129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3

Analysis

max time kernel
376s
max time network
388s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe
Size

72KB
MD5

a4dcd3ddfa420486ef8f5f3be8df9800
SHA1

8843ebf5000f0da76a0391656fb49df2b901eac3
SHA256

129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3
SHA512

53cf4a502f89a1ac149321ea7c6961ec224914f1d1dafb552c9328d4584153370f931469eb1814f0f1cd7573e544aa3e04248a2fac0bd09abae36613713bb7c5
SSDEEP

384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2K:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrG

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 14 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	update.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe

Disables RegEdit via registry modification 28 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	update.exe

Executes dropped EXE 18 IoCs

pid	Process
3300	backup.exe
2368	backup.exe
3360	backup.exe
2848	update.exe
3196	backup.exe
972	System Restore.exe
1744	update.exe
2504	backup.exe
1376	backup.exe
3504	backup.exe
3752	backup.exe
4376	backup.exe
4972	backup.exe
3384	backup.exe
1664	backup.exe
4028	backup.exe
380	update.exe
2388	backup.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\update.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Common Files\backup.exe	backup.exe
File opened for modification	C:\Program Files\backup.exe	update.exe
File opened for modification	C:\Program Files (x86)\backup.exe	update.exe
File opened for modification	C:\Program Files\7-Zip\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\backup.exe	backup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
1608	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe
3300	backup.exe
2368	backup.exe
3360	backup.exe
2848	update.exe
3196	backup.exe
972	System Restore.exe
1744	update.exe
2504	backup.exe
1376	backup.exe
3504	backup.exe
3752	backup.exe
4376	backup.exe
4972	backup.exe
3384	backup.exe
1664	backup.exe
4028	backup.exe
380	update.exe
2388	backup.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 3300	1608	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe	81
PID 1608 wrote to memory of 3300	1608	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe	81
PID 1608 wrote to memory of 3300	1608	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe	81
PID 1608 wrote to memory of 2368	1608	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe	82
PID 1608 wrote to memory of 2368	1608	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe	82
PID 1608 wrote to memory of 2368	1608	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe	82
PID 1608 wrote to memory of 3360	1608	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe	83
PID 1608 wrote to memory of 3360	1608	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe	83
PID 1608 wrote to memory of 3360	1608	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe	83
PID 1608 wrote to memory of 2848	1608	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe	84
PID 1608 wrote to memory of 2848	1608	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe	84
PID 1608 wrote to memory of 2848	1608	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe	84
PID 1608 wrote to memory of 3196	1608	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe	85
PID 1608 wrote to memory of 3196	1608	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe	85
PID 1608 wrote to memory of 3196	1608	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe	85
PID 1608 wrote to memory of 972	1608	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe	86
PID 1608 wrote to memory of 972	1608	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe	86
PID 1608 wrote to memory of 972	1608	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe	86
PID 3300 wrote to memory of 1744	3300	backup.exe	87
PID 3300 wrote to memory of 1744	3300	backup.exe	87
PID 3300 wrote to memory of 1744	3300	backup.exe	87
PID 1608 wrote to memory of 2504	1608	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe	88
PID 1608 wrote to memory of 2504	1608	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe	88
PID 1608 wrote to memory of 2504	1608	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe	88
PID 1744 wrote to memory of 1376	1744	update.exe	89
PID 1744 wrote to memory of 1376	1744	update.exe	89
PID 1744 wrote to memory of 1376	1744	update.exe	89
PID 1744 wrote to memory of 3504	1744	update.exe	90
PID 1744 wrote to memory of 3504	1744	update.exe	90
PID 1744 wrote to memory of 3504	1744	update.exe	90
PID 1744 wrote to memory of 3752	1744	update.exe	91
PID 1744 wrote to memory of 3752	1744	update.exe	91
PID 1744 wrote to memory of 3752	1744	update.exe	91
PID 1744 wrote to memory of 4376	1744	update.exe	93
PID 1744 wrote to memory of 4376	1744	update.exe	93
PID 1744 wrote to memory of 4376	1744	update.exe	93
PID 3752 wrote to memory of 4972	3752	backup.exe	94
PID 3752 wrote to memory of 4972	3752	backup.exe	94
PID 3752 wrote to memory of 4972	3752	backup.exe	94
PID 4376 wrote to memory of 3384	4376	backup.exe	95
PID 4376 wrote to memory of 3384	4376	backup.exe	95
PID 4376 wrote to memory of 3384	4376	backup.exe	95
PID 4972 wrote to memory of 1664	4972	backup.exe	96
PID 4972 wrote to memory of 1664	4972	backup.exe	96
PID 4972 wrote to memory of 1664	4972	backup.exe	96
PID 3752 wrote to memory of 380	3752	backup.exe	97
PID 3752 wrote to memory of 380	3752	backup.exe	97
PID 3752 wrote to memory of 380	3752	backup.exe	97
PID 1744 wrote to memory of 4028	1744	update.exe	98
PID 1744 wrote to memory of 4028	1744	update.exe	98
PID 1744 wrote to memory of 4028	1744	update.exe	98
PID 3384 wrote to memory of 2388	3384	backup.exe	99
PID 3384 wrote to memory of 2388	3384	backup.exe	99
PID 3384 wrote to memory of 2388	3384	backup.exe	99

System policy modification 1 TTPs 56 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	update.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	System Restore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	update.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	System Restore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe

C:\Users\Admin\AppData\Local\Temp\129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe
"C:\Users\Admin\AppData\Local\Temp\129d9a2412db812d0ba82a2ca24090894fd687606e4733f29c59e1a54f6d98f3.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1608
- C:\Users\Admin\AppData\Local\Temp\1287350798\backup.exe
  C:\Users\Admin\AppData\Local\Temp\1287350798\backup.exe C:\Users\Admin\AppData\Local\Temp\1287350798\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3300
- - C:\update.exe
    \update.exe \
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1744
  - - C:\odt\backup.exe
      C:\odt\backup.exe C:\odt\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:1376
  - - C:\PerfLogs\backup.exe
      C:\PerfLogs\backup.exe C:\PerfLogs\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:3504
  - - C:\Program Files\backup.exe
      "C:\Program Files\backup.exe" C:\Program Files\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3752
    - - C:\Program Files\7-Zip\backup.exe
        
        "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4972
      - C:\Program Files\7-Zip\Lang\backup.exe
        
        "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1664
    - - C:\Program Files\Common Files\update.exe
        
        "C:\Program Files\Common Files\update.exe" C:\Program Files\Common Files\
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:380
  - - C:\Program Files (x86)\backup.exe
      "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4376
    - - C:\Program Files (x86)\Adobe\backup.exe
        
        "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3384
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2388
  - - C:\Users\backup.exe
      C:\Users\backup.exe C:\Users\
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4028
- C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2368
- C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:3360
- C:\Users\Admin\AppData\Local\Temp\Low\update.exe
  C:\Users\Admin\AppData\Local\Temp\Low\update.exe C:\Users\Admin\AppData\Local\Temp\Low\
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2848
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:3196
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:972
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:2504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\backup.exe

Filesize
72KB

MD5
786d9cfda186438695fad45e9be4d3a2

SHA1
16493f39da592c601f6e8105eeea9255799a98e0

SHA256
7f1bbc3a28e8d5727cd9bd7ec9f179a2f1ea9d0f057455280fa1d564cee15a90

SHA512
1f91eaa87e3786469b4ed223a038a2c17e018e6857f0abba05383e28d4c55e2283efcf9454806e4b4d888f7b6b552cc43ba972280133f4645711ec38e82252c4

Download Submit
C:\PerfLogs\backup.exe

Filesize
72KB

MD5
786d9cfda186438695fad45e9be4d3a2

SHA1
16493f39da592c601f6e8105eeea9255799a98e0

SHA256
7f1bbc3a28e8d5727cd9bd7ec9f179a2f1ea9d0f057455280fa1d564cee15a90

SHA512
1f91eaa87e3786469b4ed223a038a2c17e018e6857f0abba05383e28d4c55e2283efcf9454806e4b4d888f7b6b552cc43ba972280133f4645711ec38e82252c4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe

Filesize
72KB

MD5
347567ce3afcc7735ad902060182777d

SHA1
489af9a297101ab8e21a2191ac9a3603d345262f

SHA256
5de159d0df14feee2c8d4e9d883801a451831230b74b47ff8e72ea66fd9fbdee

SHA512
470f1f71ffa143be6e274f39b7112949c2827f31b6dd90890f0f0bb100167f8d75bd1dc25c71d0cd76f019aa87f5d41d3e1ce3e81f1845142daedcb5d5066691

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe

Filesize
72KB

MD5
347567ce3afcc7735ad902060182777d

SHA1
489af9a297101ab8e21a2191ac9a3603d345262f

SHA256
5de159d0df14feee2c8d4e9d883801a451831230b74b47ff8e72ea66fd9fbdee

SHA512
470f1f71ffa143be6e274f39b7112949c2827f31b6dd90890f0f0bb100167f8d75bd1dc25c71d0cd76f019aa87f5d41d3e1ce3e81f1845142daedcb5d5066691

Download Submit
C:\Program Files (x86)\Adobe\backup.exe

Filesize
72KB

MD5
4727dafde3584db9fd5d4242678a8c61

SHA1
821651e8b66ddcd56ea4ac996fa530318d81fb13

SHA256
8fec21a506ea299f5fd1697fe87913420e731fa4f0cf82b9e7d4ebcbce522ace

SHA512
4db5af6c379e227b797253a315062f08a1fc4807e7403731a3d50f74e1532366ff508f168b60cbd2e3f07a12d179351b26659b7095407215c204db65c950e664

Download Submit
C:\Program Files (x86)\Adobe\backup.exe

Filesize
72KB

MD5
4727dafde3584db9fd5d4242678a8c61

SHA1
821651e8b66ddcd56ea4ac996fa530318d81fb13

SHA256
8fec21a506ea299f5fd1697fe87913420e731fa4f0cf82b9e7d4ebcbce522ace

SHA512
4db5af6c379e227b797253a315062f08a1fc4807e7403731a3d50f74e1532366ff508f168b60cbd2e3f07a12d179351b26659b7095407215c204db65c950e664

Download Submit
C:\Program Files (x86)\backup.exe

Filesize
72KB

MD5
23b5ede04b0d26150a1ae541f0009885

SHA1
3875908b2cc10e375c929e465f8633ef9f07c65a

SHA256
014f8ca06ba955484d55ff5ff90639ccf6f88b70ea968342d74148a9a49d3ead

SHA512
6d070e6451bacceae96cc957865ee570cab7a7c257eca471ac6044c85ed284548153dc9ac704b19bf8ff99692a2bb92d1fd2406618782a2460e1e1d97886fb4c

Download Submit
C:\Program Files (x86)\backup.exe

Filesize
72KB

MD5
23b5ede04b0d26150a1ae541f0009885

SHA1
3875908b2cc10e375c929e465f8633ef9f07c65a

SHA256
014f8ca06ba955484d55ff5ff90639ccf6f88b70ea968342d74148a9a49d3ead

SHA512
6d070e6451bacceae96cc957865ee570cab7a7c257eca471ac6044c85ed284548153dc9ac704b19bf8ff99692a2bb92d1fd2406618782a2460e1e1d97886fb4c

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
c7b629dc5ef7c66c8499e453fbe27e33

SHA1
6be85795238681b5328f7ebd69d008800e6835f4

SHA256
045fefe71a5ae1bb36510be5fe30ac00076211172e2fb9ff8c934bc15febe9db

SHA512
4841ed44a9d738322c0bcc46852961c59a4c6853296cb5b8b2b412ecbaffb9f0144a2a2f7b595edf2feecdfbd73b10b7a29f1d41e359f3ef3094605fc5875cba

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
c7b629dc5ef7c66c8499e453fbe27e33

SHA1
6be85795238681b5328f7ebd69d008800e6835f4

SHA256
045fefe71a5ae1bb36510be5fe30ac00076211172e2fb9ff8c934bc15febe9db

SHA512
4841ed44a9d738322c0bcc46852961c59a4c6853296cb5b8b2b412ecbaffb9f0144a2a2f7b595edf2feecdfbd73b10b7a29f1d41e359f3ef3094605fc5875cba

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
6d513eb32e1c4f9e137c6b232891e6c1

SHA1
be06f179b33718b5283c25b08ec38dbf31287afe

SHA256
c3bd0eadff43cdc687e700bc5c27f95d28932860399219fc09863344b16c97c8

SHA512
0fe78141d213f4d73bf8ba3949c761e7e7ef26819f4fb2e3e66f10e764a70962148c17d2701708dfc6e954141a02fc0f6dd373ca6c6d1aa852bccb43a90a23ef

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
6d513eb32e1c4f9e137c6b232891e6c1

SHA1
be06f179b33718b5283c25b08ec38dbf31287afe

SHA256
c3bd0eadff43cdc687e700bc5c27f95d28932860399219fc09863344b16c97c8

SHA512
0fe78141d213f4d73bf8ba3949c761e7e7ef26819f4fb2e3e66f10e764a70962148c17d2701708dfc6e954141a02fc0f6dd373ca6c6d1aa852bccb43a90a23ef

Download Submit
C:\Program Files\Common Files\update.exe

Filesize
72KB

MD5
221ca49f0b6247673ba748fec6465b73

SHA1
1355e27a0a17efe178ed390de974fce050d06443

SHA256
9d7f4d8a876d0204ef8a2415837a3d091cebfeaa4e1d697c7e4c5ab19ca9293c

SHA512
b905ac684be1dd643a1e16a292f8224d2a4cf086c9c12d2b7d2676dc58f7e139327eed231698cf7e334c60cc3e427fd4a06f35d3c8d07e83789faebd4829098b

Download Submit
C:\Program Files\Common Files\update.exe

Filesize
72KB

MD5
221ca49f0b6247673ba748fec6465b73

SHA1
1355e27a0a17efe178ed390de974fce050d06443

SHA256
9d7f4d8a876d0204ef8a2415837a3d091cebfeaa4e1d697c7e4c5ab19ca9293c

SHA512
b905ac684be1dd643a1e16a292f8224d2a4cf086c9c12d2b7d2676dc58f7e139327eed231698cf7e334c60cc3e427fd4a06f35d3c8d07e83789faebd4829098b

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
18f741a4115d6a41c8565a4b7dc6ab85

SHA1
e61b60bfeaba0a07d63dcd8b94670310e3898b5c

SHA256
30cdb20cadc551343d64ff1afacfc9545d8d38800a4ad2545d04b4271d2cc201

SHA512
5cc9f4c96f16a3e545e0287010b3d155548f8034f75833b6d41a82563931b295af48bee71317db11c5b78d38685b6c2f6e9b4e6ef0c0d66a41b539aa428670db

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
18f741a4115d6a41c8565a4b7dc6ab85

SHA1
e61b60bfeaba0a07d63dcd8b94670310e3898b5c

SHA256
30cdb20cadc551343d64ff1afacfc9545d8d38800a4ad2545d04b4271d2cc201

SHA512
5cc9f4c96f16a3e545e0287010b3d155548f8034f75833b6d41a82563931b295af48bee71317db11c5b78d38685b6c2f6e9b4e6ef0c0d66a41b539aa428670db

Download Submit
C:\Users\Admin\AppData\Local\Temp\1287350798\backup.exe

Filesize
72KB

MD5
00201393cd9bab42885866ed7814bf68

SHA1
d48606e103229b7d4b1d503ce375d349df56b734

SHA256
b2fee956ad83664e40e60885cbefd8a807b3c83c45c2746dbda64dc7faca1938

SHA512
4c7a81e0d918f41c760c83be354e0760acc781c8f05279b93cf06adb4be17cb48dd3988ab03229124cec4a7955dbcb6da23606e1d0bcefe970cfc31e2df52c05

Download Submit
C:\Users\Admin\AppData\Local\Temp\1287350798\backup.exe

Filesize
72KB

MD5
00201393cd9bab42885866ed7814bf68

SHA1
d48606e103229b7d4b1d503ce375d349df56b734

SHA256
b2fee956ad83664e40e60885cbefd8a807b3c83c45c2746dbda64dc7faca1938

SHA512
4c7a81e0d918f41c760c83be354e0760acc781c8f05279b93cf06adb4be17cb48dd3988ab03229124cec4a7955dbcb6da23606e1d0bcefe970cfc31e2df52c05

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\update.exe

Filesize
72KB

MD5
8ab869aad3e5cb19eea220893c81331e

SHA1
87de790b7765e3d9a60fd4ff57ef2629475a969a

SHA256
f4c3a6097e352fa844e11817917ed914d76014d98d33c57a2573e758e059bfe9

SHA512
26a3529e1d4b03a942a917b528a8ef58d74298aa4347bf5fb8eb1bd62db18732ae920da9ef10f6fb85d7f578e5dc085b0dd7dc1a1b0e28caf7bece7e3de16ed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\update.exe

Filesize
72KB

MD5
8ab869aad3e5cb19eea220893c81331e

SHA1
87de790b7765e3d9a60fd4ff57ef2629475a969a

SHA256
f4c3a6097e352fa844e11817917ed914d76014d98d33c57a2573e758e059bfe9

SHA512
26a3529e1d4b03a942a917b528a8ef58d74298aa4347bf5fb8eb1bd62db18732ae920da9ef10f6fb85d7f578e5dc085b0dd7dc1a1b0e28caf7bece7e3de16ed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
8ab869aad3e5cb19eea220893c81331e

SHA1
87de790b7765e3d9a60fd4ff57ef2629475a969a

SHA256
f4c3a6097e352fa844e11817917ed914d76014d98d33c57a2573e758e059bfe9

SHA512
26a3529e1d4b03a942a917b528a8ef58d74298aa4347bf5fb8eb1bd62db18732ae920da9ef10f6fb85d7f578e5dc085b0dd7dc1a1b0e28caf7bece7e3de16ed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
8ab869aad3e5cb19eea220893c81331e

SHA1
87de790b7765e3d9a60fd4ff57ef2629475a969a

SHA256
f4c3a6097e352fa844e11817917ed914d76014d98d33c57a2573e758e059bfe9

SHA512
26a3529e1d4b03a942a917b528a8ef58d74298aa4347bf5fb8eb1bd62db18732ae920da9ef10f6fb85d7f578e5dc085b0dd7dc1a1b0e28caf7bece7e3de16ed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe

Filesize
72KB

MD5
8ab869aad3e5cb19eea220893c81331e

SHA1
87de790b7765e3d9a60fd4ff57ef2629475a969a

SHA256
f4c3a6097e352fa844e11817917ed914d76014d98d33c57a2573e758e059bfe9

SHA512
26a3529e1d4b03a942a917b528a8ef58d74298aa4347bf5fb8eb1bd62db18732ae920da9ef10f6fb85d7f578e5dc085b0dd7dc1a1b0e28caf7bece7e3de16ed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe

Filesize
72KB

MD5
8ab869aad3e5cb19eea220893c81331e

SHA1
87de790b7765e3d9a60fd4ff57ef2629475a969a

SHA256
f4c3a6097e352fa844e11817917ed914d76014d98d33c57a2573e758e059bfe9

SHA512
26a3529e1d4b03a942a917b528a8ef58d74298aa4347bf5fb8eb1bd62db18732ae920da9ef10f6fb85d7f578e5dc085b0dd7dc1a1b0e28caf7bece7e3de16ed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

Filesize
72KB

MD5
00201393cd9bab42885866ed7814bf68

SHA1
d48606e103229b7d4b1d503ce375d349df56b734

SHA256
b2fee956ad83664e40e60885cbefd8a807b3c83c45c2746dbda64dc7faca1938

SHA512
4c7a81e0d918f41c760c83be354e0760acc781c8f05279b93cf06adb4be17cb48dd3988ab03229124cec4a7955dbcb6da23606e1d0bcefe970cfc31e2df52c05

Download Submit
C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

Filesize
72KB

MD5
00201393cd9bab42885866ed7814bf68

SHA1
d48606e103229b7d4b1d503ce375d349df56b734

SHA256
b2fee956ad83664e40e60885cbefd8a807b3c83c45c2746dbda64dc7faca1938

SHA512
4c7a81e0d918f41c760c83be354e0760acc781c8f05279b93cf06adb4be17cb48dd3988ab03229124cec4a7955dbcb6da23606e1d0bcefe970cfc31e2df52c05

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
00201393cd9bab42885866ed7814bf68

SHA1
d48606e103229b7d4b1d503ce375d349df56b734

SHA256
b2fee956ad83664e40e60885cbefd8a807b3c83c45c2746dbda64dc7faca1938

SHA512
4c7a81e0d918f41c760c83be354e0760acc781c8f05279b93cf06adb4be17cb48dd3988ab03229124cec4a7955dbcb6da23606e1d0bcefe970cfc31e2df52c05

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
00201393cd9bab42885866ed7814bf68

SHA1
d48606e103229b7d4b1d503ce375d349df56b734

SHA256
b2fee956ad83664e40e60885cbefd8a807b3c83c45c2746dbda64dc7faca1938

SHA512
4c7a81e0d918f41c760c83be354e0760acc781c8f05279b93cf06adb4be17cb48dd3988ab03229124cec4a7955dbcb6da23606e1d0bcefe970cfc31e2df52c05

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
8ab869aad3e5cb19eea220893c81331e

SHA1
87de790b7765e3d9a60fd4ff57ef2629475a969a

SHA256
f4c3a6097e352fa844e11817917ed914d76014d98d33c57a2573e758e059bfe9

SHA512
26a3529e1d4b03a942a917b528a8ef58d74298aa4347bf5fb8eb1bd62db18732ae920da9ef10f6fb85d7f578e5dc085b0dd7dc1a1b0e28caf7bece7e3de16ed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
8ab869aad3e5cb19eea220893c81331e

SHA1
87de790b7765e3d9a60fd4ff57ef2629475a969a

SHA256
f4c3a6097e352fa844e11817917ed914d76014d98d33c57a2573e758e059bfe9

SHA512
26a3529e1d4b03a942a917b528a8ef58d74298aa4347bf5fb8eb1bd62db18732ae920da9ef10f6fb85d7f578e5dc085b0dd7dc1a1b0e28caf7bece7e3de16ed0

Download Submit
C:\Users\backup.exe

Filesize
72KB

MD5
104b92e8d121d2cc383378e571ad38af

SHA1
7b88cc2c82cb794ddc1a71b77341061d0a76935b

SHA256
53997e04223cbb17914737b41e9bf713f17980bbea683a979ec5d7417c7a1716

SHA512
7217916bcf27a9b460a257407fb901146496a442206b0c903e67bc011946b250c8c5a236946efdc624cd5de61b2389cdb563a1c66e5f16729605de7fe6988146

Download Submit
C:\Users\backup.exe

Filesize
72KB

MD5
104b92e8d121d2cc383378e571ad38af

SHA1
7b88cc2c82cb794ddc1a71b77341061d0a76935b

SHA256
53997e04223cbb17914737b41e9bf713f17980bbea683a979ec5d7417c7a1716

SHA512
7217916bcf27a9b460a257407fb901146496a442206b0c903e67bc011946b250c8c5a236946efdc624cd5de61b2389cdb563a1c66e5f16729605de7fe6988146

Download Submit
C:\odt\backup.exe

Filesize
72KB

MD5
595dde9c4773a988b0c5992ffae664cc

SHA1
b52519613eedecb2ec918eb1ec92831a27d9acec

SHA256
4ac59b562f447542260fd788334a35553f740f9d9fdc419f073ae5cf951d1bfb

SHA512
a35c183b2389e678c20369ceda5de401ae26c4474b90a2a0ffcf43a97bc0a55d15eeb5e91671aa6f589892d63274a7a995bb406540601ca3752abb8a81debd22

Download Submit
C:\odt\backup.exe

Filesize
72KB

MD5
595dde9c4773a988b0c5992ffae664cc

SHA1
b52519613eedecb2ec918eb1ec92831a27d9acec

SHA256
4ac59b562f447542260fd788334a35553f740f9d9fdc419f073ae5cf951d1bfb

SHA512
a35c183b2389e678c20369ceda5de401ae26c4474b90a2a0ffcf43a97bc0a55d15eeb5e91671aa6f589892d63274a7a995bb406540601ca3752abb8a81debd22

Download Submit
C:\update.exe

Filesize
72KB

MD5
7665be34e80d9e64168ba15cd4ae6186

SHA1
28507c5c36150721b53397f6afd6b6bc297dfe6f

SHA256
437579d8bbefdf686042c0bf5aeec9c78ad5078e789d53afe42e396929cb433b

SHA512
8cc3933bdc06640ae64ed94cf57f61989eefaaf63fa8c21e37dcbe340f76a0e85b3a72fbb6358476f707f5e70d817acf653ee24530d811418828177d54c09cb5

Download Submit
C:\update.exe

Filesize
72KB

MD5
7665be34e80d9e64168ba15cd4ae6186

SHA1
28507c5c36150721b53397f6afd6b6bc297dfe6f

SHA256
437579d8bbefdf686042c0bf5aeec9c78ad5078e789d53afe42e396929cb433b

SHA512
8cc3933bdc06640ae64ed94cf57f61989eefaaf63fa8c21e37dcbe340f76a0e85b3a72fbb6358476f707f5e70d817acf653ee24530d811418828177d54c09cb5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads