46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d

Analysis

max time kernel
103s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 19:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe
Size

72KB
MD5

04a9a99a4fd0f34b2a0ae0c46dfad266
SHA1

b5bc7e7c422220d73e64095f3554c3841a8cd94b
SHA256

46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d
SHA512

7a24283c3ca7e4c47f7716cdcd3620eafccd260de4a9cd8c84b19b65c13654908fd14a3fba00642aad7cf42e1ca4cc05d22fe4aa8b6f26586f5c65d550b449c1
SSDEEP

384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2u:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrP6

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 48 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	data.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe

Disables RegEdit via registry modification 64 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	System Restore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	data.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe

Executes dropped EXE 56 IoCs

pid	Process
952	backup.exe
956	backup.exe
844	backup.exe
1088	backup.exe
1884	backup.exe
692	backup.exe
1888	backup.exe
1040	data.exe
1544	backup.exe
532	backup.exe
1436	backup.exe
1720	backup.exe
1496	backup.exe
628	backup.exe
1488	backup.exe
1736	backup.exe
1980	backup.exe
868	backup.exe
708	backup.exe
1088	backup.exe
1952	backup.exe
840	backup.exe
1588	backup.exe
2020	backup.exe
784	backup.exe
1828	backup.exe
760	backup.exe
1648	backup.exe
1544	backup.exe
1964	backup.exe
2012	backup.exe
1524	System Restore.exe
1836	backup.exe
1636	backup.exe
1032	backup.exe
1720	backup.exe
1328	backup.exe
1080	backup.exe
1580	backup.exe
1248	backup.exe
1904	backup.exe
1044	backup.exe
568	backup.exe
584	backup.exe
696	backup.exe
468	backup.exe
2000	backup.exe
1788	backup.exe
1748	backup.exe
708	backup.exe
692	backup.exe
1964	backup.exe
1756	backup.exe
1104	backup.exe
1144	backup.exe
428	backup.exe

Loads dropped DLL 64 IoCs

pid	Process
2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe
2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe
2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe
2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe
2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe
2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe
2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe
2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe
2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe
2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe
2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe
2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe
2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe
1888	backup.exe
1888	backup.exe
2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe
1040	data.exe
1040	data.exe
1888	backup.exe
1888	backup.exe
1436	backup.exe
1436	backup.exe
1720	backup.exe
1720	backup.exe
1436	backup.exe
1436	backup.exe
628	backup.exe
628	backup.exe
1436	backup.exe
628	backup.exe
1436	backup.exe
628	backup.exe
1888	backup.exe
1888	backup.exe
1488	backup.exe
1488	backup.exe
1736	backup.exe
1736	backup.exe
628	backup.exe
628	backup.exe
868	backup.exe
868	backup.exe
1488	backup.exe
1952	backup.exe
1488	backup.exe
840	backup.exe
840	backup.exe
1952	backup.exe
1736	backup.exe
1736	backup.exe
2020	backup.exe
2020	backup.exe
628	backup.exe
628	backup.exe
2020	backup.exe
1736	backup.exe
2020	backup.exe
1736	backup.exe
1436	backup.exe
1436	backup.exe
1888	backup.exe
1888	backup.exe
1544	backup.exe
1544	backup.exe

Drops file in Program Files directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\en-US\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\System\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\fr-FR\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe	backup.exe
File opened for modification	C:\Program Files\Internet Explorer\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\it-IT\backup.exe	backup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\System\ado\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\System\ado\de-DE\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\System\de-DE\backup.exe	backup.exe
File opened for modification	C:\Program Files\7-Zip\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\de-DE\backup.exe	backup.exe
File opened for modification	C:\Program Files\7-Zip\Lang\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe	backup.exe
File opened for modification	C:\Program Files\Google\Chrome\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Common Files\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe	backup.exe
File opened for modification	C:\Program Files\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\es-ES\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe	backup.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\backup.exe	backup.exe
File opened for modification	C:\Program Files\DVD Maker\ja-JP\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\System\ado\en-US\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Services\backup.exe	backup.exe
File opened for modification	C:\Program Files\Google\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe	backup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\backup.exe	backup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 50 IoCs

pid	Process
2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe
952	backup.exe
956	backup.exe
844	backup.exe
1088	backup.exe
1884	backup.exe
692	backup.exe
1888	backup.exe
1040	data.exe
1544	backup.exe
532	backup.exe
1436	backup.exe
1720	backup.exe
1496	backup.exe
628	backup.exe
1488	backup.exe
1736	backup.exe
1980	backup.exe
868	backup.exe
708	backup.exe
1088	backup.exe
1952	backup.exe
840	backup.exe
2020	backup.exe
784	backup.exe
1828	backup.exe
760	backup.exe
1648	backup.exe
1544	backup.exe
1588	backup.exe
1964	backup.exe
2012	backup.exe
1524	System Restore.exe
1836	backup.exe
1032	backup.exe
1636	backup.exe
1720	backup.exe
1328	backup.exe
1080	backup.exe
1580	backup.exe
1248	backup.exe
1904	backup.exe
1044	backup.exe
568	backup.exe
696	backup.exe
468	backup.exe
584	backup.exe
1788	backup.exe
1748	backup.exe
692	backup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 952	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	28
PID 2040 wrote to memory of 952	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	28
PID 2040 wrote to memory of 952	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	28
PID 2040 wrote to memory of 952	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	28
PID 2040 wrote to memory of 956	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	29
PID 2040 wrote to memory of 956	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	29
PID 2040 wrote to memory of 956	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	29
PID 2040 wrote to memory of 956	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	29
PID 2040 wrote to memory of 844	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	30
PID 2040 wrote to memory of 844	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	30
PID 2040 wrote to memory of 844	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	30
PID 2040 wrote to memory of 844	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	30
PID 2040 wrote to memory of 1088	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	31
PID 2040 wrote to memory of 1088	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	31
PID 2040 wrote to memory of 1088	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	31
PID 2040 wrote to memory of 1088	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	31
PID 2040 wrote to memory of 1884	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	32
PID 2040 wrote to memory of 1884	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	32
PID 2040 wrote to memory of 1884	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	32
PID 2040 wrote to memory of 1884	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	32
PID 2040 wrote to memory of 692	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	33
PID 2040 wrote to memory of 692	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	33
PID 2040 wrote to memory of 692	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	33
PID 2040 wrote to memory of 692	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	33
PID 952 wrote to memory of 1888	952	backup.exe	34
PID 952 wrote to memory of 1888	952	backup.exe	34
PID 952 wrote to memory of 1888	952	backup.exe	34
PID 952 wrote to memory of 1888	952	backup.exe	34
PID 1888 wrote to memory of 1040	1888	backup.exe	35
PID 1888 wrote to memory of 1040	1888	backup.exe	35
PID 1888 wrote to memory of 1040	1888	backup.exe	35
PID 1888 wrote to memory of 1040	1888	backup.exe	35
PID 2040 wrote to memory of 1544	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	36
PID 2040 wrote to memory of 1544	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	36
PID 2040 wrote to memory of 1544	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	36
PID 2040 wrote to memory of 1544	2040	46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe	36
PID 1040 wrote to memory of 532	1040	data.exe	37
PID 1040 wrote to memory of 532	1040	data.exe	37
PID 1040 wrote to memory of 532	1040	data.exe	37
PID 1040 wrote to memory of 532	1040	data.exe	37
PID 1888 wrote to memory of 1436	1888	backup.exe	38
PID 1888 wrote to memory of 1436	1888	backup.exe	38
PID 1888 wrote to memory of 1436	1888	backup.exe	38
PID 1888 wrote to memory of 1436	1888	backup.exe	38
PID 1436 wrote to memory of 1720	1436	backup.exe	39
PID 1436 wrote to memory of 1720	1436	backup.exe	39
PID 1436 wrote to memory of 1720	1436	backup.exe	39
PID 1436 wrote to memory of 1720	1436	backup.exe	39
PID 1720 wrote to memory of 1496	1720	backup.exe	40
PID 1720 wrote to memory of 1496	1720	backup.exe	40
PID 1720 wrote to memory of 1496	1720	backup.exe	40
PID 1720 wrote to memory of 1496	1720	backup.exe	40
PID 1436 wrote to memory of 628	1436	backup.exe	41
PID 1436 wrote to memory of 628	1436	backup.exe	41
PID 1436 wrote to memory of 628	1436	backup.exe	41
PID 1436 wrote to memory of 628	1436	backup.exe	41
PID 628 wrote to memory of 1488	628	backup.exe	42
PID 628 wrote to memory of 1488	628	backup.exe	42
PID 628 wrote to memory of 1488	628	backup.exe	42
PID 628 wrote to memory of 1488	628	backup.exe	42
PID 1436 wrote to memory of 1736	1436	backup.exe	43
PID 1436 wrote to memory of 1736	1436	backup.exe	43
PID 1436 wrote to memory of 1736	1436	backup.exe	43
PID 1436 wrote to memory of 1736	1436	backup.exe	43

System policy modification 1 TTPs 64 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	data.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	System Restore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	System Restore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe

C:\Users\Admin\AppData\Local\Temp\46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe
"C:\Users\Admin\AppData\Local\Temp\46b33e1a86e91ec80eea926213fb82b19c903c13f3d6997306ea7f9687e6858d.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\790053660\backup.exe
  C:\Users\Admin\AppData\Local\Temp\790053660\backup.exe C:\Users\Admin\AppData\Local\Temp\790053660\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:952
- - C:\backup.exe
    \backup.exe \
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1888
  - - C:\PerfLogs\data.exe
      C:\PerfLogs\data.exe C:\PerfLogs\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1040
    - - C:\PerfLogs\Admin\backup.exe
        
        C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:532
  - - C:\Program Files\backup.exe
      "C:\Program Files\backup.exe" C:\Program Files\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1436
    - - C:\Program Files\7-Zip\backup.exe
        
        "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1720
      - C:\Program Files\7-Zip\Lang\backup.exe
        
        "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1496
    - - C:\Program Files\Common Files\backup.exe
        
        "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:628
      - C:\Program Files\Common Files\Microsoft Shared\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:1488
        
        C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
        7⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:708
        
        C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
        7⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1588
        
        C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
        8⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1080
        
        C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
        8⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1904
        
        C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:468
        
        C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
        8⤵
        
        PID:1680
        
        C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
        8⤵
        
        PID:576
        
        C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
        7⤵
        Executes dropped EXE
        
        PID:428
        
        C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
        7⤵
        
        PID:968
        
        C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
        7⤵
        
        PID:544
      - C:\Program Files\Common Files\Services\backup.exe
        
        "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1980
      - C:\Program Files\Common Files\SpeechEngines\backup.exe
        
        "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1952
        
        C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
        
        "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
        7⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:784
      - C:\Program Files\Common Files\System\backup.exe
        
        "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1648
        
        C:\Program Files\Common Files\System\ado\backup.exe
        
        "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
        7⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1720
        
        C:\Program Files\Common Files\System\ado\de-DE\backup.exe
        
        "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
        8⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1748
        
        C:\Program Files\Common Files\System\ado\en-US\backup.exe
        
        "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
        8⤵
        Executes dropped EXE
        
        PID:1104
        
        C:\Program Files\Common Files\System\ado\es-ES\data.exe
        
        "C:\Program Files\Common Files\System\ado\es-ES\data.exe" C:\Program Files\Common Files\System\ado\es-ES\
        8⤵
        
        PID:1652
        
        C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
        8⤵
        
        PID:1788
        
        C:\Program Files\Common Files\System\de-DE\backup.exe
        
        "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
        7⤵
        
        PID:1920
        
        C:\Program Files\Common Files\System\en-US\backup.exe
        
        "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
        7⤵
        
        PID:696
        
        C:\Program Files\Common Files\System\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
        7⤵
        
        PID:760
    - - C:\Program Files\DVD Maker\backup.exe
        
        "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1736
      - C:\Program Files\DVD Maker\de-DE\backup.exe
        
        "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1088
      - C:\Program Files\DVD Maker\en-US\backup.exe
        
        "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1828
      - C:\Program Files\DVD Maker\es-ES\backup.exe
        
        "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1964
      - C:\Program Files\DVD Maker\fr-FR\backup.exe
        
        "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1032
      - C:\Program Files\DVD Maker\it-IT\backup.exe
        
        "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1248
      - C:\Program Files\DVD Maker\ja-JP\backup.exe
        
        "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
        6⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:584
      - C:\Program Files\DVD Maker\Shared\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
        6⤵
        Executes dropped EXE
        
        PID:1756
        
        C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
        
        "C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
        7⤵
        
        PID:1784
    - - C:\Program Files\Google\backup.exe
        
        "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
        5⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2012
      - C:\Program Files\Google\Chrome\backup.exe
        
        "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1636
        
        C:\Program Files\Google\Chrome\Application\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
        7⤵
        Modifies visibility of file extensions in Explorer
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:568
        
        C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
        8⤵
        Executes dropped EXE
        
        PID:708
        
        C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\
        8⤵
        
        PID:1376
        
        C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
        8⤵
        
        PID:1828
    - - C:\Program Files\Internet Explorer\backup.exe
        
        "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
        5⤵
        
        PID:1560
      - C:\Program Files\Internet Explorer\de-DE\data.exe
        
        "C:\Program Files\Internet Explorer\de-DE\data.exe" C:\Program Files\Internet Explorer\de-DE\
        6⤵
        
        PID:1212
      - C:\Program Files\Internet Explorer\en-US\backup.exe
        
        "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
        6⤵
        
        PID:1976
    - - C:\Program Files\Java\backup.exe
        
        "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
        5⤵
        
        PID:2000
    - - C:\Program Files\Microsoft Games\backup.exe
        
        "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
        5⤵
        
        PID:1388
  - - C:\Program Files (x86)\backup.exe
      "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:868
    - - C:\Program Files (x86)\Adobe\backup.exe
        
        "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:840
      - C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2020
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
        7⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:760
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
        7⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1544
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
        8⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1836
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
        8⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1580
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
        8⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:696
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
        8⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1788
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
        9⤵
        
        PID:676
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
        8⤵
        Executes dropped EXE
        
        PID:1144
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\System Restore.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
        8⤵
        
        PID:1536
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
        7⤵
        
        PID:2028
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
        8⤵
        
        PID:1892
        
        C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
        7⤵
        
        PID:652
    - - C:\Program Files (x86)\Common Files\backup.exe
        
        "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
        5⤵
        
        PID:1948
    - - C:\Program Files (x86)\Google\backup.exe
        
        "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
        5⤵
        
        PID:1620
    - - C:\Program Files (x86)\Internet Explorer\backup.exe
        
        "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
        5⤵
        
        PID:1736
  - - C:\Users\System Restore.exe
      "C:\Users\System Restore.exe" C:\Users\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:1524
    - - C:\Users\Admin\backup.exe
        
        C:\Users\Admin\backup.exe C:\Users\Admin\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1328
      - C:\Users\Admin\Contacts\backup.exe
        
        C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1044
      - C:\Users\Admin\Desktop\backup.exe
        
        C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        System policy modification
        
        PID:2000
      - C:\Users\Admin\Documents\backup.exe
        
        C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:692
      - C:\Users\Admin\Downloads\backup.exe
        
        C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
        6⤵
        Executes dropped EXE
        
        PID:1964
      - C:\Users\Admin\Favorites\backup.exe
        
        C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
        6⤵
        
        PID:1088
    - - C:\Users\Public\backup.exe
        
        C:\Users\Public\backup.exe C:\Users\Public\
        5⤵
        
        PID:1248
  - - C:\Windows\backup.exe
      C:\Windows\backup.exe C:\Windows\
      4⤵
      PID:1172
    - - C:\Windows\addins\backup.exe
        
        C:\Windows\addins\backup.exe C:\Windows\addins\
        5⤵
        
        PID:1952
- C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:956
- C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:844
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1088
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1884
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:692
- C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
  C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
05c37f3cf57471e2dc8088286411f2e2

SHA1
94f071a7d0ba516620f9f899ad1e263a246ca6e8

SHA256
49c142417091e788e26a3826afebddf8f0733a9e32199460d574ce7f2ffac6eb

SHA512
3a659439b263628a3b8ee84f96ef56196d59a510f3c4f993c3c2391c5985f3109fcdcea8e1630755b41dae1127f6b6bef4db3a27386209618d618814247f4b46

Download Submit
C:\PerfLogs\data.exe

Filesize
72KB

MD5
3d0acc96b2ddc10787bf10b6aa4532a7

SHA1
ec3337d17e3b3869e2920642b758ab3b0a1453a8

SHA256
f10ec997c6978f3e69873175805f90af941eb63e5171196c26523ec20a1302a2

SHA512
f9321366a1fd386f665ddb8256332eb4a332ca87df0d2ace8c715abfb3611673c1400cbd60f5d035593b51c00b3c6c557ffb76144de78d5962c6c6af3fa21d51

Download Submit
C:\PerfLogs\data.exe

Filesize
72KB

MD5
3d0acc96b2ddc10787bf10b6aa4532a7

SHA1
ec3337d17e3b3869e2920642b758ab3b0a1453a8

SHA256
f10ec997c6978f3e69873175805f90af941eb63e5171196c26523ec20a1302a2

SHA512
f9321366a1fd386f665ddb8256332eb4a332ca87df0d2ace8c715abfb3611673c1400cbd60f5d035593b51c00b3c6c557ffb76144de78d5962c6c6af3fa21d51

Download Submit
C:\Program Files (x86)\backup.exe

Filesize
72KB

MD5
843c03db3d926dd681a00ce30ceacb09

SHA1
0afb3d70627a1aeaa743149f50de894c3d19327e

SHA256
c0ffa2e3ec5faa204208273b202dd724973dfaadbb1a94980237d71c4900848a

SHA512
a5b00f34f936d49500fad3115377a5c9c41ea9716ff41532809335d729e1a97efd9ddef74ccbc6b23e0daabf70bb16b8bfb396eb65d89869e12eaf77eaefd8ec

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
4b5e110bf286e0d854f233bebb042281

SHA1
b04f62c48a703103aba196a3b9726ffcd618dde1

SHA256
d8f553bac0a06f55f6b47b9f3b5a6e40bf672c677f3cafca9a324470e0d80776

SHA512
bc5da8300951c162e6fb20b02b69e52ddb58a3a34675dfc44e48c20904a9a962eff718be794a160a5447874b70f0aa885dbedd1d20d25915ba11f2276c3f09f9

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
fd5593e69a137d07c96658df99972064

SHA1
63b4b3a54290f8453ec69d98694b6f6ba03f85cb

SHA256
996c98f5408e49a2a18aad54f8b763a70eb86eaf06a7dfa295a8d64f6d31bc1d

SHA512
54b69580ffcd342ad87b571958ec8b24da5a38264e75263a4b9659c63066b34c9516f3a3005685b36f0ff538c8ea3205d3d5676fc25ab4fe2a085f3672b828a3

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
fd5593e69a137d07c96658df99972064

SHA1
63b4b3a54290f8453ec69d98694b6f6ba03f85cb

SHA256
996c98f5408e49a2a18aad54f8b763a70eb86eaf06a7dfa295a8d64f6d31bc1d

SHA512
54b69580ffcd342ad87b571958ec8b24da5a38264e75263a4b9659c63066b34c9516f3a3005685b36f0ff538c8ea3205d3d5676fc25ab4fe2a085f3672b828a3

Download Submit
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

Filesize
72KB

MD5
36cfebe36d05993ee0f34e3236e6f825

SHA1
47ed3fd2aff4c28cebcc5e1e32b3f554f958424d

SHA256
36edb01cf88240c17e6dbbd35436010eca8b74c750c1c059137a2a541280972d

SHA512
0a09873cbffd187e0b2053229e951c1c219a7de08323e03bf421553af5d14a7f5c182f9405849ce938188b753bd63fcff3404f2972ea3fc033542b7e60a3efe7

Download Submit
C:\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
72KB

MD5
96af395b17acd6e9067eedbdd0b2387e

SHA1
70a91751fc867a894e2869eeab03a78ffd1e141a

SHA256
86a9339a1e48e4fa76039e2fd937aac406f7490066e93c5abd85aefde66cac66

SHA512
18db2541d396b069aa2108a34ef8b2a178a85251485d203d6904a26f17ba44c47f8115a3e29cb69ea4c9b78bb2b0245028d27a55b5825bfb2edd0f80a85b72d4

Download Submit
C:\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
72KB

MD5
96af395b17acd6e9067eedbdd0b2387e

SHA1
70a91751fc867a894e2869eeab03a78ffd1e141a

SHA256
86a9339a1e48e4fa76039e2fd937aac406f7490066e93c5abd85aefde66cac66

SHA512
18db2541d396b069aa2108a34ef8b2a178a85251485d203d6904a26f17ba44c47f8115a3e29cb69ea4c9b78bb2b0245028d27a55b5825bfb2edd0f80a85b72d4

Download Submit
C:\Program Files\Common Files\Services\backup.exe

Filesize
72KB

MD5
de9f1087af86083512242c7e03dd73e5

SHA1
6354454815b845c415f841e124fee2deaf4af6be

SHA256
94176941bb86e63c0d567383bd9742d81480ba7be63c5fbe52b132684dd092b0

SHA512
3810afcd94a153593ae192f979ade586e749c45c4edffa37bcb03940e69dae96c674223a406ae8e1d52cc4be71ba0a021f9535804d00fec0187401dc91f6a89a

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
fd5593e69a137d07c96658df99972064

SHA1
63b4b3a54290f8453ec69d98694b6f6ba03f85cb

SHA256
996c98f5408e49a2a18aad54f8b763a70eb86eaf06a7dfa295a8d64f6d31bc1d

SHA512
54b69580ffcd342ad87b571958ec8b24da5a38264e75263a4b9659c63066b34c9516f3a3005685b36f0ff538c8ea3205d3d5676fc25ab4fe2a085f3672b828a3

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
fd5593e69a137d07c96658df99972064

SHA1
63b4b3a54290f8453ec69d98694b6f6ba03f85cb

SHA256
996c98f5408e49a2a18aad54f8b763a70eb86eaf06a7dfa295a8d64f6d31bc1d

SHA512
54b69580ffcd342ad87b571958ec8b24da5a38264e75263a4b9659c63066b34c9516f3a3005685b36f0ff538c8ea3205d3d5676fc25ab4fe2a085f3672b828a3

Download Submit
C:\Program Files\DVD Maker\backup.exe

Filesize
72KB

MD5
5fbc60290b5852e47581b392b73ed9a6

SHA1
c496878a71bb27c4d5a426064007354604d19407

SHA256
b189f1c7ece28c49b26119d3bf26332e6091f1787715137624d9a662c53047a3

SHA512
c22050745b4e4697bbdb52f060698fed5d6b19d6e43a6674d30d31829558b9ff1bd104d9408695b49e4e74775d25458ca4fbdacdeeae191329ab016e78a4236f

Download Submit
C:\Program Files\DVD Maker\backup.exe

Filesize
72KB

MD5
5fbc60290b5852e47581b392b73ed9a6

SHA1
c496878a71bb27c4d5a426064007354604d19407

SHA256
b189f1c7ece28c49b26119d3bf26332e6091f1787715137624d9a662c53047a3

SHA512
c22050745b4e4697bbdb52f060698fed5d6b19d6e43a6674d30d31829558b9ff1bd104d9408695b49e4e74775d25458ca4fbdacdeeae191329ab016e78a4236f

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
f65226e28bce4a78d697888ec9707abe

SHA1
af5a54242934c121bb2e506e9bf4867433c61f04

SHA256
9bc128c03636d5d7470cc718451ad24afd29e2fa3ae1d6c8e4cbcfdee0d06ec5

SHA512
8c802f4b624f130c14a113f94c519a013a6bcfe1e8ff00f5c7aae64932686b06374ec4a890431ae19d9d099df92c95c275417304716d96c906c3ecbb89ea34b7

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
f65226e28bce4a78d697888ec9707abe

SHA1
af5a54242934c121bb2e506e9bf4867433c61f04

SHA256
9bc128c03636d5d7470cc718451ad24afd29e2fa3ae1d6c8e4cbcfdee0d06ec5

SHA512
8c802f4b624f130c14a113f94c519a013a6bcfe1e8ff00f5c7aae64932686b06374ec4a890431ae19d9d099df92c95c275417304716d96c906c3ecbb89ea34b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\790053660\backup.exe

Filesize
72KB

MD5
4c72e471bf273bbbabdb18a1ffef566c

SHA1
f95e3153266b2f74f2c45aacef92f35e62b9e6b3

SHA256
aba0327dfb76c52650ef33f93878be4a595727f364593b3f54b87716c50b46bf

SHA512
a8123ab0c95d866a4fdc09bc4824a1a4bdef1a2e77b405c58907aed6c017aaedc9013003f7d9745755fcff80a00ebf74e5adad18fccce826a47bf6095badd4ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\790053660\backup.exe

Filesize
72KB

MD5
4c72e471bf273bbbabdb18a1ffef566c

SHA1
f95e3153266b2f74f2c45aacef92f35e62b9e6b3

SHA256
aba0327dfb76c52650ef33f93878be4a595727f364593b3f54b87716c50b46bf

SHA512
a8123ab0c95d866a4fdc09bc4824a1a4bdef1a2e77b405c58907aed6c017aaedc9013003f7d9745755fcff80a00ebf74e5adad18fccce826a47bf6095badd4ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
4c72e471bf273bbbabdb18a1ffef566c

SHA1
f95e3153266b2f74f2c45aacef92f35e62b9e6b3

SHA256
aba0327dfb76c52650ef33f93878be4a595727f364593b3f54b87716c50b46bf

SHA512
a8123ab0c95d866a4fdc09bc4824a1a4bdef1a2e77b405c58907aed6c017aaedc9013003f7d9745755fcff80a00ebf74e5adad18fccce826a47bf6095badd4ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
4c72e471bf273bbbabdb18a1ffef566c

SHA1
f95e3153266b2f74f2c45aacef92f35e62b9e6b3

SHA256
aba0327dfb76c52650ef33f93878be4a595727f364593b3f54b87716c50b46bf

SHA512
a8123ab0c95d866a4fdc09bc4824a1a4bdef1a2e77b405c58907aed6c017aaedc9013003f7d9745755fcff80a00ebf74e5adad18fccce826a47bf6095badd4ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
5a5844cd5ddc0f6799fb48955f9cb690

SHA1
3d8e70ba4b90bd59c05b66624dda98ea98501213

SHA256
ff419cce5dd303e433fa8fd8231c9010718df40780d6aba0543eff3f3efd4af7

SHA512
a4d1c384e723ada49feaf9a5a45e0ca5fc6b65bf509976885f6dee77226c51eb6a2f1f0369a0c426a7a1e00c8fe9ddae6d8683c33c75d3d47fbe34d45a3b3aa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
5a5844cd5ddc0f6799fb48955f9cb690

SHA1
3d8e70ba4b90bd59c05b66624dda98ea98501213

SHA256
ff419cce5dd303e433fa8fd8231c9010718df40780d6aba0543eff3f3efd4af7

SHA512
a4d1c384e723ada49feaf9a5a45e0ca5fc6b65bf509976885f6dee77226c51eb6a2f1f0369a0c426a7a1e00c8fe9ddae6d8683c33c75d3d47fbe34d45a3b3aa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
4c72e471bf273bbbabdb18a1ffef566c

SHA1
f95e3153266b2f74f2c45aacef92f35e62b9e6b3

SHA256
aba0327dfb76c52650ef33f93878be4a595727f364593b3f54b87716c50b46bf

SHA512
a8123ab0c95d866a4fdc09bc4824a1a4bdef1a2e77b405c58907aed6c017aaedc9013003f7d9745755fcff80a00ebf74e5adad18fccce826a47bf6095badd4ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
5a5844cd5ddc0f6799fb48955f9cb690

SHA1
3d8e70ba4b90bd59c05b66624dda98ea98501213

SHA256
ff419cce5dd303e433fa8fd8231c9010718df40780d6aba0543eff3f3efd4af7

SHA512
a4d1c384e723ada49feaf9a5a45e0ca5fc6b65bf509976885f6dee77226c51eb6a2f1f0369a0c426a7a1e00c8fe9ddae6d8683c33c75d3d47fbe34d45a3b3aa7

Download Submit
C:\backup.exe

Filesize
72KB

MD5
278882aba9b79824904a6768511f7169

SHA1
c8beb8f9804f9b67bcb3d19879ccb3801c041b7f

SHA256
7f1d539d10c69017e94d81a4fc2777e88d16078a9cdc1daea6a792cbdf5c46f0

SHA512
c0887fe5751e5e6fc29972d4ca21246ff40e7c650edeec4f071450d73b6652f312c009b734a23ee34ad7327ddd7162f378818a5b9a71e3b8ade2485085438504

Download Submit
C:\backup.exe

Filesize
72KB

MD5
278882aba9b79824904a6768511f7169

SHA1
c8beb8f9804f9b67bcb3d19879ccb3801c041b7f

SHA256
7f1d539d10c69017e94d81a4fc2777e88d16078a9cdc1daea6a792cbdf5c46f0

SHA512
c0887fe5751e5e6fc29972d4ca21246ff40e7c650edeec4f071450d73b6652f312c009b734a23ee34ad7327ddd7162f378818a5b9a71e3b8ade2485085438504

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
05c37f3cf57471e2dc8088286411f2e2

SHA1
94f071a7d0ba516620f9f899ad1e263a246ca6e8

SHA256
49c142417091e788e26a3826afebddf8f0733a9e32199460d574ce7f2ffac6eb

SHA512
3a659439b263628a3b8ee84f96ef56196d59a510f3c4f993c3c2391c5985f3109fcdcea8e1630755b41dae1127f6b6bef4db3a27386209618d618814247f4b46

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
72KB

MD5
05c37f3cf57471e2dc8088286411f2e2

SHA1
94f071a7d0ba516620f9f899ad1e263a246ca6e8

SHA256
49c142417091e788e26a3826afebddf8f0733a9e32199460d574ce7f2ffac6eb

SHA512
3a659439b263628a3b8ee84f96ef56196d59a510f3c4f993c3c2391c5985f3109fcdcea8e1630755b41dae1127f6b6bef4db3a27386209618d618814247f4b46

Download Submit
\PerfLogs\data.exe

Filesize
72KB

MD5
3d0acc96b2ddc10787bf10b6aa4532a7

SHA1
ec3337d17e3b3869e2920642b758ab3b0a1453a8

SHA256
f10ec997c6978f3e69873175805f90af941eb63e5171196c26523ec20a1302a2

SHA512
f9321366a1fd386f665ddb8256332eb4a332ca87df0d2ace8c715abfb3611673c1400cbd60f5d035593b51c00b3c6c557ffb76144de78d5962c6c6af3fa21d51

Download Submit
\PerfLogs\data.exe

Filesize
72KB

MD5
3d0acc96b2ddc10787bf10b6aa4532a7

SHA1
ec3337d17e3b3869e2920642b758ab3b0a1453a8

SHA256
f10ec997c6978f3e69873175805f90af941eb63e5171196c26523ec20a1302a2

SHA512
f9321366a1fd386f665ddb8256332eb4a332ca87df0d2ace8c715abfb3611673c1400cbd60f5d035593b51c00b3c6c557ffb76144de78d5962c6c6af3fa21d51

Download Submit
\Program Files (x86)\backup.exe

Filesize
72KB

MD5
843c03db3d926dd681a00ce30ceacb09

SHA1
0afb3d70627a1aeaa743149f50de894c3d19327e

SHA256
c0ffa2e3ec5faa204208273b202dd724973dfaadbb1a94980237d71c4900848a

SHA512
a5b00f34f936d49500fad3115377a5c9c41ea9716ff41532809335d729e1a97efd9ddef74ccbc6b23e0daabf70bb16b8bfb396eb65d89869e12eaf77eaefd8ec

Download Submit
\Program Files (x86)\backup.exe

Filesize
72KB

MD5
843c03db3d926dd681a00ce30ceacb09

SHA1
0afb3d70627a1aeaa743149f50de894c3d19327e

SHA256
c0ffa2e3ec5faa204208273b202dd724973dfaadbb1a94980237d71c4900848a

SHA512
a5b00f34f936d49500fad3115377a5c9c41ea9716ff41532809335d729e1a97efd9ddef74ccbc6b23e0daabf70bb16b8bfb396eb65d89869e12eaf77eaefd8ec

Download Submit
\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
4b5e110bf286e0d854f233bebb042281

SHA1
b04f62c48a703103aba196a3b9726ffcd618dde1

SHA256
d8f553bac0a06f55f6b47b9f3b5a6e40bf672c677f3cafca9a324470e0d80776

SHA512
bc5da8300951c162e6fb20b02b69e52ddb58a3a34675dfc44e48c20904a9a962eff718be794a160a5447874b70f0aa885dbedd1d20d25915ba11f2276c3f09f9

Download Submit
\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
4b5e110bf286e0d854f233bebb042281

SHA1
b04f62c48a703103aba196a3b9726ffcd618dde1

SHA256
d8f553bac0a06f55f6b47b9f3b5a6e40bf672c677f3cafca9a324470e0d80776

SHA512
bc5da8300951c162e6fb20b02b69e52ddb58a3a34675dfc44e48c20904a9a962eff718be794a160a5447874b70f0aa885dbedd1d20d25915ba11f2276c3f09f9

Download Submit
\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
fd5593e69a137d07c96658df99972064

SHA1
63b4b3a54290f8453ec69d98694b6f6ba03f85cb

SHA256
996c98f5408e49a2a18aad54f8b763a70eb86eaf06a7dfa295a8d64f6d31bc1d

SHA512
54b69580ffcd342ad87b571958ec8b24da5a38264e75263a4b9659c63066b34c9516f3a3005685b36f0ff538c8ea3205d3d5676fc25ab4fe2a085f3672b828a3

Download Submit
\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
fd5593e69a137d07c96658df99972064

SHA1
63b4b3a54290f8453ec69d98694b6f6ba03f85cb

SHA256
996c98f5408e49a2a18aad54f8b763a70eb86eaf06a7dfa295a8d64f6d31bc1d

SHA512
54b69580ffcd342ad87b571958ec8b24da5a38264e75263a4b9659c63066b34c9516f3a3005685b36f0ff538c8ea3205d3d5676fc25ab4fe2a085f3672b828a3

Download Submit
\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

Filesize
72KB

MD5
36cfebe36d05993ee0f34e3236e6f825

SHA1
47ed3fd2aff4c28cebcc5e1e32b3f554f958424d

SHA256
36edb01cf88240c17e6dbbd35436010eca8b74c750c1c059137a2a541280972d

SHA512
0a09873cbffd187e0b2053229e951c1c219a7de08323e03bf421553af5d14a7f5c182f9405849ce938188b753bd63fcff3404f2972ea3fc033542b7e60a3efe7

Download Submit
\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

Filesize
72KB

MD5
36cfebe36d05993ee0f34e3236e6f825

SHA1
47ed3fd2aff4c28cebcc5e1e32b3f554f958424d

SHA256
36edb01cf88240c17e6dbbd35436010eca8b74c750c1c059137a2a541280972d

SHA512
0a09873cbffd187e0b2053229e951c1c219a7de08323e03bf421553af5d14a7f5c182f9405849ce938188b753bd63fcff3404f2972ea3fc033542b7e60a3efe7

Download Submit
\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
72KB

MD5
96af395b17acd6e9067eedbdd0b2387e

SHA1
70a91751fc867a894e2869eeab03a78ffd1e141a

SHA256
86a9339a1e48e4fa76039e2fd937aac406f7490066e93c5abd85aefde66cac66

SHA512
18db2541d396b069aa2108a34ef8b2a178a85251485d203d6904a26f17ba44c47f8115a3e29cb69ea4c9b78bb2b0245028d27a55b5825bfb2edd0f80a85b72d4

Download Submit
\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
72KB

MD5
96af395b17acd6e9067eedbdd0b2387e

SHA1
70a91751fc867a894e2869eeab03a78ffd1e141a

SHA256
86a9339a1e48e4fa76039e2fd937aac406f7490066e93c5abd85aefde66cac66

SHA512
18db2541d396b069aa2108a34ef8b2a178a85251485d203d6904a26f17ba44c47f8115a3e29cb69ea4c9b78bb2b0245028d27a55b5825bfb2edd0f80a85b72d4

Download Submit
\Program Files\Common Files\Services\backup.exe

Filesize
72KB

MD5
de9f1087af86083512242c7e03dd73e5

SHA1
6354454815b845c415f841e124fee2deaf4af6be

SHA256
94176941bb86e63c0d567383bd9742d81480ba7be63c5fbe52b132684dd092b0

SHA512
3810afcd94a153593ae192f979ade586e749c45c4edffa37bcb03940e69dae96c674223a406ae8e1d52cc4be71ba0a021f9535804d00fec0187401dc91f6a89a

Download Submit
\Program Files\Common Files\Services\backup.exe

Filesize
72KB

MD5
de9f1087af86083512242c7e03dd73e5

SHA1
6354454815b845c415f841e124fee2deaf4af6be

SHA256
94176941bb86e63c0d567383bd9742d81480ba7be63c5fbe52b132684dd092b0

SHA512
3810afcd94a153593ae192f979ade586e749c45c4edffa37bcb03940e69dae96c674223a406ae8e1d52cc4be71ba0a021f9535804d00fec0187401dc91f6a89a

Download Submit
\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
fd5593e69a137d07c96658df99972064

SHA1
63b4b3a54290f8453ec69d98694b6f6ba03f85cb

SHA256
996c98f5408e49a2a18aad54f8b763a70eb86eaf06a7dfa295a8d64f6d31bc1d

SHA512
54b69580ffcd342ad87b571958ec8b24da5a38264e75263a4b9659c63066b34c9516f3a3005685b36f0ff538c8ea3205d3d5676fc25ab4fe2a085f3672b828a3

Download Submit
\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
fd5593e69a137d07c96658df99972064

SHA1
63b4b3a54290f8453ec69d98694b6f6ba03f85cb

SHA256
996c98f5408e49a2a18aad54f8b763a70eb86eaf06a7dfa295a8d64f6d31bc1d

SHA512
54b69580ffcd342ad87b571958ec8b24da5a38264e75263a4b9659c63066b34c9516f3a3005685b36f0ff538c8ea3205d3d5676fc25ab4fe2a085f3672b828a3

Download Submit
\Program Files\DVD Maker\backup.exe

Filesize
72KB

MD5
5fbc60290b5852e47581b392b73ed9a6

SHA1
c496878a71bb27c4d5a426064007354604d19407

SHA256
b189f1c7ece28c49b26119d3bf26332e6091f1787715137624d9a662c53047a3

SHA512
c22050745b4e4697bbdb52f060698fed5d6b19d6e43a6674d30d31829558b9ff1bd104d9408695b49e4e74775d25458ca4fbdacdeeae191329ab016e78a4236f

Download Submit
\Program Files\DVD Maker\backup.exe

Filesize
72KB

MD5
5fbc60290b5852e47581b392b73ed9a6

SHA1
c496878a71bb27c4d5a426064007354604d19407

SHA256
b189f1c7ece28c49b26119d3bf26332e6091f1787715137624d9a662c53047a3

SHA512
c22050745b4e4697bbdb52f060698fed5d6b19d6e43a6674d30d31829558b9ff1bd104d9408695b49e4e74775d25458ca4fbdacdeeae191329ab016e78a4236f

Download Submit
\Program Files\DVD Maker\de-DE\backup.exe

Filesize
72KB

MD5
e7bf76782f265fc8ac3ee4f194cec9c2

SHA1
98601a88e5db65859bdc4a4a43f92a1d8d30815c

SHA256
a1acb1994a99699d9882eb9718565b0b134a546a0738139d9f5d850b7c293578

SHA512
790585b332a86cbe80aa40984b9ba326bd86ac1103873e3e361bd16bfc3e48f28e4fedd618e5495c2d7e80033da3b98c7d7e59171eadab454440879b50d008cc

Download Submit
\Program Files\backup.exe

Filesize
72KB

MD5
f65226e28bce4a78d697888ec9707abe

SHA1
af5a54242934c121bb2e506e9bf4867433c61f04

SHA256
9bc128c03636d5d7470cc718451ad24afd29e2fa3ae1d6c8e4cbcfdee0d06ec5

SHA512
8c802f4b624f130c14a113f94c519a013a6bcfe1e8ff00f5c7aae64932686b06374ec4a890431ae19d9d099df92c95c275417304716d96c906c3ecbb89ea34b7

Download Submit
\Program Files\backup.exe

Filesize
72KB

MD5
f65226e28bce4a78d697888ec9707abe

SHA1
af5a54242934c121bb2e506e9bf4867433c61f04

SHA256
9bc128c03636d5d7470cc718451ad24afd29e2fa3ae1d6c8e4cbcfdee0d06ec5

SHA512
8c802f4b624f130c14a113f94c519a013a6bcfe1e8ff00f5c7aae64932686b06374ec4a890431ae19d9d099df92c95c275417304716d96c906c3ecbb89ea34b7

Download Submit
\Users\Admin\AppData\Local\Temp\790053660\backup.exe

Filesize
72KB

MD5
4c72e471bf273bbbabdb18a1ffef566c

SHA1
f95e3153266b2f74f2c45aacef92f35e62b9e6b3

SHA256
aba0327dfb76c52650ef33f93878be4a595727f364593b3f54b87716c50b46bf

SHA512
a8123ab0c95d866a4fdc09bc4824a1a4bdef1a2e77b405c58907aed6c017aaedc9013003f7d9745755fcff80a00ebf74e5adad18fccce826a47bf6095badd4ad

Download Submit
\Users\Admin\AppData\Local\Temp\790053660\backup.exe

Filesize
72KB

MD5
4c72e471bf273bbbabdb18a1ffef566c

SHA1
f95e3153266b2f74f2c45aacef92f35e62b9e6b3

SHA256
aba0327dfb76c52650ef33f93878be4a595727f364593b3f54b87716c50b46bf

SHA512
a8123ab0c95d866a4fdc09bc4824a1a4bdef1a2e77b405c58907aed6c017aaedc9013003f7d9745755fcff80a00ebf74e5adad18fccce826a47bf6095badd4ad

Download Submit
\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
4c72e471bf273bbbabdb18a1ffef566c

SHA1
f95e3153266b2f74f2c45aacef92f35e62b9e6b3

SHA256
aba0327dfb76c52650ef33f93878be4a595727f364593b3f54b87716c50b46bf

SHA512
a8123ab0c95d866a4fdc09bc4824a1a4bdef1a2e77b405c58907aed6c017aaedc9013003f7d9745755fcff80a00ebf74e5adad18fccce826a47bf6095badd4ad

Download Submit
\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
4c72e471bf273bbbabdb18a1ffef566c

SHA1
f95e3153266b2f74f2c45aacef92f35e62b9e6b3

SHA256
aba0327dfb76c52650ef33f93878be4a595727f364593b3f54b87716c50b46bf

SHA512
a8123ab0c95d866a4fdc09bc4824a1a4bdef1a2e77b405c58907aed6c017aaedc9013003f7d9745755fcff80a00ebf74e5adad18fccce826a47bf6095badd4ad

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
4c72e471bf273bbbabdb18a1ffef566c

SHA1
f95e3153266b2f74f2c45aacef92f35e62b9e6b3

SHA256
aba0327dfb76c52650ef33f93878be4a595727f364593b3f54b87716c50b46bf

SHA512
a8123ab0c95d866a4fdc09bc4824a1a4bdef1a2e77b405c58907aed6c017aaedc9013003f7d9745755fcff80a00ebf74e5adad18fccce826a47bf6095badd4ad

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
4c72e471bf273bbbabdb18a1ffef566c

SHA1
f95e3153266b2f74f2c45aacef92f35e62b9e6b3

SHA256
aba0327dfb76c52650ef33f93878be4a595727f364593b3f54b87716c50b46bf

SHA512
a8123ab0c95d866a4fdc09bc4824a1a4bdef1a2e77b405c58907aed6c017aaedc9013003f7d9745755fcff80a00ebf74e5adad18fccce826a47bf6095badd4ad

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
5a5844cd5ddc0f6799fb48955f9cb690

SHA1
3d8e70ba4b90bd59c05b66624dda98ea98501213

SHA256
ff419cce5dd303e433fa8fd8231c9010718df40780d6aba0543eff3f3efd4af7

SHA512
a4d1c384e723ada49feaf9a5a45e0ca5fc6b65bf509976885f6dee77226c51eb6a2f1f0369a0c426a7a1e00c8fe9ddae6d8683c33c75d3d47fbe34d45a3b3aa7

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
5a5844cd5ddc0f6799fb48955f9cb690

SHA1
3d8e70ba4b90bd59c05b66624dda98ea98501213

SHA256
ff419cce5dd303e433fa8fd8231c9010718df40780d6aba0543eff3f3efd4af7

SHA512
a4d1c384e723ada49feaf9a5a45e0ca5fc6b65bf509976885f6dee77226c51eb6a2f1f0369a0c426a7a1e00c8fe9ddae6d8683c33c75d3d47fbe34d45a3b3aa7

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
5a5844cd5ddc0f6799fb48955f9cb690

SHA1
3d8e70ba4b90bd59c05b66624dda98ea98501213

SHA256
ff419cce5dd303e433fa8fd8231c9010718df40780d6aba0543eff3f3efd4af7

SHA512
a4d1c384e723ada49feaf9a5a45e0ca5fc6b65bf509976885f6dee77226c51eb6a2f1f0369a0c426a7a1e00c8fe9ddae6d8683c33c75d3d47fbe34d45a3b3aa7

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
72KB

MD5
5a5844cd5ddc0f6799fb48955f9cb690

SHA1
3d8e70ba4b90bd59c05b66624dda98ea98501213

SHA256
ff419cce5dd303e433fa8fd8231c9010718df40780d6aba0543eff3f3efd4af7

SHA512
a4d1c384e723ada49feaf9a5a45e0ca5fc6b65bf509976885f6dee77226c51eb6a2f1f0369a0c426a7a1e00c8fe9ddae6d8683c33c75d3d47fbe34d45a3b3aa7

Download Submit
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
4c72e471bf273bbbabdb18a1ffef566c

SHA1
f95e3153266b2f74f2c45aacef92f35e62b9e6b3

SHA256
aba0327dfb76c52650ef33f93878be4a595727f364593b3f54b87716c50b46bf

SHA512
a8123ab0c95d866a4fdc09bc4824a1a4bdef1a2e77b405c58907aed6c017aaedc9013003f7d9745755fcff80a00ebf74e5adad18fccce826a47bf6095badd4ad

Download Submit
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
4c72e471bf273bbbabdb18a1ffef566c

SHA1
f95e3153266b2f74f2c45aacef92f35e62b9e6b3

SHA256
aba0327dfb76c52650ef33f93878be4a595727f364593b3f54b87716c50b46bf

SHA512
a8123ab0c95d866a4fdc09bc4824a1a4bdef1a2e77b405c58907aed6c017aaedc9013003f7d9745755fcff80a00ebf74e5adad18fccce826a47bf6095badd4ad

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
5a5844cd5ddc0f6799fb48955f9cb690

SHA1
3d8e70ba4b90bd59c05b66624dda98ea98501213

SHA256
ff419cce5dd303e433fa8fd8231c9010718df40780d6aba0543eff3f3efd4af7

SHA512
a4d1c384e723ada49feaf9a5a45e0ca5fc6b65bf509976885f6dee77226c51eb6a2f1f0369a0c426a7a1e00c8fe9ddae6d8683c33c75d3d47fbe34d45a3b3aa7

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
5a5844cd5ddc0f6799fb48955f9cb690

SHA1
3d8e70ba4b90bd59c05b66624dda98ea98501213

SHA256
ff419cce5dd303e433fa8fd8231c9010718df40780d6aba0543eff3f3efd4af7

SHA512
a4d1c384e723ada49feaf9a5a45e0ca5fc6b65bf509976885f6dee77226c51eb6a2f1f0369a0c426a7a1e00c8fe9ddae6d8683c33c75d3d47fbe34d45a3b3aa7

Download Submit
memory/2040-115-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads