Overview

overview

10

Static

static

86d7a11493...fc.exe

windows7-x64

10

86d7a11493...fc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    176s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/12/2022, 19:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    86d7a11493bd9340342c2983f0b63bd084318d1aeaa2249f172c00e8cd81fefc.exe
  • Size 72KB
  • Sample221202-ydbvaabg51
  • SHA256 86d7a11493bd9340342c2983f0b63bd084318d1aeaa2249f172c00e8cd81fefc
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 55 IoCs
    evasion
  • Executes dropped EXE 60 IoCs
  • Drops file in Program Files directory 51 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 61 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\86d7a11493bd9340342c2983f0b63bd084318d1aeaa2249f172c00e8cd81fefc.exe
    "C:\Users\Admin\AppData\Local\Temp\86d7a11493bd9340342c2983f0b63bd084318d1aeaa2249f172c00e8cd81fefc.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2656
    • C:\Users\Admin\AppData\Local\Temp\1180324242\backup.exe
      C:\Users\Admin\AppData\Local\Temp\1180324242\backup.exe C:\Users\Admin\AppData\Local\Temp\1180324242\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4296
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1708
        • C:\odt\System Restore.exe
          "C:\odt\System Restore.exe" C:\odt\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:932
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:3988
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4128
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:4416
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:4396
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:3964
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:3860
            • C:\Program Files\Common Files\microsoft shared\data.exe
              "C:\Program Files\Common Files\microsoft shared\data.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2428
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:2444
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2904
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2160
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\update.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\update.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:5072
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3596
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3952
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4148
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:532
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\data.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\data.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4040
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4960
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4112
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3560
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4156
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4168
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1836
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4752
                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\update.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\update.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2616
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\data.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3068
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:4668
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2264
              • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:2460
                • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1764
                • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4396
                • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4444
                • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3000
            • C:\Program Files\Common Files\Services\backup.exe
              "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:1660
            • C:\Program Files\Common Files\System\backup.exe
              "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:1676
              • C:\Program Files\Common Files\System\ado\backup.exe
                "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:3824
                • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                  "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3564
                • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                  "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2488
                • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                  "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1308
          • C:\Program Files\Google\backup.exe
            "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:456
            • C:\Program Files\Google\Chrome\update.exe
              "C:\Program Files\Google\Chrome\update.exe" C:\Program Files\Google\Chrome\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:232
              • C:\Program Files\Google\Chrome\Application\backup.exe
                "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                PID:2688
                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2128
                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:4996
                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1288
        • C:\Program Files (x86)\backup.exe
          "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:3724
          • C:\Program Files (x86)\Adobe\backup.exe
            "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:400
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:2824
              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3696
              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1692
                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1000
                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4084
    • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
      C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1436
    • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\data.exe
      C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\data.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:4504
    • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
      C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1808
    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe
      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2732
    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:916
    • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
      C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2624

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        backup.exe
        • Path C:\PerfLogs\backup.exe
        • Size 72KB
        • SHA256 5d35fde0f78e366e46f7d233cca195de80aff74787cfeffe1921014ca52a8e21
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\PerfLogs\backup.exe
        • Size 72KB
        • SHA256 5d35fde0f78e366e46f7d233cca195de80aff74787cfeffe1921014ca52a8e21
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\7-Zip\Lang\backup.exe
        • Size 72KB
        • SHA256 18af8ede93ad382adabb47dd3ed0e774c03bb3061c846597ac2e09836c4b837f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\7-Zip\Lang\backup.exe
        • Size 72KB
        • SHA256 18af8ede93ad382adabb47dd3ed0e774c03bb3061c846597ac2e09836c4b837f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\7-Zip\backup.exe
        • Size 72KB
        • SHA256 b20b3cd8c8192b31bfd5f84ed4178db17f6c4177c85dbe26fb79bc0e4fca6dac
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\7-Zip\backup.exe
        • Size 72KB
        • SHA256 b20b3cd8c8192b31bfd5f84ed4178db17f6c4177c85dbe26fb79bc0e4fca6dac
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\DESIGNER\backup.exe
        • Size 72KB
        • SHA256 783786d9850015540951a688abf101ced0d28255b10e814e6129185d6d377a47
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\DESIGNER\backup.exe
        • Size 72KB
        • SHA256 783786d9850015540951a688abf101ced0d28255b10e814e6129185d6d377a47
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\backup.exe
        • Size 72KB
        • SHA256 1b5ddb608dfc310da3de866e672695f2e78f4a1f9437b50c0ccd4865a09325bc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\backup.exe
        • Size 72KB
        • SHA256 1b5ddb608dfc310da3de866e672695f2e78f4a1f9437b50c0ccd4865a09325bc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
        • Size 72KB
        • SHA256 446b2f61b98ab47299f8bce19b9167af14a207eb0c7c5ec10004631f7ce22682
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
        • Size 72KB
        • SHA256 446b2f61b98ab47299f8bce19b9167af14a207eb0c7c5ec10004631f7ce22682
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data.exe
        • Path C:\Program Files\Common Files\microsoft shared\data.exe
        • Size 72KB
        • SHA256 bc71fa51b0f8953fa99dc20fcb3d3908ee293d763c0a19de293a2d64b23e3b34
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data.exe
        • Path C:\Program Files\Common Files\microsoft shared\data.exe
        • Size 72KB
        • SHA256 bc71fa51b0f8953fa99dc20fcb3d3908ee293d763c0a19de293a2d64b23e3b34
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
        • Size 72KB
        • SHA256 b4badeea95e81c6e30dc96b9564cca6f8e12d1c101c004a115be9afda5d344b7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
        • Size 72KB
        • SHA256 b4badeea95e81c6e30dc96b9564cca6f8e12d1c101c004a115be9afda5d344b7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\backup.exe
        • Size 72KB
        • SHA256 cdc60d4cd899b18be62824412590ff42651249f2f7bd1bdca73dffdff64bed71
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\backup.exe
        • Size 72KB
        • SHA256 cdc60d4cd899b18be62824412590ff42651249f2f7bd1bdca73dffdff64bed71
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        update.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\bg-BG\update.exe
        • Size 72KB
        • SHA256 b4badeea95e81c6e30dc96b9564cca6f8e12d1c101c004a115be9afda5d344b7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        update.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\bg-BG\update.exe
        • Size 72KB
        • SHA256 b4badeea95e81c6e30dc96b9564cca6f8e12d1c101c004a115be9afda5d344b7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
        • Size 72KB
        • SHA256 b4badeea95e81c6e30dc96b9564cca6f8e12d1c101c004a115be9afda5d344b7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
        • Size 72KB
        • SHA256 b4badeea95e81c6e30dc96b9564cca6f8e12d1c101c004a115be9afda5d344b7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
        • Size 72KB
        • SHA256 84022785b12e9710edaba55eb26b6fc84c6416563eaa8b347082df89b4e18d00
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
        • Size 72KB
        • SHA256 84022785b12e9710edaba55eb26b6fc84c6416563eaa8b347082df89b4e18d00
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
        • Size 72KB
        • SHA256 84022785b12e9710edaba55eb26b6fc84c6416563eaa8b347082df89b4e18d00
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
        • Size 72KB
        • SHA256 84022785b12e9710edaba55eb26b6fc84c6416563eaa8b347082df89b4e18d00
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
        • Size 72KB
        • SHA256 84022785b12e9710edaba55eb26b6fc84c6416563eaa8b347082df89b4e18d00
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
        • Size 72KB
        • SHA256 84022785b12e9710edaba55eb26b6fc84c6416563eaa8b347082df89b4e18d00
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\en-GB\data.exe
        • Size 72KB
        • SHA256 d3ad59831bbb414ca1f397899cd1781d796becbb6883b43914a2523067992f71
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\en-GB\data.exe
        • Size 72KB
        • SHA256 d3ad59831bbb414ca1f397899cd1781d796becbb6883b43914a2523067992f71
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
        • Size 72KB
        • SHA256 d3ad59831bbb414ca1f397899cd1781d796becbb6883b43914a2523067992f71
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
        • Size 72KB
        • SHA256 d3ad59831bbb414ca1f397899cd1781d796becbb6883b43914a2523067992f71
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
        • Size 72KB
        • SHA256 d3ad59831bbb414ca1f397899cd1781d796becbb6883b43914a2523067992f71
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
        • Size 72KB
        • SHA256 d3ad59831bbb414ca1f397899cd1781d796becbb6883b43914a2523067992f71
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
        • Size 72KB
        • SHA256 7d78c7f80a25446d587df0798be2c9af26a6af5ddef8ebacc7e9dfd6671391c5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
        • Size 72KB
        • SHA256 7d78c7f80a25446d587df0798be2c9af26a6af5ddef8ebacc7e9dfd6671391c5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
        • Size 72KB
        • SHA256 7d78c7f80a25446d587df0798be2c9af26a6af5ddef8ebacc7e9dfd6671391c5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
        • Size 72KB
        • SHA256 7d78c7f80a25446d587df0798be2c9af26a6af5ddef8ebacc7e9dfd6671391c5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
        • Size 72KB
        • SHA256 83aa9b557e958d717a87668c8ce7e76a1c0c3b509986b63001ec727fa3d8a4d0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
        • Size 72KB
        • SHA256 83aa9b557e958d717a87668c8ce7e76a1c0c3b509986b63001ec727fa3d8a4d0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
        • Size 72KB
        • SHA256 83aa9b557e958d717a87668c8ce7e76a1c0c3b509986b63001ec727fa3d8a4d0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
        • Size 72KB
        • SHA256 83aa9b557e958d717a87668c8ce7e76a1c0c3b509986b63001ec727fa3d8a4d0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
        • Size 72KB
        • SHA256 83aa9b557e958d717a87668c8ce7e76a1c0c3b509986b63001ec727fa3d8a4d0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
        • Size 72KB
        • SHA256 83aa9b557e958d717a87668c8ce7e76a1c0c3b509986b63001ec727fa3d8a4d0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\backup.exe
        • Size 72KB
        • SHA256 327e3ec6610a082a158d48e0c0fd7f73e6fc605d18ce770af177b8e2beca425e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Program Files\backup.exe
        • Size 72KB
        • SHA256 327e3ec6610a082a158d48e0c0fd7f73e6fc605d18ce770af177b8e2beca425e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\1180324242\backup.exe
        • Size 72KB
        • SHA256 b85301ef518462eec09669f00e80f7bef6651e51a71d6a90a687a726aefe7aff
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\1180324242\backup.exe
        • Size 72KB
        • SHA256 b85301ef518462eec09669f00e80f7bef6651e51a71d6a90a687a726aefe7aff
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
        • Size 72KB
        • SHA256 29e8683cea8410b59d71cc0e14c4d43cfb65138a157feca99cd8f04c823cbdb6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
        • Size 72KB
        • SHA256 29e8683cea8410b59d71cc0e14c4d43cfb65138a157feca99cd8f04c823cbdb6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe
        • Size 72KB
        • SHA256 8090e888ec00f7a10a65ef120d1208cf3ae2538ac7fa86f0a6278f2319270dcf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe
        • Size 72KB
        • SHA256 8090e888ec00f7a10a65ef120d1208cf3ae2538ac7fa86f0a6278f2319270dcf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
        • Size 72KB
        • SHA256 a8f89ce05bee289a56a189f0a18248ecdf8115ef435cb3aa793f5c0f35d895af
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
        • Size 72KB
        • SHA256 a8f89ce05bee289a56a189f0a18248ecdf8115ef435cb3aa793f5c0f35d895af
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
        • Size 72KB
        • SHA256 b85301ef518462eec09669f00e80f7bef6651e51a71d6a90a687a726aefe7aff
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
        • Size 72KB
        • SHA256 b85301ef518462eec09669f00e80f7bef6651e51a71d6a90a687a726aefe7aff
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data.exe
        • Path C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\data.exe
        • Size 72KB
        • SHA256 b85301ef518462eec09669f00e80f7bef6651e51a71d6a90a687a726aefe7aff
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data.exe
        • Path C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\data.exe
        • Size 72KB
        • SHA256 b85301ef518462eec09669f00e80f7bef6651e51a71d6a90a687a726aefe7aff
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
        • Size 72KB
        • SHA256 b7b45782a27213365adb944dfbeec3b21660e3476389ee24a5dc89674dad7f92
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
        • Size 72KB
        • SHA256 b7b45782a27213365adb944dfbeec3b21660e3476389ee24a5dc89674dad7f92
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\backup.exe
        • Size 72KB
        • SHA256 b64be255199d567f7ce352cddda6823b6f1294effd4bf56dd00cb0edf01e95e2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        backup.exe
        • Path C:\backup.exe
        • Size 72KB
        • SHA256 b64be255199d567f7ce352cddda6823b6f1294effd4bf56dd00cb0edf01e95e2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System Restore.exe
        • Path C:\odt\System Restore.exe
        • Size 72KB
        • SHA256 5d35fde0f78e366e46f7d233cca195de80aff74787cfeffe1921014ca52a8e21
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System Restore.exe
        • Path C:\odt\System Restore.exe
        • Size 72KB
        • SHA256 5d35fde0f78e366e46f7d233cca195de80aff74787cfeffe1921014ca52a8e21
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download