

SHA1
0d7a2e783a9e34b1743c297521d2226b86ba3b19

SHA256
94850ce9cf5fff2fa51c7be9ca882e9688df04611b8871a3486f04fa0dd58f8f

SHA512
06c38e49687e551c939cfc2968c61b723dc8c3ffe6a5e221515df563774a92d57913bad306a5d975c4c1e9a3f2ac2e71ebe43313732605852c50a2d9faa6ab44

Download Submit
C:\Program Files (x86)\Adobe\Reader 9.0\update.exe

Filesize
72KB

MD5
53d23b53471718d96f2a68cd5b57eea9

SHA1
0d7a2e783a9e34b1743c297521d2226b86ba3b19

SHA256
94850ce9cf5fff2fa51c7be9ca882e9688df04611b8871a3486f04fa0dd58f8f

SHA512
06c38e49687e551c939cfc2968c61b723dc8c3ffe6a5e221515df563774a92d57913bad306a5d975c4c1e9a3f2ac2e71ebe43313732605852c50a2d9faa6ab44

Download Submit
C:\Program Files (x86)\Adobe\update.exe

Filesize
72KB

MD5
ce0e266afc03ee71311c09ba7400c45c

SHA1
b3f9407ea8562cd6787ec7ad5cf814bac47258f1

SHA256
20e9ed90276255ad66afc71f9ee3e8ddd8924769c6526febe78110d78a3e60ba

SHA512
3aff96dc06bf7b32f9e72b213e0856e7bb4056475c860f719df8fd25da6be1532de4c0bcd08bd751544a9bdede5d11fd02e04807a1943ff6e36cf368af083ab5

Download Submit
C:\Program Files (x86)\Adobe\update.exe

Filesize
72KB

MD5
ce0e266afc03ee71311c09ba7400c45c

SHA1
b3f9407ea8562cd6787ec7ad5cf814bac47258f1

SHA256
20e9ed90276255ad66afc71f9ee3e8ddd8924769c6526febe78110d78a3e60ba

SHA512
3aff96dc06bf7b32f9e72b213e0856e7bb4056475c860f719df8fd25da6be1532de4c0bcd08bd751544a9bdede5d11fd02e04807a1943ff6e36cf368af083ab5

Download Submit
C:\Program Files (x86)\backup.exe

Filesize
72KB

MD5
fe5eeba576e2488572a509ed94144496

SHA1
06b2efbdcd663befbeb4dac98c6782bcbbf9bd23

SHA256
477700e03d98d6ed813b354e68acaf5c3d4756e91cdbc50521a972f0a73ad320

SHA512
10fdcedcc69414d0234d441ef93a048a720389f417ab6af3777f82fd1f61f960d0a7a1dd4b598eedba332febad11f94b8d2da6bee52229e422a4e21cfd6c46c7

Download Submit
C:\Program Files (x86)\backup.exe

Filesize
72KB

MD5
fe5eeba576e2488572a509ed94144496

SHA1
06b2efbdcd663befbeb4dac98c6782bcbbf9bd23

SHA256
477700e03d98d6ed813b354e68acaf5c3d4756e91cdbc50521a972f0a73ad320

SHA512
10fdcedcc69414d0234d441ef93a048a720389f417ab6af3777f82fd1f61f960d0a7a1dd4b598eedba332febad11f94b8d2da6bee52229e422a4e21cfd6c46c7

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
d794de0a3f1292ff9f35eb0c3235763c

SHA1
14b0c05ef1125c464b8a7421b2af1abb1e4c450f

SHA256
3d3dfcceb94c9afdcd9d2b82affc3af5f82126db75e5f98a99f8b0ba1e501667

SHA512
fac1a84e695b537ea65399fc70d0da3aad869085a01356bfd6eaa082a46a53118b7bc4b13af030403c8b655c385c1aa95fcb10c1154e05587f61b444f71985b6

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
9948209391789837e2a67b38193ead78

SHA1
18180096ad941b516300dfbc9c1166b9efa49605

SHA256
57af95b931a7f50cc7822d06418b7afa0a3af7d13cf159d2ae391ec77eacb677

SHA512
31846b5f3bc7c872f78d2e81794546c994ab519e275a63b05ae343dc98c211a9b8f4a4c6de3f087b2ae46f40d7023634f9fd5db227da8e1650b046472579e2c6

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
9948209391789837e2a67b38193ead78

SHA1
18180096ad941b516300dfbc9c1166b9efa49605

SHA256
57af95b931a7f50cc7822d06418b7afa0a3af7d13cf159d2ae391ec77eacb677

SHA512
31846b5f3bc7c872f78d2e81794546c994ab519e275a63b05ae343dc98c211a9b8f4a4c6de3f087b2ae46f40d7023634f9fd5db227da8e1650b046472579e2c6

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
a1ea1d85034e94bd717fac1c83410273

SHA1
084dc2f8583551cff1a71e9f6a30de2cd30b81e4

SHA256
3408aebd42cc76bbccbf2d4dc096274590c6d16843cf3cf63be885aa5f731ddc

SHA512
05a3a7b4fff0ccb44567be962c452956f5e7928dd4d2ebfd47a49747f2506f7db6f1abfb94fa7c3dbdd3a8e4ba85bd008a3e02d54778256fd09282a33a4da1ae

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
796b78d973aaa229de70df1cabdda966

SHA1
452c9915675d5d2b0f10a54fc07d7820323d312a

SHA256
5c14ec91b4c99940c30fdc0437ecca0fd505f55c37199326d3f5d239cb90d8d2

SHA512
bddd868a0d19ec7a989dbfe5e336d703e59ca4d8d4971e6be1a070e36fa574483b728ee858ea2c272126b44ebe2f00a11525051dbb563f31ce35b1e10c0f384b

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
796b78d973aaa229de70df1cabdda966

SHA1
452c9915675d5d2b0f10a54fc07d7820323d312a

SHA256
5c14ec91b4c99940c30fdc0437ecca0fd505f55c37199326d3f5d239cb90d8d2

SHA512
bddd868a0d19ec7a989dbfe5e336d703e59ca4d8d4971e6be1a070e36fa574483b728ee858ea2c272126b44ebe2f00a11525051dbb563f31ce35b1e10c0f384b

Download Submit
C:\Users\Admin\AppData\Local\Temp\2266124903\backup.exe

Filesize
72KB

MD5
a94deb479ff2c472ba0cfe937d67f669

SHA1
51d74953c596cd8f39afc4dc108d1e9c6ca8d421

SHA256
39d30bf7ef516ec95a67c99514839c3bbff6747c0651ec1c4914a87decbcf172

SHA512
66fac8248d4198adc0f70b8ba84af14a2b905be32f8f7f73f2d57e2f1f42da15527f3af892d755b3829fdb1b438b494d04be96eb8d83119d43b1ca0d687941aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\2266124903\backup.exe

Filesize
72KB

MD5
a94deb479ff2c472ba0cfe937d67f669

SHA1
51d74953c596cd8f39afc4dc108d1e9c6ca8d421

SHA256
39d30bf7ef516ec95a67c99514839c3bbff6747c0651ec1c4914a87decbcf172

SHA512
66fac8248d4198adc0f70b8ba84af14a2b905be32f8f7f73f2d57e2f1f42da15527f3af892d755b3829fdb1b438b494d04be96eb8d83119d43b1ca0d687941aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
a94deb479ff2c472ba0cfe937d67f669

SHA1
51d74953c596cd8f39afc4dc108d1e9c6ca8d421

SHA256
39d30bf7ef516ec95a67c99514839c3bbff6747c0651ec1c4914a87decbcf172

SHA512
66fac8248d4198adc0f70b8ba84af14a2b905be32f8f7f73f2d57e2f1f42da15527f3af892d755b3829fdb1b438b494d04be96eb8d83119d43b1ca0d687941aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
a94deb479ff2c472ba0cfe937d67f669

SHA1
51d74953c596cd8f39afc4dc108d1e9c6ca8d421

SHA256
39d30bf7ef516ec95a67c99514839c3bbff6747c0651ec1c4914a87decbcf172

SHA512
66fac8248d4198adc0f70b8ba84af14a2b905be32f8f7f73f2d57e2f1f42da15527f3af892d755b3829fdb1b438b494d04be96eb8d83119d43b1ca0d687941aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
ab35e4642a3280768a3afb0cd0a7c399

SHA1
0c3729211b32e185c5f15b44d393efb1ebe45818

SHA256
fdc7300bd88141b8e9dba21348436cba5b2dbe4a4762cd821c3a67c620aaf68e

SHA512
c410b0d11ade9a1cdab0ae90f736ef5688100a14fa4efc859fe662b2e729f7660c95094a957d73039a1c1e18a230f835cc98a4f45fc3ed26fc03f8daf146b27e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
ab35e4642a3280768a3afb0cd0a7c399

SHA1
0c3729211b32e185c5f15b44d393efb1ebe45818

SHA256
fdc7300bd88141b8e9dba21348436cba5b2dbe4a4762cd821c3a67c620aaf68e

SHA512
c410b0d11ade9a1cdab0ae90f736ef5688100a14fa4efc859fe662b2e729f7660c95094a957d73039a1c1e18a230f835cc98a4f45fc3ed26fc03f8daf146b27e

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
a94deb479ff2c472ba0cfe937d67f669

SHA1
51d74953c596cd8f39afc4dc108d1e9c6ca8d421

SHA256
39d30bf7ef516ec95a67c99514839c3bbff6747c0651ec1c4914a87decbcf172

SHA512
66fac8248d4198adc0f70b8ba84af14a2b905be32f8f7f73f2d57e2f1f42da15527f3af892d755b3829fdb1b438b494d04be96eb8d83119d43b1ca0d687941aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe

Filesize
72KB

MD5
ab35e4642a3280768a3afb0cd0a7c399

SHA1
0c3729211b32e185c5f15b44d393efb1ebe45818

SHA256
fdc7300bd88141b8e9dba21348436cba5b2dbe4a4762cd821c3a67c620aaf68e

SHA512
c410b0d11ade9a1cdab0ae90f736ef5688100a14fa4efc859fe662b2e729f7660c95094a957d73039a1c1e18a230f835cc98a4f45fc3ed26fc03f8daf146b27e

Download Submit
C:\backup.exe

Filesize
72KB

MD5
679cc458f8f36e901bda052f1e63ace1

SHA1
f36d0feb23c423edf9756d3d64154cad3b06a84e

SHA256
d2f082e5e033221ac23401081c4af222a763681c55f132c5ca74eb8d700ca7e6

SHA512
2c56f29323700a1aab6a62c5736b9d6617e0b7ff53c99eadf07c959c3add8a550289816e076ea5d356fad26e73944900683a6b46321a09625ca0b7978b8e4087

Download Submit
C:\backup.exe

Filesize
72KB

MD5
679cc458f8f36e901bda052f1e63ace1

SHA1
f36d0feb23c423edf9756d3d64154cad3b06a84e

SHA256
d2f082e5e033221ac23401081c4af222a763681c55f132c5ca74eb8d700ca7e6

SHA512
2c56f29323700a1aab6a62c5736b9d6617e0b7ff53c99eadf07c959c3add8a550289816e076ea5d356fad26e73944900683a6b46321a09625ca0b7978b8e4087

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
ec079420db78a1c338afb57597d68bd0

SHA1
73fc395b312789adfe39d6e5adb389a3b0bd6a9e

SHA256
489fa5451f92f129a6224b0d6de128e4969285111a10fb08df2a5b99eec7f6df

SHA512
8aaabff61342f6a4ad2d850a5d0c9828b37493d4b55f69e7a1e0418c2af3194162bc5ea82a61e3716d44d6cb8601ab08445494c7e6548dd88693217a3db178d4

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
ec079420db78a1c338afb57597d68bd0

SHA1
73fc395b312789adfe39d6e5adb389a3b0bd6a9e

SHA256
489fa5451f92f129a6224b0d6de128e4969285111a10fb08df2a5b99eec7f6df

SHA512
8aaabff61342f6a4ad2d850a5d0c9828b37493d4b55f69e7a1e0418c2af3194162bc5ea82a61e3716d44d6cb8601ab08445494c7e6548dd88693217a3db178d4

Download Submit
\PerfLogs\backup.exe

Filesize
72KB

MD5
796b78d973aaa229de70df1cabdda966

SHA1
452c9915675d5d2b0f10a54fc07d7820323d312a

SHA256
5c14ec91b4c99940c30fdc0437ecca0fd505f55c37199326d3f5d239cb90d8d2

SHA512
bddd868a0d19ec7a989dbfe5e336d703e59ca4d8d4971e6be1a070e36fa574483b728ee858ea2c272126b44ebe2f00a11525051dbb563f31ce35b1e10c0f384b

Download Submit
\PerfLogs\backup.exe

Filesize
72KB

MD5
796b78d973aaa229de70df1cabdda966

SHA1
452c9915675d5d2b0f10a54fc07d7820323d312a

SHA256
5c14ec91b4c99940c30fdc0437ecca0fd505f55c37199326d3f5d239cb90d8d2

SHA512
bddd868a0d19ec7a989dbfe5e336d703e59ca4d8d4971e6be1a070e36fa574483b728ee858ea2c272126b44ebe2f00a11525051dbb563f31ce35b1e10c0f384b

Download Submit
\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe

Filesize
72KB

MD5
0ee0dbcf5d5119abdfa8b948fe254171

SHA1
4debde63f439de450655b57bd10eb9b86c857888

SHA256
888c0e0703911aa9f94e5a2a4f19bd8578f3601c563db79008a33ab2585dffdf

SHA512
aa43b78f34642112ce93c464227477803f11c77201390a19025d7fb042bb2456b9c0aa226e892ce0ef24c93cde702762b98244ea5205d809c5eacc26385de5f5

Download Submit
\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe

Filesize
72KB

MD5
0ee0dbcf5d5119abdfa8b948fe254171

SHA1
4debde63f439de450655b57bd10eb9b86c857888

SHA256
888c0e0703911aa9f94e5a2a4f19bd8578f3601c563db79008a33ab2585dffdf

SHA512
aa43b78f34642112ce93c464227477803f11c77201390a19025d7fb042bb2456b9c0aa226e892ce0ef24c93cde702762b98244ea5205d809c5eacc26385de5f5

Download Submit
\Program Files (x86)\Adobe\Reader 9.0\update.exe

Filesize
72KB

MD5
53d23b53471718d96f2a68cd5b57eea9

SHA1
0d7a2e783a9e34b1743c297521d2226b86ba3b19

SHA256
94850ce9cf5fff2fa51c7be9ca882e9688df04611b8871a3486f04fa0dd58f8f

SHA512
06c38e49687e551c939cfc2968c61b723dc8c3ffe6a5e221515df563774a92d57913bad306a5d975c4c1e9a3f2ac2e71ebe43313732605852c50a2d9faa6ab44

Download Submit
\Program Files (x86)\Adobe\Reader 9.0\update.exe

Filesize
72KB

MD5
53d23b53471718d96f2a68cd5b57eea9

SHA1
0d7a2e783a9e34b1743c297521d2226b86ba3b19

SHA256
94850ce9cf5fff2fa51c7be9ca882e9688df04611b8871a3486f04fa0dd58f8f

SHA512
06c38e49687e551c939cfc2968c61b723dc8c3ffe6a5e221515df563774a92d57913bad306a5d975c4c1e9a3f2ac2e71ebe43313732605852c50a2d9faa6ab44

Download Submit
\Program Files (x86)\Adobe\Reader 9.0\update.exe

Filesize
72KB

MD5
53d23b53471718d96f2a68cd5b57eea9

SHA1
0d7a2e783a9e34b1743c297521d2226b86ba3b19

SHA256
94850ce9cf5fff2fa51c7be9ca882e9688df04611b8871a3486f04fa0dd58f8f

SHA512
06c38e49687e551c939cfc2968c61b723dc8c3ffe6a5e221515df563774a92d57913bad306a5d975c4c1e9a3f2ac2e71ebe43313732605852c50a2d9faa6ab44

Download Submit
\Program Files (x86)\Adobe\Reader 9.0\update.exe

Filesize
72KB

MD5
53d23b53471718d96f2a68cd5b57eea9

SHA1
0d7a2e783a9e34b1743c297521d2226b86ba3b19

SHA256
94850ce9cf5fff2fa51c7be9ca882e9688df04611b8871a3486f04fa0dd58f8f

SHA512
06c38e49687e551c939cfc2968c61b723dc8c3ffe6a5e221515df563774a92d57913bad306a5d975c4c1e9a3f2ac2e71ebe43313732605852c50a2d9faa6ab44

Download Submit
\Program Files (x86)\Adobe\update.exe

Filesize
72KB

MD5
ce0e266afc03ee71311c09ba7400c45c

SHA1
b3f9407ea8562cd6787ec7ad5cf814bac47258f1

SHA256
20e9ed90276255ad66afc71f9ee3e8ddd8924769c6526febe78110d78a3e60ba

SHA512
3aff96dc06bf7b32f9e72b213e0856e7bb4056475c860f719df8fd25da6be1532de4c0bcd08bd751544a9bdede5d11fd02e04807a1943ff6e36cf368af083ab5

Download Submit
\Program Files (x86)\Adobe\update.exe

Filesize
72KB

MD5
ce0e266afc03ee71311c09ba7400c45c

SHA1
b3f9407ea8562cd6787ec7ad5cf814bac47258f1

SHA256
20e9ed90276255ad66afc71f9ee3e8ddd8924769c6526febe78110d78a3e60ba

SHA512
3aff96dc06bf7b32f9e72b213e0856e7bb4056475c860f719df8fd25da6be1532de4c0bcd08bd751544a9bdede5d11fd02e04807a1943ff6e36cf368af083ab5

Download Submit
\Program Files (x86)\Adobe\update.exe

Filesize
72KB

MD5
ce0e266afc03ee71311c09ba7400c45c

SHA1
b3f9407ea8562cd6787ec7ad5cf814bac47258f1

SHA256
20e9ed90276255ad66afc71f9ee3e8ddd8924769c6526febe78110d78a3e60ba

SHA512
3aff96dc06bf7b32f9e72b213e0856e7bb4056475c860f719df8fd25da6be1532de4c0bcd08bd751544a9bdede5d11fd02e04807a1943ff6e36cf368af083ab5

Download Submit
\Program Files (x86)\Adobe\update.exe

Filesize
72KB

MD5
ce0e266afc03ee71311c09ba7400c45c

SHA1
b3f9407ea8562cd6787ec7ad5cf814bac47258f1

SHA256
20e9ed90276255ad66afc71f9ee3e8ddd8924769c6526febe78110d78a3e60ba

SHA512
3aff96dc06bf7b32f9e72b213e0856e7bb4056475c860f719df8fd25da6be1532de4c0bcd08bd751544a9bdede5d11fd02e04807a1943ff6e36cf368af083ab5

Download Submit
\Program Files (x86)\backup.exe

Filesize
72KB

MD5
fe5eeba576e2488572a509ed94144496

SHA1
06b2efbdcd663befbeb4dac98c6782bcbbf9bd23

SHA256
477700e03d98d6ed813b354e68acaf5c3d4756e91cdbc50521a972f0a73ad320

SHA512
10fdcedcc69414d0234d441ef93a048a720389f417ab6af3777f82fd1f61f960d0a7a1dd4b598eedba332febad11f94b8d2da6bee52229e422a4e21cfd6c46c7

Download Submit
\Program Files (x86)\backup.exe

Filesize
72KB

MD5
fe5eeba576e2488572a509ed94144496

SHA1
06b2efbdcd663befbeb4dac98c6782bcbbf9bd23

SHA256
477700e03d98d6ed813b354e68acaf5c3d4756e91cdbc50521a972f0a73ad320

SHA512
10fdcedcc69414d0234d441ef93a048a720389f417ab6af3777f82fd1f61f960d0a7a1dd4b598eedba332febad11f94b8d2da6bee52229e422a4e21cfd6c46c7

Download Submit
\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
d794de0a3f1292ff9f35eb0c3235763c

SHA1
14b0c05ef1125c464b8a7421b2af1abb1e4c450f

SHA256
3d3dfcceb94c9afdcd9d2b82affc3af5f82126db75e5f98a99f8b0ba1e501667

SHA512
fac1a84e695b537ea65399fc70d0da3aad869085a01356bfd6eaa082a46a53118b7bc4b13af030403c8b655c385c1aa95fcb10c1154e05587f61b444f71985b6

Download Submit
\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
d794de0a3f1292ff9f35eb0c3235763c

SHA1
14b0c05ef1125c464b8a7421b2af1abb1e4c450f

SHA256
3d3dfcceb94c9afdcd9d2b82affc3af5f82126db75e5f98a99f8b0ba1e501667

SHA512
fac1a84e695b537ea65399fc70d0da3aad869085a01356bfd6eaa082a46a53118b7bc4b13af030403c8b655c385c1aa95fcb10c1154e05587f61b444f71985b6

Download Submit
\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
9948209391789837e2a67b38193ead78

SHA1
18180096ad941b516300dfbc9c1166b9efa49605

SHA256
57af95b931a7f50cc7822d06418b7afa0a3af7d13cf159d2ae391ec77eacb677

SHA512
31846b5f3bc7c872f78d2e81794546c994ab519e275a63b05ae343dc98c211a9b8f4a4c6de3f087b2ae46f40d7023634f9fd5db227da8e1650b046472579e2c6

Download Submit
\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
9948209391789837e2a67b38193ead78

SHA1
18180096ad941b516300dfbc9c1166b9efa49605

SHA256
57af95b931a7f50cc7822d06418b7afa0a3af7d13cf159d2ae391ec77eacb677

SHA512
31846b5f3bc7c872f78d2e81794546c994ab519e275a63b05ae343dc98c211a9b8f4a4c6de3f087b2ae46f40d7023634f9fd5db227da8e1650b046472579e2c6

Download Submit
\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
a1ea1d85034e94bd717fac1c83410273

SHA1
084dc2f8583551cff1a71e9f6a30de2cd30b81e4

SHA256
3408aebd42cc76bbccbf2d4dc096274590c6d16843cf3cf63be885aa5f731ddc

SHA512
05a3a7b4fff0ccb44567be962c452956f5e7928dd4d2ebfd47a49747f2506f7db6f1abfb94fa7c3dbdd3a8e4ba85bd008a3e02d54778256fd09282a33a4da1ae

Download Submit
\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
a1ea1d85034e94bd717fac1c83410273

SHA1
084dc2f8583551cff1a71e9f6a30de2cd30b81e4

SHA256
3408aebd42cc76bbccbf2d4dc096274590c6d16843cf3cf63be885aa5f731ddc

SHA512
05a3a7b4fff0ccb44567be962c452956f5e7928dd4d2ebfd47a49747f2506f7db6f1abfb94fa7c3dbdd3a8e4ba85bd008a3e02d54778256fd09282a33a4da1ae

Download Submit
\Program Files\backup.exe

Filesize
72KB

MD5
796b78d973aaa229de70df1cabdda966

SHA1
452c9915675d5d2b0f10a54fc07d7820323d312a

SHA256
5c14ec91b4c99940c30fdc0437ecca0fd505f55c37199326d3f5d239cb90d8d2

SHA512
bddd868a0d19ec7a989dbfe5e336d703e59ca4d8d4971e6be1a070e36fa574483b728ee858ea2c272126b44ebe2f00a11525051dbb563f31ce35b1e10c0f384b

Download Submit
\Program Files\backup.exe

Filesize
72KB

MD5
796b78d973aaa229de70df1cabdda966

SHA1
452c9915675d5d2b0f10a54fc07d7820323d312a

SHA256
5c14ec91b4c99940c30fdc0437ecca0fd505f55c37199326d3f5d239cb90d8d2

SHA512
bddd868a0d19ec7a989dbfe5e336d703e59ca4d8d4971e6be1a070e36fa574483b728ee858ea2c272126b44ebe2f00a11525051dbb563f31ce35b1e10c0f384b

Download Submit
\Users\Admin\AppData\Local\Temp\2266124903\backup.exe

Filesize
72KB

MD5
a94deb479ff2c472ba0cfe937d67f669

SHA1
51d74953c596cd8f39afc4dc108d1e9c6ca8d421

SHA256
39d30bf7ef516ec95a67c99514839c3bbff6747c0651ec1c4914a87decbcf172

SHA512
66fac8248d4198adc0f70b8ba84af14a2b905be32f8f7f73f2d57e2f1f42da15527f3af892d755b3829fdb1b438b494d04be96eb8d83119d43b1ca0d687941aa

Download Submit
\Users\Admin\AppData\Local\Temp\2266124903\backup.exe

Filesize
72KB

MD5
a94deb479ff2c472ba0cfe937d67f669

SHA1
51d74953c596cd8f39afc4dc108d1e9c6ca8d421

SHA256
39d30bf7ef516ec95a67c99514839c3bbff6747c0651ec1c4914a87decbcf172

SHA512
66fac8248d4198adc0f70b8ba84af14a2b905be32f8f7f73f2d57e2f1f42da15527f3af892d755b3829fdb1b438b494d04be96eb8d83119d43b1ca0d687941aa

Download Submit
\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
a94deb479ff2c472ba0cfe937d67f669

SHA1
51d74953c596cd8f39afc4dc108d1e9c6ca8d421

SHA256
39d30bf7ef516ec95a67c99514839c3bbff6747c0651ec1c4914a87decbcf172

SHA512
66fac8248d4198adc0f70b8ba84af14a2b905be32f8f7f73f2d57e2f1f42da15527f3af892d755b3829fdb1b438b494d04be96eb8d83119d43b1ca0d687941aa

Download Submit
\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
a94deb479ff2c472ba0cfe937d67f669

SHA1
51d74953c596cd8f39afc4dc108d1e9c6ca8d421

SHA256
39d30bf7ef516ec95a67c99514839c3bbff6747c0651ec1c4914a87decbcf172

SHA512
66fac8248d4198adc0f70b8ba84af14a2b905be32f8f7f73f2d57e2f1f42da15527f3af892d755b3829fdb1b438b494d04be96eb8d83119d43b1ca0d687941aa

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
a94deb479ff2c472ba0cfe937d67f669

SHA1
51d74953c596cd8f39afc4dc108d1e9c6ca8d421

SHA256
39d30bf7ef516ec95a67c99514839c3bbff6747c0651ec1c4914a87decbcf172

SHA512
66fac8248d4198adc0f70b8ba84af14a2b905be32f8f7f73f2d57e2f1f42da15527f3af892d755b3829fdb1b438b494d04be96eb8d83119d43b1ca0d687941aa

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
a94deb479ff2c472ba0cfe937d67f669

SHA1
51d74953c596cd8f39afc4dc108d1e9c6ca8d421

SHA256
39d30bf7ef516ec95a67c99514839c3bbff6747c0651ec1c4914a87decbcf172

SHA512
66fac8248d4198adc0f70b8ba84af14a2b905be32f8f7f73f2d57e2f1f42da15527f3af892d755b3829fdb1b438b494d04be96eb8d83119d43b1ca0d687941aa

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
ab35e4642a3280768a3afb0cd0a7c399

SHA1
0c3729211b32e185c5f15b44d393efb1ebe45818

SHA256
fdc7300bd88141b8e9dba21348436cba5b2dbe4a4762cd821c3a67c620aaf68e

SHA512
c410b0d11ade9a1cdab0ae90f736ef5688100a14fa4efc859fe662b2e729f7660c95094a957d73039a1c1e18a230f835cc98a4f45fc3ed26fc03f8daf146b27e

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
ab35e4642a3280768a3afb0cd0a7c399

SHA1
0c3729211b32e185c5f15b44d393efb1ebe45818

SHA256
fdc7300bd88141b8e9dba21348436cba5b2dbe4a4762cd821c3a67c620aaf68e

SHA512
c410b0d11ade9a1cdab0ae90f736ef5688100a14fa4efc859fe662b2e729f7660c95094a957d73039a1c1e18a230f835cc98a4f45fc3ed26fc03f8daf146b27e

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
ab35e4642a3280768a3afb0cd0a7c399

SHA1
0c3729211b32e185c5f15b44d393efb1ebe45818

SHA256
fdc7300bd88141b8e9dba21348436cba5b2dbe4a4762cd821c3a67c620aaf68e

SHA512
c410b0d11ade9a1cdab0ae90f736ef5688100a14fa4efc859fe662b2e729f7660c95094a957d73039a1c1e18a230f835cc98a4f45fc3ed26fc03f8daf146b27e

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
ab35e4642a3280768a3afb0cd0a7c399

SHA1
0c3729211b32e185c5f15b44d393efb1ebe45818

SHA256
fdc7300bd88141b8e9dba21348436cba5b2dbe4a4762cd821c3a67c620aaf68e

SHA512
c410b0d11ade9a1cdab0ae90f736ef5688100a14fa4efc859fe662b2e729f7660c95094a957d73039a1c1e18a230f835cc98a4f45fc3ed26fc03f8daf146b27e

Download Submit
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
a94deb479ff2c472ba0cfe937d67f669

SHA1
51d74953c596cd8f39afc4dc108d1e9c6ca8d421

SHA256
39d30bf7ef516ec95a67c99514839c3bbff6747c0651ec1c4914a87decbcf172

SHA512
66fac8248d4198adc0f70b8ba84af14a2b905be32f8f7f73f2d57e2f1f42da15527f3af892d755b3829fdb1b438b494d04be96eb8d83119d43b1ca0d687941aa

Download Submit
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
a94deb479ff2c472ba0cfe937d67f669

SHA1
51d74953c596cd8f39afc4dc108d1e9c6ca8d421

SHA256
39d30bf7ef516ec95a67c99514839c3bbff6747c0651ec1c4914a87decbcf172

SHA512
66fac8248d4198adc0f70b8ba84af14a2b905be32f8f7f73f2d57e2f1f42da15527f3af892d755b3829fdb1b438b494d04be96eb8d83119d43b1ca0d687941aa

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe

Filesize
72KB

MD5
ab35e4642a3280768a3afb0cd0a7c399

SHA1
0c3729211b32e185c5f15b44d393efb1ebe45818

SHA256
fdc7300bd88141b8e9dba21348436cba5b2dbe4a4762cd821c3a67c620aaf68e

SHA512
c410b0d11ade9a1cdab0ae90f736ef5688100a14fa4efc859fe662b2e729f7660c95094a957d73039a1c1e18a230f835cc98a4f45fc3ed26fc03f8daf146b27e

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\System Restore.exe

Filesize
72KB

MD5
ab35e4642a3280768a3afb0cd0a7c399

SHA1
0c3729211b32e185c5f15b44d393efb1ebe45818

SHA256
fdc7300bd88141b8e9dba21348436cba5b2dbe4a4762cd821c3a67c620aaf68e

SHA512
c410b0d11ade9a1cdab0ae90f736ef5688100a14fa4efc859fe662b2e729f7660c95094a957d73039a1c1e18a230f835cc98a4f45fc3ed26fc03f8daf146b27e

Download Submit
memory/1296-107-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download
memory/1296-132-0x0000000074C31000-0x0000000074C33000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads