Overview

overview

10

Static

static

1d31febccb...e6.exe

windows7-x64

10

1d31febccb...e6.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    244s
  • max time network
    253s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2022, 14:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1d31febccb4def6ecbb5e325e2f6a18b9df921d9cde27414b3d46960e6de58e6.exe
  • Size 72KB
  • Sample221121-rrmqdade22
  • SHA256 1d31febccb4def6ecbb5e325e2f6a18b9df921d9cde27414b3d46960e6de58e6
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 43 IoCs
    evasion
  • Disables RegEdit via registry modification 64 IoCs
    evasion
  • Executes dropped EXE 59 IoCs
  • Drops file in Program Files directory 38 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 58 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d31febccb4def6ecbb5e325e2f6a18b9df921d9cde27414b3d46960e6de58e6.exe
    "C:\Users\Admin\AppData\Local\Temp\1d31febccb4def6ecbb5e325e2f6a18b9df921d9cde27414b3d46960e6de58e6.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Disables RegEdit via registry modification
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3164
    • C:\Users\Admin\AppData\Local\Temp\1238733345\backup.exe
      C:\Users\Admin\AppData\Local\Temp\1238733345\backup.exe C:\Users\Admin\AppData\Local\Temp\1238733345\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2956
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:5052
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:1140
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:4032
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:3740
          • C:\Program Files\7-Zip\data.exe
            "C:\Program Files\7-Zip\data.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:3080
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:3884
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1296
            • C:\Program Files\Common Files\DESIGNER\System Restore.exe
              "C:\Program Files\Common Files\DESIGNER\System Restore.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:5000
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:4584
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:4212
              • C:\Program Files\Common Files\microsoft shared\ink\System Restore.exe
                "C:\Program Files\Common Files\microsoft shared\ink\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:680
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1128
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2104
              • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1376
                • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                  8⤵
                  • Executes dropped EXE
                  PID:5040
              • C:\Program Files\Common Files\microsoft shared\OFFICE16\update.exe
                "C:\Program Files\Common Files\microsoft shared\OFFICE16\update.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4720
            • C:\Program Files\Common Files\Services\backup.exe
              "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:3388
            • C:\Program Files\Common Files\System\backup.exe
              "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1048
          • C:\Program Files\Google\backup.exe
            "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:540
            • C:\Program Files\Google\Chrome\System Restore.exe
              "C:\Program Files\Google\Chrome\System Restore.exe" C:\Program Files\Google\Chrome\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              PID:364
              • C:\Program Files\Google\Chrome\Application\backup.exe
                "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:4348
                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1168
                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:4272
                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1864
                • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                  "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2944
          • C:\Program Files\Internet Explorer\backup.exe
            "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:3460
            • C:\Program Files\Internet Explorer\de-DE\backup.exe
              "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
              6⤵
              • Executes dropped EXE
              PID:180
          • C:\Program Files\Java\backup.exe
            "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:4488
        • C:\Program Files (x86)\backup.exe
          "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1956
          • C:\Program Files (x86)\Adobe\backup.exe
            "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:996
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:708
              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                PID:1484
                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4388
                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3448
              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:948
              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:2236
                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1060
              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3380
          • C:\Program Files (x86)\Common Files\backup.exe
            "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:3156
            • C:\Program Files (x86)\Common Files\Adobe\backup.exe
              "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3436
          • C:\Program Files (x86)\Google\backup.exe
            "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:5084
        • C:\Users\backup.exe
          C:\Users\backup.exe C:\Users\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4884
          • C:\Users\Admin\data.exe
            C:\Users\Admin\data.exe C:\Users\Admin\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:628
            • C:\Users\Admin\3D Objects\backup.exe
              "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:1596
            • C:\Users\Admin\Contacts\backup.exe
              C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:4364
            • C:\Users\Admin\Desktop\backup.exe
              C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:4184
            • C:\Users\Admin\Documents\backup.exe
              C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:3752
            • C:\Users\Admin\Downloads\backup.exe
              C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3432
          • C:\Users\Public\backup.exe
            C:\Users\Public\backup.exe C:\Users\Public\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:2548
            • C:\Users\Public\Documents\backup.exe
              C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:856
        • C:\Windows\backup.exe
          C:\Windows\backup.exe C:\Windows\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:4152
          • C:\Windows\addins\backup.exe
            C:\Windows\addins\backup.exe C:\Windows\addins\
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:5008
    • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
      C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1716
    • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
      C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2008
    • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
      C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3084
    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:792
    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:1616
    • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
      C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:3936

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        backup.exe
        • Path C:\PerfLogs\backup.exe
        • Size 72KB
        • SHA256 ea7d97aea611396ee34ef5fd0e90b1fc03f1fffe6f8f36f5e823b0b8714d9c9f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\PerfLogs\backup.exe
        • Size 72KB
        • SHA256 ea7d97aea611396ee34ef5fd0e90b1fc03f1fffe6f8f36f5e823b0b8714d9c9f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
        • Size 72KB
        • SHA256 09b7e29bb5500ebffe0e0893e10bdf3523c7995ef0c660dc30d8666288df5ea4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
        • Size 72KB
        • SHA256 09b7e29bb5500ebffe0e0893e10bdf3523c7995ef0c660dc30d8666288df5ea4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
        • Size 72KB
        • SHA256 09b7e29bb5500ebffe0e0893e10bdf3523c7995ef0c660dc30d8666288df5ea4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
        • Size 72KB
        • SHA256 09b7e29bb5500ebffe0e0893e10bdf3523c7995ef0c660dc30d8666288df5ea4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
        • Size 72KB
        • SHA256 bc5c434e51f8518688e7952137c1059c3ce99cff94c1bf6e212fc42f6a3014ab
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
        • Size 72KB
        • SHA256 bc5c434e51f8518688e7952137c1059c3ce99cff94c1bf6e212fc42f6a3014ab
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files (x86)\Adobe\backup.exe
        • Size 72KB
        • SHA256 99d828615507347b29e725216d83e1d7bab1eaafa16dd4d215dec9b5e93cc9fc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files (x86)\Adobe\backup.exe
        • Size 72KB
        • SHA256 99d828615507347b29e725216d83e1d7bab1eaafa16dd4d215dec9b5e93cc9fc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files (x86)\backup.exe
        • Size 72KB
        • SHA256 1e20ebfb17d47fdad00fa20a1fc8de35a04c2231f165bc58bd2c1085f2879bb9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files (x86)\backup.exe
        • Size 72KB
        • SHA256 1e20ebfb17d47fdad00fa20a1fc8de35a04c2231f165bc58bd2c1085f2879bb9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\7-Zip\Lang\backup.exe
        • Size 72KB
        • SHA256 8bf95aac9a6fc0ccf1700ab84d06f4b60f2d29b81d52843d2ae5d30ed728068e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\7-Zip\Lang\backup.exe
        • Size 72KB
        • SHA256 8bf95aac9a6fc0ccf1700ab84d06f4b60f2d29b81d52843d2ae5d30ed728068e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data.exe
        • Path C:\Program Files\7-Zip\data.exe
        • Size 72KB
        • SHA256 e120e1d56f853e6b4d42e239aa6d88ffd02b3e9fe85a3d55834c0b197eaa7aef
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data.exe
        • Path C:\Program Files\7-Zip\data.exe
        • Size 72KB
        • SHA256 e120e1d56f853e6b4d42e239aa6d88ffd02b3e9fe85a3d55834c0b197eaa7aef
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System Restore.exe
        • Path C:\Program Files\Common Files\DESIGNER\System Restore.exe
        • Size 72KB
        • SHA256 4015b0928ab1bae643bf5ea8b960a29f40f717639a674f69feacb72d188e76ea
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System Restore.exe
        • Path C:\Program Files\Common Files\DESIGNER\System Restore.exe
        • Size 72KB
        • SHA256 4015b0928ab1bae643bf5ea8b960a29f40f717639a674f69feacb72d188e76ea
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\backup.exe
        • Size 72KB
        • SHA256 5bf6c8dee576ff8a18246dad28b59b6bf107d7b1ca6c8a0aeb0c70b329f9f82f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\backup.exe
        • Size 72KB
        • SHA256 5bf6c8dee576ff8a18246dad28b59b6bf107d7b1ca6c8a0aeb0c70b329f9f82f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
        • Size 72KB
        • SHA256 1977698161d52a7069ddfe573ceb3ea54a042709b0b990c496d9de489062867f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
        • Size 72KB
        • SHA256 1977698161d52a7069ddfe573ceb3ea54a042709b0b990c496d9de489062867f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\backup.exe
        • Size 72KB
        • SHA256 624bf290521889a70873bb06127125415a9ffb9e66dbfbc0ac515082f9bc82d8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\backup.exe
        • Size 72KB
        • SHA256 624bf290521889a70873bb06127125415a9ffb9e66dbfbc0ac515082f9bc82d8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System Restore.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\System Restore.exe
        • Size 72KB
        • SHA256 1977698161d52a7069ddfe573ceb3ea54a042709b0b990c496d9de489062867f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System Restore.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\System Restore.exe
        • Size 72KB
        • SHA256 1977698161d52a7069ddfe573ceb3ea54a042709b0b990c496d9de489062867f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
        • Size 72KB
        • SHA256 b92311cf966f1e86f0d0dfd4a23f5f32b0e9c63f925bdbab68011f23586ba96a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
        • Size 72KB
        • SHA256 b92311cf966f1e86f0d0dfd4a23f5f32b0e9c63f925bdbab68011f23586ba96a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Google\Chrome\Application\backup.exe
        • Size 72KB
        • SHA256 a1246619508d12b40c329b3b10d15460a31ac03a3e43b4360c2421ab62e3330d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Google\Chrome\Application\backup.exe
        • Size 72KB
        • SHA256 a1246619508d12b40c329b3b10d15460a31ac03a3e43b4360c2421ab62e3330d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System Restore.exe
        • Path C:\Program Files\Google\Chrome\System Restore.exe
        • Size 72KB
        • SHA256 9a9053e6163e63a85829d205bec7642089d936e91048656503e379aeae95b2b2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System Restore.exe
        • Path C:\Program Files\Google\Chrome\System Restore.exe
        • Size 72KB
        • SHA256 9a9053e6163e63a85829d205bec7642089d936e91048656503e379aeae95b2b2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Google\backup.exe
        • Size 72KB
        • SHA256 7910a7886b8fdb389c8199c026fe272fec4729e0ab1c61be36a639f6a663bc61
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Google\backup.exe
        • Size 72KB
        • SHA256 7910a7886b8fdb389c8199c026fe272fec4729e0ab1c61be36a639f6a663bc61
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\backup.exe
        • Size 72KB
        • SHA256 acf0d6a86bc93dcaaeadd759f165e15a7f87269d6992f81621442772937e5ec4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\backup.exe
        • Size 72KB
        • SHA256 acf0d6a86bc93dcaaeadd759f165e15a7f87269d6992f81621442772937e5ec4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\3D Objects\backup.exe
        • Size 72KB
        • SHA256 f3962c4d97d90fc20ced9325e8969a0d0e037007f55fc8526716668642e5e0c8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\3D Objects\backup.exe
        • Size 72KB
        • SHA256 f3962c4d97d90fc20ced9325e8969a0d0e037007f55fc8526716668642e5e0c8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\1238733345\backup.exe
        • Size 72KB
        • SHA256 ec239a0e3225a98a66bc4c66c081330ae7fa954d8e990d4d56e777c97444b6bf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\1238733345\backup.exe
        • Size 72KB
        • SHA256 ec239a0e3225a98a66bc4c66c081330ae7fa954d8e990d4d56e777c97444b6bf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
        • Size 72KB
        • SHA256 ec239a0e3225a98a66bc4c66c081330ae7fa954d8e990d4d56e777c97444b6bf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
        • Size 72KB
        • SHA256 ec239a0e3225a98a66bc4c66c081330ae7fa954d8e990d4d56e777c97444b6bf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
        • Size 72KB
        • SHA256 13d21c7f47e5ed9e6e744b21434065b7f33468436495c98acd8d58971e7b0175
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
        • Size 72KB
        • SHA256 13d21c7f47e5ed9e6e744b21434065b7f33468436495c98acd8d58971e7b0175
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
        • Size 72KB
        • SHA256 50e37ca3e5147080472373b731ecd5be015166074de4a17a4479ae6427f8ffc7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
        • Size 72KB
        • SHA256 50e37ca3e5147080472373b731ecd5be015166074de4a17a4479ae6427f8ffc7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
        • Size 72KB
        • SHA256 ec239a0e3225a98a66bc4c66c081330ae7fa954d8e990d4d56e777c97444b6bf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
        • Size 72KB
        • SHA256 ec239a0e3225a98a66bc4c66c081330ae7fa954d8e990d4d56e777c97444b6bf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
        • Size 72KB
        • SHA256 ec239a0e3225a98a66bc4c66c081330ae7fa954d8e990d4d56e777c97444b6bf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
        • Size 72KB
        • SHA256 ec239a0e3225a98a66bc4c66c081330ae7fa954d8e990d4d56e777c97444b6bf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
        • Size 72KB
        • SHA256 6dc5823cf794c45799ecb2bf797bf0351867bd8cb61a4e3278696cd95f528b10
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
        • Size 72KB
        • SHA256 6dc5823cf794c45799ecb2bf797bf0351867bd8cb61a4e3278696cd95f528b10
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\Contacts\backup.exe
        • Size 72KB
        • SHA256 06b7919504de06470630ef361743404d55efffa709aa1165ab11fb9431686d9f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\Contacts\backup.exe
        • Size 72KB
        • SHA256 06b7919504de06470630ef361743404d55efffa709aa1165ab11fb9431686d9f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\Desktop\backup.exe
        • Size 72KB
        • SHA256 06b7919504de06470630ef361743404d55efffa709aa1165ab11fb9431686d9f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\Desktop\backup.exe
        • Size 72KB
        • SHA256 06b7919504de06470630ef361743404d55efffa709aa1165ab11fb9431686d9f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data.exe
        • Path C:\Users\Admin\data.exe
        • Size 72KB
        • SHA256 6875066f72063d34528b9ff90da8cada753286ea218c194b997a26b8e9e05823
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data.exe
        • Path C:\Users\Admin\data.exe
        • Size 72KB
        • SHA256 6875066f72063d34528b9ff90da8cada753286ea218c194b997a26b8e9e05823
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\backup.exe
        • Size 72KB
        • SHA256 138553ebf6215ea80282f92d8b2a7a031c04b5ae3d1f32992b9693594290c7db
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\backup.exe
        • Size 72KB
        • SHA256 138553ebf6215ea80282f92d8b2a7a031c04b5ae3d1f32992b9693594290c7db
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\backup.exe
        • Size 72KB
        • SHA256 c365d3fa3bd9eb7a1281dc2a42212edbb07ce6dbc49fc38d68edbf74ec2c033e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\backup.exe
        • Size 72KB
        • SHA256 c365d3fa3bd9eb7a1281dc2a42212edbb07ce6dbc49fc38d68edbf74ec2c033e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\odt\backup.exe
        • Size 72KB
        • SHA256 03507484d94ec66f3043ebe02521d076a56c7744ebd17513bbac41d40dce76b5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\odt\backup.exe
        • Size 72KB
        • SHA256 03507484d94ec66f3043ebe02521d076a56c7744ebd17513bbac41d40dce76b5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download