26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4

Analysis

max time kernel
368s
max time network
439s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 20:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe
Size

72KB
MD5

006dd6e39f5264070c2c9b73fb9062a2
SHA1

9e06fa509179f477269af80df47887cf336e3551
SHA256

26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4
SHA512

30e89bc0891c051d866c9e10a135fa3041de1b5d56aa271df701664d5eeff084e231256dfa3127a1cf20a4750fec199748538107cc8e9edfaede192b11e9bb39
SSDEEP

384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2i:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPW

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 13 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe

Disables RegEdit via registry modification 26 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe

Executes dropped EXE 19 IoCs

pid	Process
4172	backup.exe
4176	backup.exe
3436	backup.exe
3680	backup.exe
4488	backup.exe
1528	backup.exe
3100	backup.exe
4388	backup.exe
3420	backup.exe
4516	update.exe
4152	backup.exe
4588	update.exe
2188	backup.exe
2764	backup.exe
3084	System Restore.exe
4644	backup.exe
4204	backup.exe
4572	backup.exe
4708	backup.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\backup.exe	update.exe
File opened for modification	C:\Program Files (x86)\Common Files\backup.exe	update.exe
File opened for modification	C:\Program Files\update.exe	backup.exe
File opened for modification	C:\Program Files (x86)\update.exe	backup.exe
File opened for modification	C:\Program Files\7-Zip\backup.exe	update.exe
File opened for modification	C:\Program Files\Common Files\System Restore.exe	update.exe
File opened for modification	C:\Program Files (x86)\Adobe\backup.exe	update.exe
File opened for modification	C:\Program Files\7-Zip\Lang\backup.exe	backup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\backup.exe	backup.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
3116	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe
4172	backup.exe
3436	backup.exe
4176	backup.exe
3680	backup.exe
4488	backup.exe
1528	backup.exe
4388	backup.exe
3100	backup.exe
3420	backup.exe
4516	update.exe
4152	backup.exe
4588	update.exe
2188	backup.exe
2764	backup.exe
3084	System Restore.exe
4644	backup.exe
4204	backup.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 4172	3116	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe	79
PID 3116 wrote to memory of 4172	3116	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe	79
PID 3116 wrote to memory of 4172	3116	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe	79
PID 3116 wrote to memory of 4176	3116	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe	80
PID 3116 wrote to memory of 4176	3116	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe	80
PID 3116 wrote to memory of 4176	3116	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe	80
PID 3116 wrote to memory of 3436	3116	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe	82
PID 3116 wrote to memory of 3436	3116	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe	82
PID 3116 wrote to memory of 3436	3116	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe	82
PID 4172 wrote to memory of 3680	4172	backup.exe	81
PID 4172 wrote to memory of 3680	4172	backup.exe	81
PID 4172 wrote to memory of 3680	4172	backup.exe	81
PID 3116 wrote to memory of 4488	3116	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe	83
PID 3116 wrote to memory of 4488	3116	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe	83
PID 3116 wrote to memory of 4488	3116	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe	83
PID 3680 wrote to memory of 1528	3680	backup.exe	84
PID 3680 wrote to memory of 1528	3680	backup.exe	84
PID 3680 wrote to memory of 1528	3680	backup.exe	84
PID 3116 wrote to memory of 3100	3116	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe	85
PID 3116 wrote to memory of 3100	3116	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe	85
PID 3116 wrote to memory of 3100	3116	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe	85
PID 3680 wrote to memory of 4388	3680	backup.exe	86
PID 3680 wrote to memory of 4388	3680	backup.exe	86
PID 3680 wrote to memory of 4388	3680	backup.exe	86
PID 3116 wrote to memory of 3420	3116	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe	87
PID 3116 wrote to memory of 3420	3116	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe	87
PID 3116 wrote to memory of 3420	3116	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe	87
PID 3680 wrote to memory of 4516	3680	backup.exe	88
PID 3680 wrote to memory of 4516	3680	backup.exe	88
PID 3680 wrote to memory of 4516	3680	backup.exe	88
PID 3116 wrote to memory of 4152	3116	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe	89
PID 3116 wrote to memory of 4152	3116	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe	89
PID 3116 wrote to memory of 4152	3116	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe	89
PID 3680 wrote to memory of 4588	3680	backup.exe	90
PID 3680 wrote to memory of 4588	3680	backup.exe	90
PID 3680 wrote to memory of 4588	3680	backup.exe	90
PID 4516 wrote to memory of 2188	4516	update.exe	91
PID 4516 wrote to memory of 2188	4516	update.exe	91
PID 4516 wrote to memory of 2188	4516	update.exe	91
PID 3680 wrote to memory of 2764	3680	backup.exe	93
PID 3680 wrote to memory of 2764	3680	backup.exe	93
PID 3680 wrote to memory of 2764	3680	backup.exe	93
PID 4516 wrote to memory of 3084	4516	update.exe	94
PID 4516 wrote to memory of 3084	4516	update.exe	94
PID 4516 wrote to memory of 3084	4516	update.exe	94
PID 4588 wrote to memory of 4644	4588	update.exe	96
PID 4588 wrote to memory of 4644	4588	update.exe	96
PID 4588 wrote to memory of 4644	4588	update.exe	96
PID 2188 wrote to memory of 4204	2188	backup.exe	95
PID 2188 wrote to memory of 4204	2188	backup.exe	95
PID 2188 wrote to memory of 4204	2188	backup.exe	95
PID 4516 wrote to memory of 4708	4516	update.exe	97
PID 4516 wrote to memory of 4708	4516	update.exe	97
PID 4516 wrote to memory of 4708	4516	update.exe	97
PID 3680 wrote to memory of 4572	3680	backup.exe	98
PID 3680 wrote to memory of 4572	3680	backup.exe	98
PID 3680 wrote to memory of 4572	3680	backup.exe	98

System policy modification 1 TTPs 52 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	System Restore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	System Restore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	System Restore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe

C:\Users\Admin\AppData\Local\Temp\26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe
"C:\Users\Admin\AppData\Local\Temp\26d328bb27be07ea86d6c074ee5559d0dd2c4d7daef24279d8eee7bbaeb49cf4.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3116
- C:\Users\Admin\AppData\Local\Temp\4221212162\backup.exe
  C:\Users\Admin\AppData\Local\Temp\4221212162\backup.exe C:\Users\Admin\AppData\Local\Temp\4221212162\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4172
- - C:\backup.exe
    \backup.exe \
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:3680
  - - C:\odt\backup.exe
      C:\odt\backup.exe C:\odt\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:1528
  - - C:\PerfLogs\backup.exe
      C:\PerfLogs\backup.exe C:\PerfLogs\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:4388
  - - C:\Program Files\update.exe
      "C:\Program Files\update.exe" C:\Program Files\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4516
    - - C:\Program Files\7-Zip\backup.exe
        
        "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2188
      - C:\Program Files\7-Zip\Lang\backup.exe
        
        "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4204
    - - C:\Program Files\Common Files\System Restore.exe
        
        "C:\Program Files\Common Files\System Restore.exe" C:\Program Files\Common Files\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:3084
    - - C:\Program Files\Google\backup.exe
        
        "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
        5⤵
        Executes dropped EXE
        
        PID:4708
  - - C:\Program Files (x86)\update.exe
      "C:\Program Files (x86)\update.exe" C:\Program Files (x86)\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4588
    - - C:\Program Files (x86)\Adobe\backup.exe
        
        "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4644
  - - C:\Users\backup.exe
      C:\Users\backup.exe C:\Users\
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2764
  - - C:\Windows\backup.exe
      C:\Windows\backup.exe C:\Windows\
      4⤵
      Executes dropped EXE
      PID:4572
- C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4176
- C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:3436
- C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4488
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:3100
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:3420
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:4152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\backup.exe

Filesize
72KB

MD5
acee9460676a8bcb42458a82564718eb

SHA1
89f1796797c4d1954882640c9f62452fc096e563

SHA256
4b8be37cf81ea93b26634f5c15a2b7b7407bbcbb1d9024f73b0499bc77bad492

SHA512
6253555caa72a7c9b2c3b3d2d6fc557028744b701f288d693cdbc65e82795a3e0af5d2c1129dfd44c96e857af0917c8e57b9c8927f6d447e07546d9c24763086

Download Submit
C:\PerfLogs\backup.exe

Filesize
72KB

MD5
acee9460676a8bcb42458a82564718eb

SHA1
89f1796797c4d1954882640c9f62452fc096e563

SHA256
4b8be37cf81ea93b26634f5c15a2b7b7407bbcbb1d9024f73b0499bc77bad492

SHA512
6253555caa72a7c9b2c3b3d2d6fc557028744b701f288d693cdbc65e82795a3e0af5d2c1129dfd44c96e857af0917c8e57b9c8927f6d447e07546d9c24763086

Download Submit
C:\Program Files (x86)\Adobe\backup.exe

Filesize
72KB

MD5
420ebd0e70723661782495e56ef0dbfa

SHA1
e3710f67bb2ce1dcf0a609392cfd11e782a5d474

SHA256
775db53b2f818c8b8dcc8acb08eed3bf2a485cb5b53e26d90a2cdbbfe18804e7

SHA512
4cfcbfb9b7c74ead4c383cda979239c5cfff5444e6cd543dbc41ae566fd63ee4a6a9d1d4b87c1ea7a218db8bd19443d4aac84d170bd6d3ddef156916b4a2ebbe

Download Submit
C:\Program Files (x86)\Adobe\backup.exe

Filesize
72KB

MD5
420ebd0e70723661782495e56ef0dbfa

SHA1
e3710f67bb2ce1dcf0a609392cfd11e782a5d474

SHA256
775db53b2f818c8b8dcc8acb08eed3bf2a485cb5b53e26d90a2cdbbfe18804e7

SHA512
4cfcbfb9b7c74ead4c383cda979239c5cfff5444e6cd543dbc41ae566fd63ee4a6a9d1d4b87c1ea7a218db8bd19443d4aac84d170bd6d3ddef156916b4a2ebbe

Download Submit
C:\Program Files (x86)\update.exe

Filesize
72KB

MD5
5ee8234273e1451c720e131f6c41a840

SHA1
7db7423abe791e9a07abf7abb419347bc4f6fbc8

SHA256
1c1c21e94714d7c7f9a728c07ef1d18665d76e5983536e7af7e2a65359d92990

SHA512
0bafea54457457252f69df0b28d53217895a303e3f785e0f622f9b3444e4ce1fcd6ec9e27c03b655dfa4d306ed9774a63b017100b6f0bee08ae808c622c2b066

Download Submit
C:\Program Files (x86)\update.exe

Filesize
72KB

MD5
5ee8234273e1451c720e131f6c41a840

SHA1
7db7423abe791e9a07abf7abb419347bc4f6fbc8

SHA256
1c1c21e94714d7c7f9a728c07ef1d18665d76e5983536e7af7e2a65359d92990

SHA512
0bafea54457457252f69df0b28d53217895a303e3f785e0f622f9b3444e4ce1fcd6ec9e27c03b655dfa4d306ed9774a63b017100b6f0bee08ae808c622c2b066

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
b0930c17daeca000d0c170b4fb2784f1

SHA1
398d7b30d27a0b10fb7f2a78b6dea60f229b76eb

SHA256
0fb3d410e50c0ea58e2b0ca9fb04c27c2ae1e6d064e8dfcfa2b0449d386c7c4c

SHA512
80a11ecdf314ee9a09a3ff6d23e4f0c692aaa60f0aef9196f413eb93209f45dce02c12b1554d05f8c1a5465cc168eb2d9023a25621880eaf1436f3ad50353a56

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
b0930c17daeca000d0c170b4fb2784f1

SHA1
398d7b30d27a0b10fb7f2a78b6dea60f229b76eb

SHA256
0fb3d410e50c0ea58e2b0ca9fb04c27c2ae1e6d064e8dfcfa2b0449d386c7c4c

SHA512
80a11ecdf314ee9a09a3ff6d23e4f0c692aaa60f0aef9196f413eb93209f45dce02c12b1554d05f8c1a5465cc168eb2d9023a25621880eaf1436f3ad50353a56

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
ce21b7b756a878aa656a61abedf30f8c

SHA1
715bbacd9e915f8311c7c23e69e9b81ba602cfed

SHA256
37e24dfd7f174f2328cb93cb47c018105fbfc45a1178b5852dc2d3e55f87a4ed

SHA512
84959a50351fd197e5fdd1fdc248ce40bd37508eb0950c1fa1bfbeeab3b33c1aa69dbceeb495f9a1cca9e00880d47b57c2f3fb332fca7c1d3f7ca290e697f160

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
ce21b7b756a878aa656a61abedf30f8c

SHA1
715bbacd9e915f8311c7c23e69e9b81ba602cfed

SHA256
37e24dfd7f174f2328cb93cb47c018105fbfc45a1178b5852dc2d3e55f87a4ed

SHA512
84959a50351fd197e5fdd1fdc248ce40bd37508eb0950c1fa1bfbeeab3b33c1aa69dbceeb495f9a1cca9e00880d47b57c2f3fb332fca7c1d3f7ca290e697f160

Download Submit
C:\Program Files\Common Files\System Restore.exe

Filesize
72KB

MD5
bf952dfe501cf977bda3e86622d3a181

SHA1
f78c9cfe7c4cb6e5948121867495faa01c4a07e7

SHA256
cf93cd12fd7317965d53a4d5f008dc3b5385402233645b317c067a8b63092646

SHA512
aa0821b2bfa4dc354b9635a1a09bc02f22fa823eb0a64dd448d4bd8e956fa153cff0ba068ef802aab5cafd25bc8ec442f97534528529f00a669ad86f9fa3e7df

Download Submit
C:\Program Files\Common Files\System Restore.exe

Filesize
72KB

MD5
bf952dfe501cf977bda3e86622d3a181

SHA1
f78c9cfe7c4cb6e5948121867495faa01c4a07e7

SHA256
cf93cd12fd7317965d53a4d5f008dc3b5385402233645b317c067a8b63092646

SHA512
aa0821b2bfa4dc354b9635a1a09bc02f22fa823eb0a64dd448d4bd8e956fa153cff0ba068ef802aab5cafd25bc8ec442f97534528529f00a669ad86f9fa3e7df

Download Submit
C:\Program Files\Google\backup.exe

Filesize
72KB

MD5
0a3c7d22d3ca04c0f24a32b1a011d403

SHA1
2e78811fd5d2cace1587a0ca375acfd5b2e8204c

SHA256
ed49499d534bc6b2cffea3fe6bc62354a44cc3f58088cd32084293abea17f742

SHA512
93ff167a3411a9fb91e557366ff23dbf2af370b4aa834afe7bbe893a4d1f4be80c6029d5d81fa61e52bffa0bed5a781a1980f093fed1cb444b2cded54d028181

Download Submit
C:\Program Files\update.exe

Filesize
72KB

MD5
acee9460676a8bcb42458a82564718eb

SHA1
89f1796797c4d1954882640c9f62452fc096e563

SHA256
4b8be37cf81ea93b26634f5c15a2b7b7407bbcbb1d9024f73b0499bc77bad492

SHA512
6253555caa72a7c9b2c3b3d2d6fc557028744b701f288d693cdbc65e82795a3e0af5d2c1129dfd44c96e857af0917c8e57b9c8927f6d447e07546d9c24763086

Download Submit
C:\Program Files\update.exe

Filesize
72KB

MD5
acee9460676a8bcb42458a82564718eb

SHA1
89f1796797c4d1954882640c9f62452fc096e563

SHA256
4b8be37cf81ea93b26634f5c15a2b7b7407bbcbb1d9024f73b0499bc77bad492

SHA512
6253555caa72a7c9b2c3b3d2d6fc557028744b701f288d693cdbc65e82795a3e0af5d2c1129dfd44c96e857af0917c8e57b9c8927f6d447e07546d9c24763086

Download Submit
C:\Users\Admin\AppData\Local\Temp\4221212162\backup.exe

Filesize
72KB

MD5
b5ece8ade520b5e046a334d8621187e3

SHA1
4b6533c72a943668466b504cdd25fbdd673b5251

SHA256
92b354025c42f3276efa8db3791efb3dfc1372faa510f5913f090a6ead7c0364

SHA512
34880334dcffebd4e9e7cae4f093cfedb60503bf65f2f0d9a79a99b6f6934255cb2d7923dff7b6a9709beb49ece5742355102d26cd84e2f7c6bd8d9ed39a5925

Download Submit
C:\Users\Admin\AppData\Local\Temp\4221212162\backup.exe

Filesize
72KB

MD5
b5ece8ade520b5e046a334d8621187e3

SHA1
4b6533c72a943668466b504cdd25fbdd673b5251

SHA256
92b354025c42f3276efa8db3791efb3dfc1372faa510f5913f090a6ead7c0364

SHA512
34880334dcffebd4e9e7cae4f093cfedb60503bf65f2f0d9a79a99b6f6934255cb2d7923dff7b6a9709beb49ece5742355102d26cd84e2f7c6bd8d9ed39a5925

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
dc0f9a366467c306ca19ae3b093026f8

SHA1
9dd17c089897d4ce67d7a58ba097be8b991ee41e

SHA256
40d25841b6310c9a4c2a79d434b73a4f5c8e2838f9e25cb742d1799000dfdf5c

SHA512
6f4e1c0ebfabbad8c988d3bde501b3cbac52741e2c535da9a830c91405913b7b0de613c09f2fa84a5cc089d017ea3b1d6dc5ce72bda3b70351e486a615a4365e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
dc0f9a366467c306ca19ae3b093026f8

SHA1
9dd17c089897d4ce67d7a58ba097be8b991ee41e

SHA256
40d25841b6310c9a4c2a79d434b73a4f5c8e2838f9e25cb742d1799000dfdf5c

SHA512
6f4e1c0ebfabbad8c988d3bde501b3cbac52741e2c535da9a830c91405913b7b0de613c09f2fa84a5cc089d017ea3b1d6dc5ce72bda3b70351e486a615a4365e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
9eed60c5d2ad77a7c78d8627becc37fc

SHA1
23f021a728c1349604aeafa9fe6d1bd22d5bed97

SHA256
51ca0cf6e99443f86013f351503778cf827a614aeab55cb97f7b7fdf97765e8a

SHA512
3988df65d6c1a4b28b5d4027a193618fe278f1d94fb66751b4171f5549b2533e2785738c9c294cae741cb653f7401d300d6fdd159bddb267fc9151991eeb4a67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
9eed60c5d2ad77a7c78d8627becc37fc

SHA1
23f021a728c1349604aeafa9fe6d1bd22d5bed97

SHA256
51ca0cf6e99443f86013f351503778cf827a614aeab55cb97f7b7fdf97765e8a

SHA512
3988df65d6c1a4b28b5d4027a193618fe278f1d94fb66751b4171f5549b2533e2785738c9c294cae741cb653f7401d300d6fdd159bddb267fc9151991eeb4a67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
9eed60c5d2ad77a7c78d8627becc37fc

SHA1
23f021a728c1349604aeafa9fe6d1bd22d5bed97

SHA256
51ca0cf6e99443f86013f351503778cf827a614aeab55cb97f7b7fdf97765e8a

SHA512
3988df65d6c1a4b28b5d4027a193618fe278f1d94fb66751b4171f5549b2533e2785738c9c294cae741cb653f7401d300d6fdd159bddb267fc9151991eeb4a67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
9eed60c5d2ad77a7c78d8627becc37fc

SHA1
23f021a728c1349604aeafa9fe6d1bd22d5bed97

SHA256
51ca0cf6e99443f86013f351503778cf827a614aeab55cb97f7b7fdf97765e8a

SHA512
3988df65d6c1a4b28b5d4027a193618fe278f1d94fb66751b4171f5549b2533e2785738c9c294cae741cb653f7401d300d6fdd159bddb267fc9151991eeb4a67

Download Submit
C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

Filesize
72KB

MD5
b5ece8ade520b5e046a334d8621187e3

SHA1
4b6533c72a943668466b504cdd25fbdd673b5251

SHA256
92b354025c42f3276efa8db3791efb3dfc1372faa510f5913f090a6ead7c0364

SHA512
34880334dcffebd4e9e7cae4f093cfedb60503bf65f2f0d9a79a99b6f6934255cb2d7923dff7b6a9709beb49ece5742355102d26cd84e2f7c6bd8d9ed39a5925

Download Submit
C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

Filesize
72KB

MD5
b5ece8ade520b5e046a334d8621187e3

SHA1
4b6533c72a943668466b504cdd25fbdd673b5251

SHA256
92b354025c42f3276efa8db3791efb3dfc1372faa510f5913f090a6ead7c0364

SHA512
34880334dcffebd4e9e7cae4f093cfedb60503bf65f2f0d9a79a99b6f6934255cb2d7923dff7b6a9709beb49ece5742355102d26cd84e2f7c6bd8d9ed39a5925

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
97b70428e1a4d2e34c9387d161665d8d

SHA1
7e04e292e944ca91ece2fd3de0877ad7cd7eb128

SHA256
67fc68327f19f6de086994b6e06ba769f72e6f5d8b7f751186e9f05bb3da930c

SHA512
55d500c05e0868d6afb4aa6f16bb6b6c5164963c2c6433c62729e9560a4563fee649795f78e68912848dddec7ecbdbd70885077f4875f6b6b4e3c15492bb8010

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
97b70428e1a4d2e34c9387d161665d8d

SHA1
7e04e292e944ca91ece2fd3de0877ad7cd7eb128

SHA256
67fc68327f19f6de086994b6e06ba769f72e6f5d8b7f751186e9f05bb3da930c

SHA512
55d500c05e0868d6afb4aa6f16bb6b6c5164963c2c6433c62729e9560a4563fee649795f78e68912848dddec7ecbdbd70885077f4875f6b6b4e3c15492bb8010

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
068bd6d18247f0447c5aac62b02c190f

SHA1
8d418001b051960e49e07ae863bd8e3168554ab2

SHA256
e00f59a699d7798c621327d1a6d7677b27afa4d7b05ecc29cc28eddbd646e7f7

SHA512
2b7f1db5781aa9a5aaa761f4348364359029e1f8e467d6861c42b0d66a4128835152310d9851ef7945bf1b4755ea594ee3739ca4749106fd6a6e7c6d0e82edb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
068bd6d18247f0447c5aac62b02c190f

SHA1
8d418001b051960e49e07ae863bd8e3168554ab2

SHA256
e00f59a699d7798c621327d1a6d7677b27afa4d7b05ecc29cc28eddbd646e7f7

SHA512
2b7f1db5781aa9a5aaa761f4348364359029e1f8e467d6861c42b0d66a4128835152310d9851ef7945bf1b4755ea594ee3739ca4749106fd6a6e7c6d0e82edb1

Download Submit
C:\Users\backup.exe

Filesize
72KB

MD5
31adcd3ec279c767467f60cbb28bf8e8

SHA1
262c704f05ffccc9a2bdbc641461f79446e62cae

SHA256
4288b8445e32c9665c8310c47abab8e89445d72437ec2df04b578ad7cd6afcd2

SHA512
bfd285a1356c6c2305750c66ec7cab47a84a317d4ad00542fdb7724c07452cc0a078b8df8a84f22b475a70bb6c44730db1e92e57dc4ccd20cc8f849c0f060246

Download Submit
C:\Users\backup.exe

Filesize
72KB

MD5
31adcd3ec279c767467f60cbb28bf8e8

SHA1
262c704f05ffccc9a2bdbc641461f79446e62cae

SHA256
4288b8445e32c9665c8310c47abab8e89445d72437ec2df04b578ad7cd6afcd2

SHA512
bfd285a1356c6c2305750c66ec7cab47a84a317d4ad00542fdb7724c07452cc0a078b8df8a84f22b475a70bb6c44730db1e92e57dc4ccd20cc8f849c0f060246

Download Submit
C:\Windows\backup.exe

Filesize
72KB

MD5
400f3dd5b7e11bd59d4e88dc762e0e14

SHA1
5f1efaa90241c12098509c1338220fcf4c60b3b6

SHA256
b5c10aced5912058880d653aa6bdf990ea61ccc9899003232d7e80528774b12d

SHA512
a83a05147916a86ec07baf30d0b5c14fc65cfa35c3f130e636b11041adbd4f56e81c092b39eb1804667c4dfb80cd36ec450e296890f5af0384b532ace860f8c2

Download Submit
C:\backup.exe

Filesize
72KB

MD5
8e34c264456fd9c8dff76df6a0529f75

SHA1
ff6d7509a3c2f0937c0e0cf6a0014b2e6fbcde30

SHA256
fdbdfaeb63d8a6441d983f39c02b8da911dd59b0cf7fb7294b7a82eba4e3b106

SHA512
06ad99a1039344e60621b8cb09aa9b081ca419fe5741b0858747022f7363a092f634bd04dfe173b34adbe7f852a2ec34a677958ae96f8598838aa0538a1b1476

Download Submit
C:\backup.exe

Filesize
72KB

MD5
8e34c264456fd9c8dff76df6a0529f75

SHA1
ff6d7509a3c2f0937c0e0cf6a0014b2e6fbcde30

SHA256
fdbdfaeb63d8a6441d983f39c02b8da911dd59b0cf7fb7294b7a82eba4e3b106

SHA512
06ad99a1039344e60621b8cb09aa9b081ca419fe5741b0858747022f7363a092f634bd04dfe173b34adbe7f852a2ec34a677958ae96f8598838aa0538a1b1476

Download Submit
C:\odt\backup.exe

Filesize
72KB

MD5
acee9460676a8bcb42458a82564718eb

SHA1
89f1796797c4d1954882640c9f62452fc096e563

SHA256
4b8be37cf81ea93b26634f5c15a2b7b7407bbcbb1d9024f73b0499bc77bad492

SHA512
6253555caa72a7c9b2c3b3d2d6fc557028744b701f288d693cdbc65e82795a3e0af5d2c1129dfd44c96e857af0917c8e57b9c8927f6d447e07546d9c24763086

Download Submit
C:\odt\backup.exe

Filesize
72KB

MD5
acee9460676a8bcb42458a82564718eb

SHA1
89f1796797c4d1954882640c9f62452fc096e563

SHA256
4b8be37cf81ea93b26634f5c15a2b7b7407bbcbb1d9024f73b0499bc77bad492

SHA512
6253555caa72a7c9b2c3b3d2d6fc557028744b701f288d693cdbc65e82795a3e0af5d2c1129dfd44c96e857af0917c8e57b9c8927f6d447e07546d9c24763086

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads