0912106b4527149e156b0838d8f16732a6dd2b6e98014a3dd8dbc253e50b76af

Analysis

max time kernel
131s
max time network
137s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 15:41

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

DropboxInstaller.exe
Size

653KB
MD5

74bbc8c19cfccb1ff3211c0b1a50d34d
SHA1

e952b1acc670346e85a6e680810612fb2b54dae7
SHA256

0912106b4527149e156b0838d8f16732a6dd2b6e98014a3dd8dbc253e50b76af
SHA512

1d53782f1ac935e01b020d38f1fe9a6f0fbec10598fec1fa181aa243c67a82665fbe692345e698e5fe02941f840923e7bb04296358a487d8803200f4c87c90a7
SSDEEP

12288:l/iSu7Kp081EFbfcjTBJgSFghJys9WDksIiCerNc9fEiQsBc4KtyUDl:l/iPoO2jTBFAys9APGVSbsi4u

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

2 1220 msiexec.exe
Downloads MZ/PE file

flow	pid	process
2	1220	msiexec.exe

Executes dropped EXE 7 IoCs

Processes:

DropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxClient_161.4.4923.exe

pid	process
1472	DropboxUpdate.exe
1868	DropboxUpdate.exe
1836	DropboxUpdate.exe
1696	DropboxUpdate.exe
1632	DropboxUpdate.exe
1380	DropboxUpdate.exe
840	DropboxClient_161.4.4923.exe

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

DropboxUpdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe	DropboxUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe\DisableExceptionChainValidation = "0"	DropboxUpdate.exe

Loads dropped DLL 28 IoCs

Processes:

DropboxInstaller.exeDropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exeDropboxClient_161.4.4923.exe

pid	process
2020	DropboxInstaller.exe
1472	DropboxUpdate.exe
1472	DropboxUpdate.exe
1472	DropboxUpdate.exe
1472	DropboxUpdate.exe
1868	DropboxUpdate.exe
1868	DropboxUpdate.exe
1868	DropboxUpdate.exe
1472	DropboxUpdate.exe
1836	DropboxUpdate.exe
1836	DropboxUpdate.exe
1836	DropboxUpdate.exe
1836	DropboxUpdate.exe
1472	DropboxUpdate.exe
1472	DropboxUpdate.exe
1472	DropboxUpdate.exe
1472	DropboxUpdate.exe
1696	DropboxUpdate.exe
1632	DropboxUpdate.exe
1632	DropboxUpdate.exe
1632	DropboxUpdate.exe
1380	DropboxUpdate.exe
1380	DropboxUpdate.exe
1380	DropboxUpdate.exe
1380	DropboxUpdate.exe
1632	DropboxUpdate.exe
1380	DropboxUpdate.exe
840	DropboxClient_161.4.4923.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in System32 directory 6 IoCs

Processes:

DropboxUpdate.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_0CEBF833D8869122FFACBB9972787B0D	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_0CEBF833D8869122FFACBB9972787B0D	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7C5C79D5EA2EAA218D5C63883951605	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D7C5C79D5EA2EAA218D5C63883951605	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	DropboxUpdate.exe

Drops file in Program Files directory 64 IoCs

Processes:

DropboxClient_161.4.4923.exeDropboxUpdate.exe

description	ioc	process
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\logo.scale-100.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\api-ms-win-crt-private-l1-1-0.dll	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\wrapt._wrappers.cp38-win32.pyd	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\TileSmall.contrast-black_scale-200.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\TileSmall.scale-100.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\TinyTile.contrast-white_scale-200.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\gslides.targetsize-24.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\logo.contrast-white.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\logo.targetsize-16_altform-unplated_contrast-black.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\api-ms-win-crt-string-l1-1-0.dll	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\dropbox_crashpad.dll	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\msvcp140_1.dll	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\StoreLogo.contrast-black_scale-200.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\TileSmall.scale-150.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\backup.targetsize-64.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\logo.targetsize-60.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\logo.targetsize-30_contrast-white.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\api-ms-win-core-util-l1-1-0.dll	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\libGLESv2.dll	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\libffi-7.dll	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\python-packages.zip	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\TileSmall.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\backup.targetsize-32.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\logo.targetsize-24_contrast-white.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Qt5Sql.dll	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\apex._apex.cp38-win32.pyd	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\gsheet.targetsize-64.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\gslides.targetsize-16.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\logo.contrast-black.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\logo.targetsize-24_altform-unplated_contrast-black.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\logo.targetsize-30_altform-unplated.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\logo.targetsize-20.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\api-ms-win-core-debug-l1-1-0.dll	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\api-ms-win-crt-convert-l1-1-0.dll	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\d3dcompiler_47.dll	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\nucleus_python.cp38-win32.pyd	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\win32security.cp38-win32.pyd	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\wininfinitedrivers_native.cp38-win32.pyd	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\TinyTile.contrast-black_scale-150.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\logo.targetsize-30.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\external_drive.targetsize-32.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\gsheet.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\api-ms-win-crt-process-l1-1-0.dll	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\cloud_files_utils.cp38-win32.pyd	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\cryptography.hazmat.bindings._padding.cp38-win32.pyd	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\msvcp140_codecvt_ids.dll	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\gdoc.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\logo.targetsize-30_contrast-black.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\TinyTile.scale-400.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\api-ms-win-core-file-l1-2-0.dll	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\msvcp140_2.dll	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\ntdll_native.cp38-win32.pyd	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\winenumhandles_native.cp38-win32.pyd	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\StoreLogo.scale-400.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\TileSmall.scale-200.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\TinyTile.contrast-black_scale-200.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\gsheet.targetsize-32.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\logo.targetsize-16.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\chrome_100_percent.pak	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\vcruntime140.dll	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\TileSmall.contrast-white.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\backup.targetsize-24.png	DropboxClient_161.4.4923.exe
File created	C:\Program Files (x86)\Dropbox\Client_161.4.4923\161.4.4923\Assets\gsheet.targetsize-16.png	DropboxClient_161.4.4923.exe

Drops file in Windows directory 9 IoCs

Processes:

msiexec.exeDropboxUpdate.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBFC9.tmp	msiexec.exe
File created	C:\Windows\Installer\6cb59e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6cb59c.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\6cb59a.msi	msiexec.exe
File created	C:\Windows\Installer\6cb59c.ipi	msiexec.exe
File created	C:\Windows\Installer\6cb59a.msi	msiexec.exe
File created	C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job	DropboxUpdate.exe
File created	C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job	DropboxUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

DropboxUpdate.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\Policy = "3"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\CLSID = "{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}"	DropboxUpdate.exe

Modifies data under HKEY_USERS 47 IoCs

Processes:

DropboxUpdate.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DropboxUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DropboxUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DropboxUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd1900000001000000100000003b878212830eb36469856f1c683b836c040000000100000010000000e67b586f7046bfe0aa51f6660b119dd90f00000001000000200000003689022b62bd20e807ccc1f32720ab2a9eeb0712e84cc373464b29cc436def97140000000100000014000000b76ba2eaa8aa848c79eab4da0f98b2c59576b9f41800000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee4b0000000100000044000000420033003900380042003800300031003300340046003700320032003000390035003400370034003300390044004200320031004100420033003000380044005f0000002000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD	DropboxUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DropboxUpdate.exe

Modifies registry class 64 IoCs

Processes:

DropboxUpdate.exeDropboxUpdate.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}\LocalServer32	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassSvc\CurVer\ = "DropboxUpdate.OnDemandCOMClassSvc.1.0"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E58F67C2-BC84-4C7C-AC35-4FFBB25A47E6}\AppID = "{76E258F0-DE86-4CEC-9D30-3F728A898741}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28F751F5-74E3-4C46-8174-D8D8A6BAF83F}\LocalizedString = "@C:\\Program Files (x86)\\Dropbox\\Update\\1.3.639.1\\goopdate.dll,-3000"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}\ProgID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}\VersionIndependentProgID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassSvc.1.0\CLSID	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\PackageCode = "9B9C73795A9A90340B0B933139D9B4AC"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\SourceList\PackageName = "DropboxUpdateHelper.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F448B4EA-A094-491A-BF61-9AF6CD450C7D}\ProxyStubClsid32	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dropbox.OneClickProcessLauncherMachine\CLSID\ = "{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CredentialDialogMachine.1.0\CLSID	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DropboxUpdate.exe\AppID = "{76E258F0-DE86-4CEC-9D30-3F728A898741}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C52C4100-E8C6-438B-AEAC-43C99F7CCC26}\ = "IAppBundle"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B8158CAB-1B7C-4A15-860E-AAA364E77334}\NumMethods\ = "10"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoCreateAsync.1.0	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassSvc.1.0	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B8158CAB-1B7C-4A15-860E-AAA364E77334}\ = "IAppVersionWeb"	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78F1393A-63FD-494A-BA89-2C3ECA4E8EC8}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachineFallback\CurVer\ = "DropboxUpdate.OnDemandCOMClassMachineFallback.1.0"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{05378308-2559-4C71-B758-7DACD5A359BA}\ProxyStubClsid32\ = "{97E0A5E2-76BC-43F6-8DDC-3E07A738E45E}"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A496C5D9-84FE-4E84-9D20-7481589E1C23}\ProgID	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.ProcessLauncher.1.0\CLSID\ = "{3363994D-A786-4A32-A745-48B9B6EA709A}"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachineFallback.1.0	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4AF89161-A408-4DFD-9DE2-3C3B7BDB14E2}\VersionIndependentProgID\ = "DropboxUpdate.CredentialDialogMachine"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebSvc.1.0\ = "DropboxUpdate Update3Web"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B35122D2-0036-4536-AEEA-EEA68E54A460}\ = "IGoogleUpdate3WebSecurity"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{831F99E1-2250-4065-8975-7408E726825F}\ProxyStubClsid32\ = "{97E0A5E2-76BC-43F6-8DDC-3E07A738E45E}"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{90AC42F5-B136-4079-B7A1-0A61FC86685D}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.ProcessLauncher\ = "Dropbox Update Process Launcher Class"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachine\CLSID\ = "{04F3B937-6C9D-4DAC-9477-8C35E24B25D1}"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28F751F5-74E3-4C46-8174-D8D8A6BAF83F}\Elevation	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{96D1EED3-701E-4FE5-B996-A543A8465897}\VersionIndependentProgID	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8EEF2D6E-1CE5-4823-88D0-7F727719D0A2}\ = "IBrowserHttpRequest2"	DropboxUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E54806CB-0046-4BCF-B389-3A6F732DC6E6}\Elevation\Enabled = "1"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E6CC2A7CB440C2A4DBE17EE5DAC2110B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F448B4EA-A094-491A-BF61-9AF6CD450C7D}\ProxyStubClsid32\ = "{97E0A5E2-76BC-43F6-8DDC-3E07A738E45E}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachine.1.0\ = "Dropbox Update Broker Class Factory"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\ = "Dropbox.OneClickProcessLauncher"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{831F99E1-2250-4065-8975-7408E726825F}\ = "IGoogleUpdate3Web"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassSvc\CLSID	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{76E258F0-DE86-4CEC-9D30-3F728A898741}\VersionIndependentProgID\ = "DropboxUpdate.OnDemandCOMClassSvc"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebSvc\CurVer\ = "DropboxUpdate.Update3WebSvc.1.0"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBCB9957-FBBA-412E-AB18-D6FEED996B31}\InprocHandler32\ = "C:\\Program Files (x86)\\Dropbox\\Update\\1.3.639.1\\psmachine.dll"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachine.1.0\CLSID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoCreateAsync\CurVer	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachineFallback.1.0\ = "DropboxUpdate Update3Web"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DropboxUpdate.exe\AppID = "{96D1EED3-701E-4FE5-B996-A543A8465897}"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5A812990327ACD34D85B163756A6E149	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\SourceList\Net\1 = "C:\\Program Files (x86)\\Dropbox\\Update\\1.3.639.1\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E54806CB-0046-4BCF-B389-3A6F732DC6E6}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F84F5221-63AA-431E-A57C-D7D03649E3E6}\ = "IRegistrationUpdateHook"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FDA8FC46-0F9A-4A8C-8764-3B80880A9AEB}	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreClass	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreClass\CLSID\ = "{3A337332-37E4-4063-B4F3-6416846C8A33}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C416C376-AEC5-4443-9D90-BEBA9434763B}\NumMethods\ = "10"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DC422F86-7267-4AF2-8F4F-A20C060621DE}\ProxyStubClsid32\ = "{97E0A5E2-76BC-43F6-8DDC-3E07A738E45E}"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{60ACA18E-54E6-43F8-A1A4-C4176B6C994E}\ProxyStubClsid32	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}\ = "DropboxUpdate Update3Web"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreClass.1\CLSID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3D412914-1C4F-447D-80D2-E7F9BB302B05}\ProxyStubClsid32	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\ProgID	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachineFallback\ = "DropboxUpdate Update3Web"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B35122D2-0036-4536-AEEA-EEA68E54A460}\NumMethods	DropboxUpdate.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

DropboxUpdate.exeDropboxUpdate.exeDropboxUpdate.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD	DropboxUpdate.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd1900000001000000100000003b878212830eb36469856f1c683b836c040000000100000010000000e67b586f7046bfe0aa51f6660b119dd90f00000001000000200000003689022b62bd20e807ccc1f32720ab2a9eeb0712e84cc373464b29cc436def97140000000100000014000000b76ba2eaa8aa848c79eab4da0f98b2c59576b9f41800000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee4b0000000100000044000000420033003900380042003800300031003300340046003700320032003000390035003400370034003300390044004200320031004100420033003000380044005f0000002000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	DropboxUpdate.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	DropboxUpdate.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	DropboxUpdate.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	DropboxUpdate.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	DropboxUpdate.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

DropboxUpdate.exemsiexec.exe

pid process

1472 DropboxUpdate.exe
1220 msiexec.exe
1220 msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

DropboxUpdate.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	1472	DropboxUpdate.exe
Token: SeShutdownPrivilege	1472	DropboxUpdate.exe
Token: SeIncreaseQuotaPrivilege	1472	DropboxUpdate.exe
Token: SeRestorePrivilege	1220	msiexec.exe
Token: SeTakeOwnershipPrivilege	1220	msiexec.exe
Token: SeSecurityPrivilege	1220	msiexec.exe
Token: SeCreateTokenPrivilege	1472	DropboxUpdate.exe
Token: SeAssignPrimaryTokenPrivilege	1472	DropboxUpdate.exe
Token: SeLockMemoryPrivilege	1472	DropboxUpdate.exe
Token: SeIncreaseQuotaPrivilege	1472	DropboxUpdate.exe
Token: SeMachineAccountPrivilege	1472	DropboxUpdate.exe
Token: SeTcbPrivilege	1472	DropboxUpdate.exe
Token: SeSecurityPrivilege	1472	DropboxUpdate.exe
Token: SeTakeOwnershipPrivilege	1472	DropboxUpdate.exe
Token: SeLoadDriverPrivilege	1472	DropboxUpdate.exe
Token: SeSystemProfilePrivilege	1472	DropboxUpdate.exe
Token: SeSystemtimePrivilege	1472	DropboxUpdate.exe
Token: SeProfSingleProcessPrivilege	1472	DropboxUpdate.exe
Token: SeIncBasePriorityPrivilege	1472	DropboxUpdate.exe
Token: SeCreatePagefilePrivilege	1472	DropboxUpdate.exe
Token: SeCreatePermanentPrivilege	1472	DropboxUpdate.exe
Token: SeBackupPrivilege	1472	DropboxUpdate.exe
Token: SeRestorePrivilege	1472	DropboxUpdate.exe
Token: SeShutdownPrivilege	1472	DropboxUpdate.exe
Token: SeDebugPrivilege	1472	DropboxUpdate.exe
Token: SeAuditPrivilege	1472	DropboxUpdate.exe
Token: SeSystemEnvironmentPrivilege	1472	DropboxUpdate.exe
Token: SeChangeNotifyPrivilege	1472	DropboxUpdate.exe
Token: SeRemoteShutdownPrivilege	1472	DropboxUpdate.exe
Token: SeUndockPrivilege	1472	DropboxUpdate.exe
Token: SeSyncAgentPrivilege	1472	DropboxUpdate.exe
Token: SeEnableDelegationPrivilege	1472	DropboxUpdate.exe
Token: SeManageVolumePrivilege	1472	DropboxUpdate.exe
Token: SeImpersonatePrivilege	1472	DropboxUpdate.exe
Token: SeCreateGlobalPrivilege	1472	DropboxUpdate.exe
Token: SeRestorePrivilege	1220	msiexec.exe
Token: SeTakeOwnershipPrivilege	1220	msiexec.exe
Token: SeRestorePrivilege	1220	msiexec.exe
Token: SeTakeOwnershipPrivilege	1220	msiexec.exe
Token: SeRestorePrivilege	1220	msiexec.exe
Token: SeTakeOwnershipPrivilege	1220	msiexec.exe
Token: SeRestorePrivilege	1220	msiexec.exe
Token: SeTakeOwnershipPrivilege	1220	msiexec.exe
Token: SeRestorePrivilege	1220	msiexec.exe
Token: SeTakeOwnershipPrivilege	1220	msiexec.exe
Token: SeRestorePrivilege	1220	msiexec.exe
Token: SeTakeOwnershipPrivilege	1220	msiexec.exe
Token: SeRestorePrivilege	1220	msiexec.exe
Token: SeTakeOwnershipPrivilege	1220	msiexec.exe
Token: SeRestorePrivilege	1220	msiexec.exe
Token: SeTakeOwnershipPrivilege	1220	msiexec.exe
Token: SeRestorePrivilege	1220	msiexec.exe
Token: SeTakeOwnershipPrivilege	1220	msiexec.exe
Token: SeRestorePrivilege	1220	msiexec.exe
Token: SeTakeOwnershipPrivilege	1220	msiexec.exe
Token: SeRestorePrivilege	1220	msiexec.exe
Token: SeTakeOwnershipPrivilege	1220	msiexec.exe
Token: SeRestorePrivilege	1220	msiexec.exe
Token: SeTakeOwnershipPrivilege	1220	msiexec.exe
Token: SeRestorePrivilege	1220	msiexec.exe
Token: SeTakeOwnershipPrivilege	1220	msiexec.exe
Token: SeRestorePrivilege	1220	msiexec.exe
Token: SeTakeOwnershipPrivilege	1220	msiexec.exe
Token: SeRestorePrivilege	1220	msiexec.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

DropboxInstaller.exeDropboxUpdate.exeDropboxUpdate.exe

description	pid	process	target process
PID 2020 wrote to memory of 1472	2020	DropboxInstaller.exe	DropboxUpdate.exe
PID 2020 wrote to memory of 1472	2020	DropboxInstaller.exe	DropboxUpdate.exe
PID 2020 wrote to memory of 1472	2020	DropboxInstaller.exe	DropboxUpdate.exe
PID 2020 wrote to memory of 1472	2020	DropboxInstaller.exe	DropboxUpdate.exe
PID 2020 wrote to memory of 1472	2020	DropboxInstaller.exe	DropboxUpdate.exe
PID 2020 wrote to memory of 1472	2020	DropboxInstaller.exe	DropboxUpdate.exe
PID 2020 wrote to memory of 1472	2020	DropboxInstaller.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1868	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1868	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1868	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1868	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1868	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1868	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1868	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1836	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1836	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1836	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1836	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1836	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1836	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1836	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1696	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1696	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1696	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1696	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1696	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1696	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1696	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1632	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1632	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1632	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1632	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1632	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1632	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1472 wrote to memory of 1632	1472	DropboxUpdate.exe	DropboxUpdate.exe
PID 1380 wrote to memory of 840	1380	DropboxUpdate.exe	DropboxClient_161.4.4923.exe
PID 1380 wrote to memory of 840	1380	DropboxUpdate.exe	DropboxClient_161.4.4923.exe
PID 1380 wrote to memory of 840	1380	DropboxUpdate.exe	DropboxClient_161.4.4923.exe
PID 1380 wrote to memory of 840	1380	DropboxUpdate.exe	DropboxClient_161.4.4923.exe
PID 1380 wrote to memory of 840	1380	DropboxUpdate.exe	DropboxClient_161.4.4923.exe
PID 1380 wrote to memory of 840	1380	DropboxUpdate.exe	DropboxClient_161.4.4923.exe
PID 1380 wrote to memory of 840	1380	DropboxUpdate.exe	DropboxClient_161.4.4923.exe

C:\Users\Admin\AppData\Local\Temp\DropboxInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\DropboxInstaller.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\DropboxUpdate.exe
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\DropboxUpdate.exe /installsource taggedmi /install "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjpmaXJlZm94OjplSndOeTdFS3dqQVFBTkJmS1psRmVuZkpYZUlZVUVHbGkwUEhVazFMcXpRQkUzVVFfMTNmX2o2cWY1YXBLLWstUkxXcDFOVDZfV1VwLW5ZODdmcEg2NjktR1Y5eDI1elR1emxJQ0d0Z0ZyRklSR3BWcVR6a1BLZll6ZUdmZ1VTQVdBc2JRaVEyV0FOWXkxZzc0NndtSVdlTTRQY0hOcG9na3d-fkBNRVRBIn0"
2⤵
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1472

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regsvc
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1868

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regserver
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
PID:1836

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcG1hWEpsWm05NE9qcGxTbmRPZVRkRlMzZHFRVkZCVGtKbVMxcHNSbVZ1WmtwWVpVbFpWVVZIYkdrd1VFaFZhekZNY1hwUlFrVXpWVkZmTVRObVgybzJjV1kxWVhCTExXc3RVa3hYY0RGT1ZEWmZWMVZ3TFc1Wk9EZG1jRWcyTmprdFIxWTVlREkxZWxSMWVteEpRMGQwWjBaeVJrbFNSM0JXY1ZSNmExQkxabGw2WlVkbVoxVlRRVmRCYzJKUmFWRXlWMEZPV1hreFp6YzBObmR0U1ZkbFRUUlFZMGhPY0c5bmEzZC1ma0JOUlZSQkluMCIgcHJvdG9jb2w9IjMuMCIgdmVyc2lvbj0iMS4zLjYzOS4xIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezM0Q0UyN0NDLTE3MjMtNEM5Mi05RkMwLTFERDBGQjIxQ0Q0OH0iIHVzZXJpZD0iezA2RDY3NEQzLTUyQUItNDczNy05NkM3LTk3NENCRTMyQUNBMX0iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9InszQTVGQjUyQS03RjQ1LTRDMkItOUFFQS0yRUNDRUQ5MTYzNEJ9Ij48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RDg5NjhGRjItRTBCMS00QTEzLUEzRTItQzlGMjk5NUYzQkM2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjYzOS4xIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:1696

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /handoff "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjpmaXJlZm94OjplSndOeTdFS3dqQVFBTkJmS1psRmVuZkpYZUlZVUVHbGkwUEhVazFMcXpRQkUzVVFfMTNmX2o2cWY1YXBLLWstUkxXcDFOVDZfV1VwLW5ZODdmcEg2NjktR1Y5eDI1elR1emxJQ0d0Z0ZyRklSR3BWcVR6a1BLZll6ZUdmZ1VTQVdBc2JRaVEyV0FOWXkxZzc0NndtSVdlTTRQY0hOcG9na3d-fkBNRVRBIn0&nolaunch=0" /installsource taggedmi /sessionid "{34CE27CC-1723-4C92-9FC0-1DD0FB21CD48}"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1220

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1380

C:\Program Files (x86)\Dropbox\Update\Install\{B2BFE9E6-5349-4CEA-AC5F-E1A182B280A8}\DropboxClient_161.4.4923.exe
"C:\Program Files (x86)\Dropbox\Update\Install\{B2BFE9E6-5349-4CEA-AC5F-E1A182B280A8}\DropboxClient_161.4.4923.exe" /S /DBData:eyJUQUdTIjoiREJQUkVBVVRIOjpmaXJlZm94OjplSndOeTdFS3dqQVFBTkJmS1psRmVuZkpYZUlZVUVHbGkwUEhVazFMcXpRQkUzVVFfMTNmX2o2cWY1YXBLLWstUkxXcDFOVDZfV1VwLW5ZODdmcEg2NjktR1Y5eDI1elR1emxJQ0d0Z0ZyRklSR3BWcVR6a1BLZll6ZUdmZ1VTQVdBc2JRaVEyV0FOWXkxZzc0NndtSVdlTTRQY0hOcG9na3d-fkBNRVRBIiwib21haGEtaW5zdGFsbGVyLWlkIjoiezA2RDY3NEQzLTUyQUItNDczNy05NkM3LTk3NENCRTMyQUNBMX0iLCJyZXF1ZXN0X3NlcXVlbmNlIjowfQ /InstallType:MACHINE
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:840

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:856

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x470
1⤵
PID:1408

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Dropbox\Update\1.3.639.1\DropboxUpdateHelper.msi
Filesize
26KB

MD5
d78d0fe3a00f46774880f12e14f7394c

SHA1
62e4d7ddd5e46d227ca2e571daa1e466f64bea66

SHA256
08ea4b27abcc2506163f41d64611e29beae769e2fbeff6ad374723bba9520827

SHA512
64d081f9562aea4729531713f8483cc97f1cc0f5317c5a39d5036088c9a3808fe5868bc07d7e87113170e7e6e4b7e61fa79a20e4449b69874d10de1768d30018

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdate.dll
Filesize
1.1MB

MD5
45e5f57ab16e4e6654464da44ebe5852

SHA1
bd45e57b3c1c7c6a1c21798ad4b2fb1a59e41ece

SHA256
b8d072135296abb0e99bf990874c6502e464af24cb9cbacf53a1095f1072e677

SHA512
698e0306d5a2f69c77569e6ca79d588e3c19668fa29f03c9f4421e4ab029e101143d8cccba4c40d79405cfc5e3121c5a477353422cb9dffd18aea68aba0b729d

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_en.dll
Filesize
31KB

MD5
0d5ad989075908469c249863555716d5

SHA1
ebb71e00051ded8d51fb7b42a8e1229f8b1fd8c5

SHA256
06ca8649fd52527c0df92d759ebae442ed7efdad3d45cef220f4d7d14aefca2f

SHA512
d548bdbb808e19cc8375fb3b3ac9855422a28450d6006749b5fd3669402b9f3bfa2c96e99661b70976e87ed658e4f7416392839c1c0dd6b5052814097101ecd3

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.639.1\psmachine.dll
Filesize
211KB

MD5
edb5981a474ad37c298c748d11247c8e

SHA1
474bd029fd83ea4feaabf310052f5bd9b6c59735

SHA256
f82caa4b49ac69496abe401286608c720d5db0a479b530b44de6f93502bae9f7

SHA512
56afe39eedf6e2e06218acf5c63f3c7fe92f210e241c19e85382835001084526152c45a6b62e8f0b5c25994eb6c114e2f989bc82c47b2aab3312f4852a59428c

Download Submit
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Filesize
127KB

MD5
8ad76e0b347bb690697535ce95b1c656

SHA1
10d2622a3965d21215a953ed924d01788a9805ed

SHA256
7655221b493047c61285e1de78807d0584920b0d14d150e2487da9728b1926f3

SHA512
35fbda7f05865b3a50454dba5ba3738eb8a5fd6d2eea5e9415d8d517811d51c50cca6c7b47a5b19f1ff1f4101567137fe18805f4f740289456da1ff2af682504

Download Submit
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Filesize
127KB

MD5
8ad76e0b347bb690697535ce95b1c656

SHA1
10d2622a3965d21215a953ed924d01788a9805ed

SHA256
7655221b493047c61285e1de78807d0584920b0d14d150e2487da9728b1926f3

SHA512
35fbda7f05865b3a50454dba5ba3738eb8a5fd6d2eea5e9415d8d517811d51c50cca6c7b47a5b19f1ff1f4101567137fe18805f4f740289456da1ff2af682504

Download Submit
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Filesize
127KB

MD5
8ad76e0b347bb690697535ce95b1c656

SHA1
10d2622a3965d21215a953ed924d01788a9805ed

SHA256
7655221b493047c61285e1de78807d0584920b0d14d150e2487da9728b1926f3

SHA512
35fbda7f05865b3a50454dba5ba3738eb8a5fd6d2eea5e9415d8d517811d51c50cca6c7b47a5b19f1ff1f4101567137fe18805f4f740289456da1ff2af682504

Download Submit
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Filesize
127KB

MD5
8ad76e0b347bb690697535ce95b1c656

SHA1
10d2622a3965d21215a953ed924d01788a9805ed

SHA256
7655221b493047c61285e1de78807d0584920b0d14d150e2487da9728b1926f3

SHA512
35fbda7f05865b3a50454dba5ba3738eb8a5fd6d2eea5e9415d8d517811d51c50cca6c7b47a5b19f1ff1f4101567137fe18805f4f740289456da1ff2af682504

Download Submit
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Filesize
127KB

MD5
8ad76e0b347bb690697535ce95b1c656

SHA1
10d2622a3965d21215a953ed924d01788a9805ed

SHA256
7655221b493047c61285e1de78807d0584920b0d14d150e2487da9728b1926f3

SHA512
35fbda7f05865b3a50454dba5ba3738eb8a5fd6d2eea5e9415d8d517811d51c50cca6c7b47a5b19f1ff1f4101567137fe18805f4f740289456da1ff2af682504

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\DropboxCrashHandler.exe
Filesize
129KB

MD5
5ecee6fc156527757209c82a4edf19ca

SHA1
653f9234e467efce1fced8b3885047fc13a2b9f3

SHA256
c8d370e15e744b49c46bd0f350d5474541a5ca17b0b438db2ad76733127f89b4

SHA512
795401d771f4d5f94a8e2507c0169acd678327f854eb64548b0e665a5586614f5f96ec52f625543010d1254308e9925cdf8cb98a2b69c18ee9053364b1997151

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\DropboxUpdate.exe
Filesize
127KB

MD5
8ad76e0b347bb690697535ce95b1c656

SHA1
10d2622a3965d21215a953ed924d01788a9805ed

SHA256
7655221b493047c61285e1de78807d0584920b0d14d150e2487da9728b1926f3

SHA512
35fbda7f05865b3a50454dba5ba3738eb8a5fd6d2eea5e9415d8d517811d51c50cca6c7b47a5b19f1ff1f4101567137fe18805f4f740289456da1ff2af682504

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\DropboxUpdate.exe
Filesize
127KB

MD5
8ad76e0b347bb690697535ce95b1c656

SHA1
10d2622a3965d21215a953ed924d01788a9805ed

SHA256
7655221b493047c61285e1de78807d0584920b0d14d150e2487da9728b1926f3

SHA512
35fbda7f05865b3a50454dba5ba3738eb8a5fd6d2eea5e9415d8d517811d51c50cca6c7b47a5b19f1ff1f4101567137fe18805f4f740289456da1ff2af682504

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\DropboxUpdateBroker.exe
Filesize
75KB

MD5
cfde3292ed966039846bc5b321bff1b2

SHA1
3ea1222f920b6534e118cd7170b3df9c6a62dc7a

SHA256
d97b011e58461d7c2ad9c2226f185708836ce1971de8fe2bf7deeac81e54f89f

SHA512
0976a8330e90b4fe7e85761dde9897ea08b3851d4dae0107fe4aa3179c9a4e08201dade6912df84ac467fd4146b098f5beaaaaf6150109b9bf5c6fc4c2f3d9da

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\DropboxUpdateHelper.msi
Filesize
26KB

MD5
d78d0fe3a00f46774880f12e14f7394c

SHA1
62e4d7ddd5e46d227ca2e571daa1e466f64bea66

SHA256
08ea4b27abcc2506163f41d64611e29beae769e2fbeff6ad374723bba9520827

SHA512
64d081f9562aea4729531713f8483cc97f1cc0f5317c5a39d5036088c9a3808fe5868bc07d7e87113170e7e6e4b7e61fa79a20e4449b69874d10de1768d30018

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\DropboxUpdateOnDemand.exe
Filesize
75KB

MD5
2b361afa23729bf6139b99a1168957b6

SHA1
eb07cfca1d372eb59c4a74de9236b380c076dfae

SHA256
3d6efe7c4671b3e11a09b3df7a1fee3434dd6b71a43c10bd9181e10a1e7941e3

SHA512
a63e46dc5d1a85593f11a529f8f4ef2fecf9cce6369b0244d9f70e1d99953473d1cfd6aa94af9e9e2cdd0493b2e6c96f9a5eaa8af35ffbc5834f66d3edb46b00

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdate.dll
Filesize
1.1MB

MD5
45e5f57ab16e4e6654464da44ebe5852

SHA1
bd45e57b3c1c7c6a1c21798ad4b2fb1a59e41ece

SHA256
b8d072135296abb0e99bf990874c6502e464af24cb9cbacf53a1095f1072e677

SHA512
698e0306d5a2f69c77569e6ca79d588e3c19668fa29f03c9f4421e4ab029e101143d8cccba4c40d79405cfc5e3121c5a477353422cb9dffd18aea68aba0b729d

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdateres_da.dll
Filesize
32KB

MD5
1301bc60c2424f69f091ababcc86f8cc

SHA1
6206159e28a00531876e9ad6f0093b945cf91c38

SHA256
9a48be8e60d43e968f6600e73391c97ed4cb9661dd1e917d335d014bf1e7b228

SHA512
8a5e1296d92dd8ac66d577efb75a5191bc27a881f8779b208322ad71f7cf952dc316f223be462f0776dd216505bb8c019c91c54dab5422f677e795f35ef60837

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdateres_de.dll
Filesize
35KB

MD5
c5e6a073fffc6683cde32b96599c7725

SHA1
7592cbce63335a407f207fa6ae8f0956f0ddd0dc

SHA256
3a01c8cd5c2a586ca17f724bbfd526d1801d1697992f2993d561c190f55da0b7

SHA512
b12c890143eaea7d5d28b41666833eb29298b4a68ef6eebcaf8b8e59f97d5e8bbb303ab631681d9c7d5d39efd5656360dff42a8cc5545fbef3355d26e4b11e74

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdateres_en.dll
Filesize
31KB

MD5
0d5ad989075908469c249863555716d5

SHA1
ebb71e00051ded8d51fb7b42a8e1229f8b1fd8c5

SHA256
06ca8649fd52527c0df92d759ebae442ed7efdad3d45cef220f4d7d14aefca2f

SHA512
d548bdbb808e19cc8375fb3b3ac9855422a28450d6006749b5fd3669402b9f3bfa2c96e99661b70976e87ed658e4f7416392839c1c0dd6b5052814097101ecd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdateres_es-419.dll
Filesize
33KB

MD5
7df80b6d573b6b3dcf6a4a0105ada9f8

SHA1
890a90f7bf97615a085712e82747feee724f8e75

SHA256
cc3e874c666cf935b3f1ddc449a946236aab95589fdfc05f631c92dc47576d0a

SHA512
e593218873793618aa930a1c3c2c17235d6abe0abf8985f50afabd76cbfe89d4e932b853020adc0043a0b47200231646a5424356e99ea8c0d8b20c580a230fb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdateres_es.dll
Filesize
33KB

MD5
86c2d7187b461398c58bed0c7e48d93b

SHA1
6f82a85337ec02f14e72d6697fef5b9d120c2447

SHA256
509b126b249def0468be289fbac4ce959059c1c3b982e7670a39291f67ac5a6b

SHA512
f32609b9976d60d129255b14e42a7e00cdc974bb41509512cf793377208c0fa6c36cb3ada69d1064804f497e0c1566926bec5b19a8b2b287c6d84d1e8d8dd9af

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdateres_fr.dll
Filesize
34KB

MD5
47d6198d8afc654b1357f886d51390d2

SHA1
e143e62ecc00246f13ce710cd68921d78f8d5258

SHA256
0b864b03fa21e972935b028f3e3e5c2b344e04d84bf8e844fded43d5c6f13ef9

SHA512
433708332cec3bf639e53522ae62b4d89689ac0d918ea5546fa25690598bf7a0600d3dc853cdc1605d569f04f49a2b76f3fd3d1281c6e92a65fbf10901d6b278

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdateres_id.dll
Filesize
31KB

MD5
b4972522aa429f03d3ef5cb1cfeb4275

SHA1
339389e671082d74954efc8ca78c4354383eed9c

SHA256
3d4983be545b604a083f0aa4e083b91037e015ac7db6a4b4d878023b5d9ef58b

SHA512
30f2bc58a1d97b1ea809bffc93d317573330877653ea180553ec57f8d98dff51aadc393a1ebe7b19eb992283122703a505b77cb7f054954f20efc202702f734c

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdateres_it.dll
Filesize
33KB

MD5
dd28fafdd50ffe47460bd6a7ed845b03

SHA1
6331f86cb24014c2e06033802171d3339a013bfd

SHA256
072429ae6fb3a7a2d145bfa7fce3be89f98d75636238ab665294500bac45d89c

SHA512
f5428a9350ab8b029423562f1fa75b7b5dc1cb03b2434cd15bbbe1224fd711d50304d7857320ce4d6499fd8e112e9e5edbfd115bdbdbc26fbcb383d96411e5e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdateres_ja.dll
Filesize
27KB

MD5
750f92b58c34c03651cad14fd0eae455

SHA1
59e4130a0131b02994901e32575f88f6ba8e54f6

SHA256
3389597240ddf453a4c396777ccf80fafd7fa80aefe8ff9ae5a4ba924323f703

SHA512
2a023bad31f3e18134cd4400f669291d7fb4740e5057d0a8162f3f5e949b0f9f556f403cb1f2c337797872374fa8102b0c8b6df5130140d87517b93b7e9c8be7

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdateres_ko.dll
Filesize
27KB

MD5
097ac7365616670974c6f39660938ff6

SHA1
6167611b08fc3f3b23018cb9d05f015c642004bf

SHA256
acfdffd0e58a985518363f4c703ceb4429b5470cdc62404e0a9b9af3fe1726bd

SHA512
705eebfde9211cf5b9f66589eb42b0d27274ecffbc0b9f706e1141a1b357f2140d4c6760dfbd97b44a2ae69821b44f9c8df259c84591e093209163f06397a1cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdateres_ms.dll
Filesize
31KB

MD5
80305b659dc0b77578476d179f5e5a56

SHA1
337f00f964eea37ab0f3d7bef28ae0abfc46d509

SHA256
6aa2021733ab522144d16567253d565f95a3bae548995c8c7412405a9a4dda6a

SHA512
46658f76570f61a72577342c8506a700a7028c2ba9859246f1a119cf919c32d3836eddbd92bf83974c987f661e0c99dfee75d85cca46684d0b8d8a6e03325a55

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdateres_nl.dll
Filesize
34KB

MD5
f51d31df7a086e6c001686086f977d35

SHA1
5407e4f85e279d2bc5a5336bf109ca0c46c91e0a

SHA256
c046cbca2d077a222158a2d95f6cbfa229e8032a2395be6e16a1565917a65246

SHA512
d1799a43beef4f3c70ac35497d10260ed324bca62f212082bf72a70bd1edab7ff48f2f5e87c7c5d9d637a5883297bbf62efeeec546a03d975877e13fa2bb88a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdateres_no.dll
Filesize
32KB

MD5
b6615b35d0905c9ca2e39678bf85bfc5

SHA1
62de31d5f991cdcbeb967ab309e3bd054927fec7

SHA256
dde7f7dddccba5b3e234e7a9af2152035ba1a044f27fb2fac65f709479ae26a6

SHA512
403deaf8a94cb5422f5749ec5c437380c4da1654e5d44910408f3681cb9a7909d841a5a38c9c6cce21fe7203581edbae655d1bba2c1caf46b1b0f906c5ca1451

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdateres_pl.dll
Filesize
33KB

MD5
0dac0bbc2244b10d540c8b07dcc331bb

SHA1
da4acc32d893f1af61b779d3257f97779c948e7b

SHA256
e65adf5cf4eb50b041855400440095c9ac9fd828f717483ef8aad6737cd170a9

SHA512
f5c698f22ebdcf8e6f241dfbe31251222043ef3367bb008f2d0e7fa8d9a5c087ecf006153d12a08baf0c52c9864e8910af6e60c21efd22c7c37bc720bc185516

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdateres_pt-BR.dll
Filesize
32KB

MD5
7aacf25f28084badfd5c6c9850ae8f0e

SHA1
122da522d5bb3c28b20128b80a4b70159711b793

SHA256
f76edb5594f35563894f6d67c70a5fc6e200b4e00145345d72d83d453c516402

SHA512
dde22d81a0cc81ca506649fc43b43f02a19c0f2dc14d0a76a97ca10d2d666c942e361221bc2a2f38550b3e7d5f86b62a6c0efac536730ff11144a91a8003df1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdateres_ru.dll
Filesize
33KB

MD5
abd331d37909e716ec5d35bd83b8cec3

SHA1
6ffdba22f3f8bd9007f69f94fc01d1381843f9fc

SHA256
d916fe1ca6a7ffeeeca2032a765db9c962dde321fd7e293d403146ab92c08467

SHA512
98f0c72e8684728f86d53232ede862cdc65a6a0c527fcfbdea4a889526026cbc5608acf0ea14a46ed113d43b03c8cfa01d1ef9dd015abee9b20c9f2de9a14626

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdateres_sv.dll
Filesize
32KB

MD5
ef762fe5636b17c491444e886dead158

SHA1
48e24cc58b4d402bdf6a40454cedeb30df72c708

SHA256
eb54da8396fe8ffe32c416357a6cebd36092cdb17bc3aae10ebf1d035abd9473

SHA512
9751abb250243d281b052ad56109fcb08390082d88307c4c930ffa25bbb34c849d54d7258e83e8c6ea51165aa9f8540e15b09f93e4a4b35bf8140de68289ffc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdateres_th.dll
Filesize
31KB

MD5
267fc12ea91ff17401bf6f59f695d1ac

SHA1
828315d0e1d3bede5c49e8df15164135f6c4150b

SHA256
e698f6be6d98549b7c01149d892fc934951534476715235d28c6afca30ef0958

SHA512
da982cf7698dd48751e1b8ad73251f35e5b71f80401a1e430fd1020c9eb9f26d3dd3226f5a7af49613df1ce9203d4e83e23d6ee54c7e4e49113cd510a9a057d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdateres_uk.dll
Filesize
32KB

MD5
aa09c8a1c612c494292a47fd07d1f2f9

SHA1
eba0dab28e9adb8d45b93b86697a6f2d9121264b

SHA256
a9737cf7ccd2f05eacd65ba898cd5084c9ea0c264d826803adce72a1691b228a

SHA512
59df99e57bfc2ea53a2732cf1c18d417f725eab2780f18cd56d10ec6786974d16df6763ea00c270bba666a1946b29ba40b80194680b6391e41e060e27d449714

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdateres_zh-CN.dll
Filesize
25KB

MD5
4115e2ea20b4faeef97d419595e993ef

SHA1
dcd23fa5536c9c5202e934bc8f43ba1ee33cb2e9

SHA256
17c88571ef3929a0d50df0211135a95d8aa0eb0ea1fc69c0ab9b36a7e1432a61

SHA512
828ef190e204f83d0b2c87a6fde74f9ed2b5550c9cdb9c6c48699ab3912bc3b4a6f76673b1bcbf8dade7756af72c9afe4e411d5ac15fbcaf2cb94eb4b6d6db6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdateres_zh-TW.dll
Filesize
25KB

MD5
d4852f657e4ac4fe693f62f336bd275f

SHA1
f407950da73032ed2f30e918ba69e6b42fb6d938

SHA256
ee9eb7898c451a1ef7756b5c721f03d452deda45a99fea3566afb8ab1ec46d1b

SHA512
9fd012bdb3dc130d045d342ceab0dec154db208001cf4d84d576e787645c5de48263d90969d683cca107a14687928ebd938c0b8726f883a6231c7fe6923acb66

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\npDropboxUpdate3.dll
Filesize
273KB

MD5
06e53e63294e29d1da4312a357b5b68c

SHA1
3ee051135178e79d5a8009afed483fd21ea1a95d

SHA256
6191829d054a53ea394a26a57f72f7dad4b683c471da341d09cf27362eb5942e

SHA512
e5463c844e60bea5e502e460fd03358a3f083053457135c5dbc29a32820593662bb34ce60224df612d2d5a0313a89d14519fa9a79ef0181ac88d087d36ebc7be

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\psmachine.dll
Filesize
211KB

MD5
edb5981a474ad37c298c748d11247c8e

SHA1
474bd029fd83ea4feaabf310052f5bd9b6c59735

SHA256
f82caa4b49ac69496abe401286608c720d5db0a479b530b44de6f93502bae9f7

SHA512
56afe39eedf6e2e06218acf5c63f3c7fe92f210e241c19e85382835001084526152c45a6b62e8f0b5c25994eb6c114e2f989bc82c47b2aab3312f4852a59428c

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM8769.tmp\psuser.dll
Filesize
211KB

MD5
d6ef3bd5cf6aaf2beb7ab2522a4b87c8

SHA1
ca1e31529d7373f279f95e27b766950d640b0e8c

SHA256
2519303fd988ae8efaa15e7c8a294135565abbfcc94bfa4610ee0b66b002eef0

SHA512
916993d6a854810f55bbea647af428f5fd322d720513624c5880e7969133e12c886d54a4ecec951cae489e167054e1eff654c7c6983d17c082df99214b084a5c

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdate.dll
Filesize
1.1MB

MD5
45e5f57ab16e4e6654464da44ebe5852

SHA1
bd45e57b3c1c7c6a1c21798ad4b2fb1a59e41ece

SHA256
b8d072135296abb0e99bf990874c6502e464af24cb9cbacf53a1095f1072e677

SHA512
698e0306d5a2f69c77569e6ca79d588e3c19668fa29f03c9f4421e4ab029e101143d8cccba4c40d79405cfc5e3121c5a477353422cb9dffd18aea68aba0b729d

Download Submit
\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdate.dll
Filesize
1.1MB

MD5
45e5f57ab16e4e6654464da44ebe5852

SHA1
bd45e57b3c1c7c6a1c21798ad4b2fb1a59e41ece

SHA256
b8d072135296abb0e99bf990874c6502e464af24cb9cbacf53a1095f1072e677

SHA512
698e0306d5a2f69c77569e6ca79d588e3c19668fa29f03c9f4421e4ab029e101143d8cccba4c40d79405cfc5e3121c5a477353422cb9dffd18aea68aba0b729d

Download Submit
\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdate.dll
Filesize
1.1MB

MD5
45e5f57ab16e4e6654464da44ebe5852

SHA1
bd45e57b3c1c7c6a1c21798ad4b2fb1a59e41ece

SHA256
b8d072135296abb0e99bf990874c6502e464af24cb9cbacf53a1095f1072e677

SHA512
698e0306d5a2f69c77569e6ca79d588e3c19668fa29f03c9f4421e4ab029e101143d8cccba4c40d79405cfc5e3121c5a477353422cb9dffd18aea68aba0b729d

Download Submit
\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdate.dll
Filesize
1.1MB

MD5
45e5f57ab16e4e6654464da44ebe5852

SHA1
bd45e57b3c1c7c6a1c21798ad4b2fb1a59e41ece

SHA256
b8d072135296abb0e99bf990874c6502e464af24cb9cbacf53a1095f1072e677

SHA512
698e0306d5a2f69c77569e6ca79d588e3c19668fa29f03c9f4421e4ab029e101143d8cccba4c40d79405cfc5e3121c5a477353422cb9dffd18aea68aba0b729d

Download Submit
\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdate.dll
Filesize
1.1MB

MD5
45e5f57ab16e4e6654464da44ebe5852

SHA1
bd45e57b3c1c7c6a1c21798ad4b2fb1a59e41ece

SHA256
b8d072135296abb0e99bf990874c6502e464af24cb9cbacf53a1095f1072e677

SHA512
698e0306d5a2f69c77569e6ca79d588e3c19668fa29f03c9f4421e4ab029e101143d8cccba4c40d79405cfc5e3121c5a477353422cb9dffd18aea68aba0b729d

Download Submit
\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_en.dll
Filesize
31KB

MD5
0d5ad989075908469c249863555716d5

SHA1
ebb71e00051ded8d51fb7b42a8e1229f8b1fd8c5

SHA256
06ca8649fd52527c0df92d759ebae442ed7efdad3d45cef220f4d7d14aefca2f

SHA512
d548bdbb808e19cc8375fb3b3ac9855422a28450d6006749b5fd3669402b9f3bfa2c96e99661b70976e87ed658e4f7416392839c1c0dd6b5052814097101ecd3

Download Submit
\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_en.dll
Filesize
31KB

MD5
0d5ad989075908469c249863555716d5

SHA1
ebb71e00051ded8d51fb7b42a8e1229f8b1fd8c5

SHA256
06ca8649fd52527c0df92d759ebae442ed7efdad3d45cef220f4d7d14aefca2f

SHA512
d548bdbb808e19cc8375fb3b3ac9855422a28450d6006749b5fd3669402b9f3bfa2c96e99661b70976e87ed658e4f7416392839c1c0dd6b5052814097101ecd3

Download Submit
\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_en.dll
Filesize
31KB

MD5
0d5ad989075908469c249863555716d5

SHA1
ebb71e00051ded8d51fb7b42a8e1229f8b1fd8c5

SHA256
06ca8649fd52527c0df92d759ebae442ed7efdad3d45cef220f4d7d14aefca2f

SHA512
d548bdbb808e19cc8375fb3b3ac9855422a28450d6006749b5fd3669402b9f3bfa2c96e99661b70976e87ed658e4f7416392839c1c0dd6b5052814097101ecd3

Download Submit
\Program Files (x86)\Dropbox\Update\1.3.639.1\goopdateres_en.dll
Filesize
31KB

MD5
0d5ad989075908469c249863555716d5

SHA1
ebb71e00051ded8d51fb7b42a8e1229f8b1fd8c5

SHA256
06ca8649fd52527c0df92d759ebae442ed7efdad3d45cef220f4d7d14aefca2f

SHA512
d548bdbb808e19cc8375fb3b3ac9855422a28450d6006749b5fd3669402b9f3bfa2c96e99661b70976e87ed658e4f7416392839c1c0dd6b5052814097101ecd3

Download Submit
\Program Files (x86)\Dropbox\Update\1.3.639.1\npDropboxUpdate3.dll
Filesize
273KB

MD5
06e53e63294e29d1da4312a357b5b68c

SHA1
3ee051135178e79d5a8009afed483fd21ea1a95d

SHA256
6191829d054a53ea394a26a57f72f7dad4b683c471da341d09cf27362eb5942e

SHA512
e5463c844e60bea5e502e460fd03358a3f083053457135c5dbc29a32820593662bb34ce60224df612d2d5a0313a89d14519fa9a79ef0181ac88d087d36ebc7be

Download Submit
\Program Files (x86)\Dropbox\Update\1.3.639.1\psmachine.dll
Filesize
211KB

MD5
edb5981a474ad37c298c748d11247c8e

SHA1
474bd029fd83ea4feaabf310052f5bd9b6c59735

SHA256
f82caa4b49ac69496abe401286608c720d5db0a479b530b44de6f93502bae9f7

SHA512
56afe39eedf6e2e06218acf5c63f3c7fe92f210e241c19e85382835001084526152c45a6b62e8f0b5c25994eb6c114e2f989bc82c47b2aab3312f4852a59428c

Download Submit
\Program Files (x86)\Dropbox\Update\1.3.639.1\psmachine.dll
Filesize
211KB

MD5
edb5981a474ad37c298c748d11247c8e

SHA1
474bd029fd83ea4feaabf310052f5bd9b6c59735

SHA256
f82caa4b49ac69496abe401286608c720d5db0a479b530b44de6f93502bae9f7

SHA512
56afe39eedf6e2e06218acf5c63f3c7fe92f210e241c19e85382835001084526152c45a6b62e8f0b5c25994eb6c114e2f989bc82c47b2aab3312f4852a59428c

Download Submit
\Program Files (x86)\Dropbox\Update\1.3.639.1\psmachine.dll
Filesize
211KB

MD5
edb5981a474ad37c298c748d11247c8e

SHA1
474bd029fd83ea4feaabf310052f5bd9b6c59735

SHA256
f82caa4b49ac69496abe401286608c720d5db0a479b530b44de6f93502bae9f7

SHA512
56afe39eedf6e2e06218acf5c63f3c7fe92f210e241c19e85382835001084526152c45a6b62e8f0b5c25994eb6c114e2f989bc82c47b2aab3312f4852a59428c

Download Submit
\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Filesize
127KB

MD5
8ad76e0b347bb690697535ce95b1c656

SHA1
10d2622a3965d21215a953ed924d01788a9805ed

SHA256
7655221b493047c61285e1de78807d0584920b0d14d150e2487da9728b1926f3

SHA512
35fbda7f05865b3a50454dba5ba3738eb8a5fd6d2eea5e9415d8d517811d51c50cca6c7b47a5b19f1ff1f4101567137fe18805f4f740289456da1ff2af682504

Download Submit
\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Filesize
127KB

MD5
8ad76e0b347bb690697535ce95b1c656

SHA1
10d2622a3965d21215a953ed924d01788a9805ed

SHA256
7655221b493047c61285e1de78807d0584920b0d14d150e2487da9728b1926f3

SHA512
35fbda7f05865b3a50454dba5ba3738eb8a5fd6d2eea5e9415d8d517811d51c50cca6c7b47a5b19f1ff1f4101567137fe18805f4f740289456da1ff2af682504

Download Submit
\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Filesize
127KB

MD5
8ad76e0b347bb690697535ce95b1c656

SHA1
10d2622a3965d21215a953ed924d01788a9805ed

SHA256
7655221b493047c61285e1de78807d0584920b0d14d150e2487da9728b1926f3

SHA512
35fbda7f05865b3a50454dba5ba3738eb8a5fd6d2eea5e9415d8d517811d51c50cca6c7b47a5b19f1ff1f4101567137fe18805f4f740289456da1ff2af682504

Download Submit
\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Filesize
127KB

MD5
8ad76e0b347bb690697535ce95b1c656

SHA1
10d2622a3965d21215a953ed924d01788a9805ed

SHA256
7655221b493047c61285e1de78807d0584920b0d14d150e2487da9728b1926f3

SHA512
35fbda7f05865b3a50454dba5ba3738eb8a5fd6d2eea5e9415d8d517811d51c50cca6c7b47a5b19f1ff1f4101567137fe18805f4f740289456da1ff2af682504

Download Submit
\Users\Admin\AppData\Local\Temp\GUM8769.tmp\DropboxUpdate.exe
Filesize
127KB

MD5
8ad76e0b347bb690697535ce95b1c656

SHA1
10d2622a3965d21215a953ed924d01788a9805ed

SHA256
7655221b493047c61285e1de78807d0584920b0d14d150e2487da9728b1926f3

SHA512
35fbda7f05865b3a50454dba5ba3738eb8a5fd6d2eea5e9415d8d517811d51c50cca6c7b47a5b19f1ff1f4101567137fe18805f4f740289456da1ff2af682504

Download Submit
\Users\Admin\AppData\Local\Temp\GUM8769.tmp\DropboxUpdate.exe
Filesize
127KB

MD5
8ad76e0b347bb690697535ce95b1c656

SHA1
10d2622a3965d21215a953ed924d01788a9805ed

SHA256
7655221b493047c61285e1de78807d0584920b0d14d150e2487da9728b1926f3

SHA512
35fbda7f05865b3a50454dba5ba3738eb8a5fd6d2eea5e9415d8d517811d51c50cca6c7b47a5b19f1ff1f4101567137fe18805f4f740289456da1ff2af682504

Download Submit
\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdate.dll
Filesize
1.1MB

MD5
45e5f57ab16e4e6654464da44ebe5852

SHA1
bd45e57b3c1c7c6a1c21798ad4b2fb1a59e41ece

SHA256
b8d072135296abb0e99bf990874c6502e464af24cb9cbacf53a1095f1072e677

SHA512
698e0306d5a2f69c77569e6ca79d588e3c19668fa29f03c9f4421e4ab029e101143d8cccba4c40d79405cfc5e3121c5a477353422cb9dffd18aea68aba0b729d

Download Submit
\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdateres_en.dll
Filesize
31KB

MD5
0d5ad989075908469c249863555716d5

SHA1
ebb71e00051ded8d51fb7b42a8e1229f8b1fd8c5

SHA256
06ca8649fd52527c0df92d759ebae442ed7efdad3d45cef220f4d7d14aefca2f

SHA512
d548bdbb808e19cc8375fb3b3ac9855422a28450d6006749b5fd3669402b9f3bfa2c96e99661b70976e87ed658e4f7416392839c1c0dd6b5052814097101ecd3

Download Submit
\Users\Admin\AppData\Local\Temp\GUM8769.tmp\goopdateres_en.dll
Filesize
31KB

MD5
0d5ad989075908469c249863555716d5

SHA1
ebb71e00051ded8d51fb7b42a8e1229f8b1fd8c5

SHA256
06ca8649fd52527c0df92d759ebae442ed7efdad3d45cef220f4d7d14aefca2f

SHA512
d548bdbb808e19cc8375fb3b3ac9855422a28450d6006749b5fd3669402b9f3bfa2c96e99661b70976e87ed658e4f7416392839c1c0dd6b5052814097101ecd3

Download Submit
memory/840-129-0x0000000000000000-mapping.dmp

Download
memory/1220-100-0x000007FEFBAB1000-0x000007FEFBAB3000-memory.dmp

Filesize
8KB

Download
memory/1472-57-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1472-55-0x0000000000000000-mapping.dmp

Download
memory/1632-118-0x0000000000000000-mapping.dmp

Download
memory/1696-115-0x0000000000000000-mapping.dmp

Download
memory/1836-104-0x0000000000000000-mapping.dmp

Download
memory/1868-92-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads