346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497

Analysis

max time kernel
409s
max time network
438s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe
Size

72KB
MD5

0c0b1c0d167a094a5dfeef38745d5a6a
SHA1

e473937658d9a8ac94b87cc84466f4f598340501
SHA256

346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497
SHA512

716aa8b1665dab0b94aa657be54bf4af4586b68c2599fcc58a11d74a775e8dea99cd00729fca1a6e35d64c966ee5aac6fdf826a2d7d1074d3a3918cfd2b93cba
SSDEEP

384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2K:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrP+

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 17 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe

Disables RegEdit via registry modification 34 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe

Executes dropped EXE 29 IoCs

pid	Process
1772	backup.exe
2616	backup.exe
4812	backup.exe
4032	backup.exe
1096	backup.exe
4380	backup.exe
3600	backup.exe
3056	backup.exe
4496	backup.exe
1916	backup.exe
4304	backup.exe
1020	backup.exe
1756	backup.exe
3988	backup.exe
1740	backup.exe
1460	backup.exe
1320	backup.exe
5088	backup.exe
2208	backup.exe
4756	update.exe
1992	backup.exe
4152	backup.exe
3468	backup.exe
3500	backup.exe
5016	backup.exe
4984	backup.exe
3552	backup.exe
3572	backup.exe
5084	backup.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\System\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\backup.exe	backup.exe
File opened for modification	C:\Program Files\backup.exe	backup.exe
File opened for modification	C:\Program Files\7-Zip\Lang\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\update.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Common Files\backup.exe	backup.exe
File opened for modification	C:\Program Files\Internet Explorer\backup.exe	backup.exe
File opened for modification	C:\Program Files\7-Zip\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\backup.exe	backup.exe
File opened for modification	C:\Program Files\Google\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\Services\backup.exe	backup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\backup.exe	backup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
4244	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe
1772	backup.exe
2616	backup.exe
4812	backup.exe
4032	backup.exe
1096	backup.exe
4380	backup.exe
3600	backup.exe
3056	backup.exe
4496	backup.exe
1916	backup.exe
4304	backup.exe
1020	backup.exe
1756	backup.exe
1740	backup.exe
3988	backup.exe
1460	backup.exe
1320	backup.exe
5088	backup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 1772	4244	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe	81
PID 4244 wrote to memory of 1772	4244	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe	81
PID 4244 wrote to memory of 1772	4244	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe	81
PID 4244 wrote to memory of 2616	4244	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe	82
PID 4244 wrote to memory of 2616	4244	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe	82
PID 4244 wrote to memory of 2616	4244	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe	82
PID 4244 wrote to memory of 4812	4244	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe	83
PID 4244 wrote to memory of 4812	4244	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe	83
PID 4244 wrote to memory of 4812	4244	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe	83
PID 1772 wrote to memory of 4032	1772	backup.exe	84
PID 1772 wrote to memory of 4032	1772	backup.exe	84
PID 1772 wrote to memory of 4032	1772	backup.exe	84
PID 4244 wrote to memory of 1096	4244	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe	85
PID 4244 wrote to memory of 1096	4244	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe	85
PID 4244 wrote to memory of 1096	4244	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe	85
PID 4032 wrote to memory of 4380	4032	backup.exe	86
PID 4032 wrote to memory of 4380	4032	backup.exe	86
PID 4032 wrote to memory of 4380	4032	backup.exe	86
PID 4244 wrote to memory of 3600	4244	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe	87
PID 4244 wrote to memory of 3600	4244	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe	87
PID 4244 wrote to memory of 3600	4244	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe	87
PID 4032 wrote to memory of 3056	4032	backup.exe	88
PID 4032 wrote to memory of 3056	4032	backup.exe	88
PID 4032 wrote to memory of 3056	4032	backup.exe	88
PID 4244 wrote to memory of 4496	4244	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe	89
PID 4244 wrote to memory of 4496	4244	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe	89
PID 4244 wrote to memory of 4496	4244	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe	89
PID 4032 wrote to memory of 1916	4032	backup.exe	90
PID 4032 wrote to memory of 1916	4032	backup.exe	90
PID 4032 wrote to memory of 1916	4032	backup.exe	90
PID 4244 wrote to memory of 4304	4244	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe	91
PID 4244 wrote to memory of 4304	4244	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe	91
PID 4244 wrote to memory of 4304	4244	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe	91
PID 1916 wrote to memory of 1020	1916	backup.exe	92
PID 1916 wrote to memory of 1020	1916	backup.exe	92
PID 1916 wrote to memory of 1020	1916	backup.exe	92
PID 1020 wrote to memory of 1756	1020	backup.exe	93
PID 1020 wrote to memory of 1756	1020	backup.exe	93
PID 1020 wrote to memory of 1756	1020	backup.exe	93
PID 4032 wrote to memory of 3988	4032	backup.exe	97
PID 4032 wrote to memory of 3988	4032	backup.exe	97
PID 4032 wrote to memory of 3988	4032	backup.exe	97
PID 1916 wrote to memory of 1740	1916	backup.exe	96
PID 1916 wrote to memory of 1740	1916	backup.exe	96
PID 1916 wrote to memory of 1740	1916	backup.exe	96
PID 1740 wrote to memory of 1460	1740	backup.exe	98
PID 1740 wrote to memory of 1460	1740	backup.exe	98
PID 1740 wrote to memory of 1460	1740	backup.exe	98
PID 3988 wrote to memory of 1320	3988	backup.exe	99
PID 3988 wrote to memory of 1320	3988	backup.exe	99
PID 3988 wrote to memory of 1320	3988	backup.exe	99
PID 1740 wrote to memory of 5088	1740	backup.exe	100
PID 1740 wrote to memory of 5088	1740	backup.exe	100
PID 1740 wrote to memory of 5088	1740	backup.exe	100
PID 1320 wrote to memory of 4756	1320	backup.exe	101
PID 1320 wrote to memory of 4756	1320	backup.exe	101
PID 1320 wrote to memory of 4756	1320	backup.exe	101
PID 4032 wrote to memory of 2208	4032	backup.exe	103
PID 4032 wrote to memory of 2208	4032	backup.exe	103
PID 4032 wrote to memory of 2208	4032	backup.exe	103
PID 3988 wrote to memory of 1992	3988	backup.exe	105
PID 3988 wrote to memory of 1992	3988	backup.exe	105
PID 3988 wrote to memory of 1992	3988	backup.exe	105
PID 1740 wrote to memory of 4152	1740	backup.exe	104

System policy modification 1 TTPs 64 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe

C:\Users\Admin\AppData\Local\Temp\346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe
"C:\Users\Admin\AppData\Local\Temp\346b35bcef2160aa2715f7b8b1b10493f71957e35e5431554cbe516044e50497.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4244
- C:\Users\Admin\AppData\Local\Temp\1825798482\backup.exe
  C:\Users\Admin\AppData\Local\Temp\1825798482\backup.exe C:\Users\Admin\AppData\Local\Temp\1825798482\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1772
- - C:\backup.exe
    \backup.exe \
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4032
  - - C:\odt\backup.exe
      C:\odt\backup.exe C:\odt\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:4380
  - - C:\PerfLogs\backup.exe
      C:\PerfLogs\backup.exe C:\PerfLogs\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:3056
  - - C:\Program Files\backup.exe
      "C:\Program Files\backup.exe" C:\Program Files\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1916
    - - C:\Program Files\7-Zip\backup.exe
        
        "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1020
      - C:\Program Files\7-Zip\Lang\backup.exe
        
        "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1756
    - - C:\Program Files\Common Files\backup.exe
        
        "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1740
      - C:\Program Files\Common Files\DESIGNER\backup.exe
        
        "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:1460
      - C:\Program Files\Common Files\microsoft shared\backup.exe
        
        "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:5088
        
        C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
        
        "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
        7⤵
        Executes dropped EXE
        
        PID:3500
        
        C:\Program Files\Common Files\microsoft shared\ink\backup.exe
        
        "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
        7⤵
        Executes dropped EXE
        
        PID:5084
      - C:\Program Files\Common Files\Services\backup.exe
        
        "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
        6⤵
        Executes dropped EXE
        
        PID:4152
      - C:\Program Files\Common Files\System\backup.exe
        
        "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
        6⤵
        Executes dropped EXE
        
        PID:5016
    - - C:\Program Files\Google\backup.exe
        
        "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
        5⤵
        Executes dropped EXE
        
        PID:3468
    - - C:\Program Files\Internet Explorer\backup.exe
        
        "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
        5⤵
        Executes dropped EXE
        
        PID:3552
  - - C:\Program Files (x86)\backup.exe
      "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3988
    - - C:\Program Files (x86)\Adobe\backup.exe
        
        "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1320
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\update.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
        6⤵
        Executes dropped EXE
        
        PID:4756
    - - C:\Program Files (x86)\Common Files\backup.exe
        
        "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
        5⤵
        Executes dropped EXE
        
        PID:1992
    - - C:\Program Files (x86)\Google\backup.exe
        
        "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
        5⤵
        Executes dropped EXE
        
        PID:4984
  - - C:\Users\backup.exe
      C:\Users\backup.exe C:\Users\
      4⤵
      Executes dropped EXE
      PID:2208
  - - C:\Windows\backup.exe
      C:\Windows\backup.exe C:\Windows\
      4⤵
      Executes dropped EXE
      PID:3572
- C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2616
- C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:4812
- C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1096
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:3600
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:4496
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:4304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\backup.exe

Filesize
72KB

MD5
d274b4e6b47dbbdf7a9ad3e83a62916c

SHA1
2ec89cb74c8e9867f7a9167bff42a9a485497c1a

SHA256
5f93f30342975d21da7c068ad38fd3754054bf04aa98459a5fa3e62b00e22e35

SHA512
d3809a17635574283a7dd2577886dcd138e19f2fc8890719b38d98862da4049cce78ba3b604cc971220cf9a39384cb3b7993e50e4d9ee360d1536277db0b6809

Download Submit
C:\PerfLogs\backup.exe

Filesize
72KB

MD5
d274b4e6b47dbbdf7a9ad3e83a62916c

SHA1
2ec89cb74c8e9867f7a9167bff42a9a485497c1a

SHA256
5f93f30342975d21da7c068ad38fd3754054bf04aa98459a5fa3e62b00e22e35

SHA512
d3809a17635574283a7dd2577886dcd138e19f2fc8890719b38d98862da4049cce78ba3b604cc971220cf9a39384cb3b7993e50e4d9ee360d1536277db0b6809

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\update.exe

Filesize
72KB

MD5
43bbf16dbed7445c54fdd27af32ab383

SHA1
e887c7046b3faec662ccefeeb1d95cca2a1a6f10

SHA256
3d65d1eb933427c2e773125eab807a2c6d20a8f97a1548e23d93c092a6795b79

SHA512
d8241e53fcc1a0ac7dd58401a6da721e2f90cc0873c73550601ab381974d002790c1623180556048e32dc793ade483368cc3f94fec01d2a1a3ddfde65a986355

Download Submit
C:\Program Files (x86)\Adobe\backup.exe

Filesize
72KB

MD5
79659541e14bb352c944942bc6a69edc

SHA1
5ffedb4bf1d6d1ec8dc38c5d0c23a597408e02d8

SHA256
70f5d80626399666eebf4e58791cd9eae6def0dae44443937314fa348f84f2e5

SHA512
0a779c16c542543be49a46b384bcd656f4b2719197577d81c27059da9c9a91c7ca087089b4bd6dae58f932b81fa083ef9573d537cd76af5d0e97476bc6fa1a4a

Download Submit
C:\Program Files (x86)\Adobe\backup.exe

Filesize
72KB

MD5
79659541e14bb352c944942bc6a69edc

SHA1
5ffedb4bf1d6d1ec8dc38c5d0c23a597408e02d8

SHA256
70f5d80626399666eebf4e58791cd9eae6def0dae44443937314fa348f84f2e5

SHA512
0a779c16c542543be49a46b384bcd656f4b2719197577d81c27059da9c9a91c7ca087089b4bd6dae58f932b81fa083ef9573d537cd76af5d0e97476bc6fa1a4a

Download Submit
C:\Program Files (x86)\Common Files\backup.exe

Filesize
72KB

MD5
8e02e245a1c3098ff3a5e7cc241a8cff

SHA1
54063d06c15417705bd8b435d7649b2e0763b894

SHA256
e8000b4af7be403ac535b08a58847552768e082a54210eb23d6354bbfa381251

SHA512
a44db20ac0a8eaed6b371e613a753077bda62091793419126d708ba825de060dba25f9e95346b76e6f6b108953c20fcfbe1868c0bd04320bf1483153eefcba77

Download Submit
C:\Program Files (x86)\Google\backup.exe

Filesize
72KB

MD5
b5982c4ce1f8784db8903de62cdc9703

SHA1
6e0ab8f182eac4e5f26864dbe5ee1fd4ba856188

SHA256
0a3994404e41d1834334524cc4df7b7fd5218313f72996eae731085eff26e587

SHA512
787dfe33a910d87dfc0c14b2f2091b73d4a7d19d4b6370cd996a8ebdd5d432757025e99281bd6f436fcf90594eeeb42c880de88e6808472193be0822ebf803bb

Download Submit
C:\Program Files (x86)\backup.exe

Filesize
72KB

MD5
a2bca79cbe08910b3ff704ff7f6edccc

SHA1
bbe4a77153e93c8d2ecb141b7f1652ef4c307d74

SHA256
7b60ed24fcecc7fcf6a916952426041ebf1ceddee794c356daa2ad894e9f7ff2

SHA512
7de01219a73392def2cc10497164f8b005337647b58c4b733c274a7a5d20667b3e98089e59b1657e7bea0f6995df34cb13f94e3c2c938abd226f7d9e8b854ac8

Download Submit
C:\Program Files (x86)\backup.exe

Filesize
72KB

MD5
a2bca79cbe08910b3ff704ff7f6edccc

SHA1
bbe4a77153e93c8d2ecb141b7f1652ef4c307d74

SHA256
7b60ed24fcecc7fcf6a916952426041ebf1ceddee794c356daa2ad894e9f7ff2

SHA512
7de01219a73392def2cc10497164f8b005337647b58c4b733c274a7a5d20667b3e98089e59b1657e7bea0f6995df34cb13f94e3c2c938abd226f7d9e8b854ac8

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
3a1612b8af79b5c7f2e33a1bb596a84d

SHA1
0d7aa41c03bd0718a1df184a99b82dc96d8653fa

SHA256
409eb98b6721f4d16158a97f0417dea974b4c5a7f7e0a9c592913784421df95b

SHA512
9897aa2b7938575a37817b71c7018c9f926e94fb7ca4d44c5552683b4f8419241bbd7355b100d48a80f8a2d5b0e6d8dbe3ddf82337476e5e7f008ba7fb6fc8f8

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
3a1612b8af79b5c7f2e33a1bb596a84d

SHA1
0d7aa41c03bd0718a1df184a99b82dc96d8653fa

SHA256
409eb98b6721f4d16158a97f0417dea974b4c5a7f7e0a9c592913784421df95b

SHA512
9897aa2b7938575a37817b71c7018c9f926e94fb7ca4d44c5552683b4f8419241bbd7355b100d48a80f8a2d5b0e6d8dbe3ddf82337476e5e7f008ba7fb6fc8f8

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
73f572976fa095101fc61531834ab16e

SHA1
f285dc1f2c1c1dd726181ffd574dbe08f350c065

SHA256
4d18adc630b2ef1dd4faae15dad2f40ffdf62db3eab070175dba0c3dad2d00ad

SHA512
dd05edab2dd1e568b0d36f0523c3050761a5116bd8e3a60c62b3ff42f0e48e9ecfd499a4ba045e1f3735953f483a8de21b4a9a871b5c05a721e7ca26f1378dfe

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
73f572976fa095101fc61531834ab16e

SHA1
f285dc1f2c1c1dd726181ffd574dbe08f350c065

SHA256
4d18adc630b2ef1dd4faae15dad2f40ffdf62db3eab070175dba0c3dad2d00ad

SHA512
dd05edab2dd1e568b0d36f0523c3050761a5116bd8e3a60c62b3ff42f0e48e9ecfd499a4ba045e1f3735953f483a8de21b4a9a871b5c05a721e7ca26f1378dfe

Download Submit
C:\Program Files\Common Files\DESIGNER\backup.exe

Filesize
72KB

MD5
e7ba794db8d60d645f1b9ddb37087d0f

SHA1
16943cebf9576df8c05d717d0951867e1a90bc88

SHA256
93752c2436827f40819b019b81750d1f7a6588bcd9e75ec6be2f4cfc931a22b7

SHA512
7260c2616a6a3f377e9f102cb05a85a327cf2c6b390ed8e06de083d7c7611fd23f5f9370ab0d39fcd227e621d829489b9508d0d49bae9c3e05edfd06257a5065

Download Submit
C:\Program Files\Common Files\DESIGNER\backup.exe

Filesize
72KB

MD5
e7ba794db8d60d645f1b9ddb37087d0f

SHA1
16943cebf9576df8c05d717d0951867e1a90bc88

SHA256
93752c2436827f40819b019b81750d1f7a6588bcd9e75ec6be2f4cfc931a22b7

SHA512
7260c2616a6a3f377e9f102cb05a85a327cf2c6b390ed8e06de083d7c7611fd23f5f9370ab0d39fcd227e621d829489b9508d0d49bae9c3e05edfd06257a5065

Download Submit
C:\Program Files\Common Files\Services\backup.exe

Filesize
72KB

MD5
cd8d83ae6f2970092f14df1df71beed3

SHA1
8d2f56a024d8ee086e3ef2ce9115692453cf884c

SHA256
4907621342ce649a56ea9e36a7bbe249b3f87a914d1b6f800a1081b27f549dda

SHA512
b043e6133a1d84df7695c4398a38c9855351433f6f7c32340d2aa10b4a758eb58defad9bd917f893fb1a59fa237c0b1e1ef56c501b09f0240f0e93f4855ac2c9

Download Submit
C:\Program Files\Common Files\System\backup.exe

Filesize
72KB

MD5
6e34ce09d69e9b683205669b1c77bc4d

SHA1
eecbed1637da7f076afdcff3c4ebae477214f590

SHA256
ff98b015906de8f94baf20309b8ea328267d38d03ba2aa34d3e006d2e12190a7

SHA512
e1edac166877b6d031333277c7a125b3967b43786fbacf37f87b4238a3bb4c993d06afa8da05d3a680d2331fd9a5ac6efac6729ed63975cc544f61b318c662ff

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
a551381af965a1ed66a36376243098c7

SHA1
cf62c64f22da522e8f78843ddb0bddbbf8fc3e00

SHA256
3b4739a8fa7d9c5d359dee0a160e357ea2cedaf0ee156a142938801c9a506f8d

SHA512
da735ad4cbde33968a21a781c4d395916d139f5c9e72dd6c5e5e2bba38b9a2db64e31f6ac6aaf9e27cdee6af6d4c440cab33bc54e91084caf1f7ecaf27589bea

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
a551381af965a1ed66a36376243098c7

SHA1
cf62c64f22da522e8f78843ddb0bddbbf8fc3e00

SHA256
3b4739a8fa7d9c5d359dee0a160e357ea2cedaf0ee156a142938801c9a506f8d

SHA512
da735ad4cbde33968a21a781c4d395916d139f5c9e72dd6c5e5e2bba38b9a2db64e31f6ac6aaf9e27cdee6af6d4c440cab33bc54e91084caf1f7ecaf27589bea

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

Filesize
72KB

MD5
d3039bd03f27ed57b315e50d5a83f964

SHA1
a4c9b6b147630a9e74edada8d02e6d9bcd1e63ae

SHA256
a63775f3794a23e7854db41dbe22d1ecfeb51b3e46231a574b0708dd3b937379

SHA512
9aac5224b514c75645e888ec2df4102af487f5485a1e9a5d461acc5a6616264fd750966bac956640b9eda7afe4194ddeb46db1dabbc05c3e84c28709e4e9f22c

Download Submit
C:\Program Files\Common Files\microsoft shared\backup.exe

Filesize
72KB

MD5
e7ba794db8d60d645f1b9ddb37087d0f

SHA1
16943cebf9576df8c05d717d0951867e1a90bc88

SHA256
93752c2436827f40819b019b81750d1f7a6588bcd9e75ec6be2f4cfc931a22b7

SHA512
7260c2616a6a3f377e9f102cb05a85a327cf2c6b390ed8e06de083d7c7611fd23f5f9370ab0d39fcd227e621d829489b9508d0d49bae9c3e05edfd06257a5065

Download Submit
C:\Program Files\Common Files\microsoft shared\backup.exe

Filesize
72KB

MD5
e7ba794db8d60d645f1b9ddb37087d0f

SHA1
16943cebf9576df8c05d717d0951867e1a90bc88

SHA256
93752c2436827f40819b019b81750d1f7a6588bcd9e75ec6be2f4cfc931a22b7

SHA512
7260c2616a6a3f377e9f102cb05a85a327cf2c6b390ed8e06de083d7c7611fd23f5f9370ab0d39fcd227e621d829489b9508d0d49bae9c3e05edfd06257a5065

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\backup.exe

Filesize
72KB

MD5
8d79d354cad5a20b9f0402861754e93e

SHA1
58125873c453f41a445dfffbd478db007daabed8

SHA256
f5ab26dc14fa207964f8a3c8af06788aa60aadb457f17403cbc29339f39bfaec

SHA512
ffb5af9743d3041e7736a376c113a875ec104cd055971d3885cda0de2e173395c31d256007888918789ca793d18e37074e26f2b06dd11d167eaa8bc92fb62d4f

Download Submit
C:\Program Files\Google\backup.exe

Filesize
72KB

MD5
56a224c6afd628f4f51ab32161b2fd8d

SHA1
d3fef90f3982cf6c4e35fd7aa9cb144e3d792bb6

SHA256
93195b2794bea2f5984c74e726d5241fbd2a8f2775dd44a8cf6bdd3ceb9e630d

SHA512
62f8b7645f5fa95aa7a5af2be4ea8a8da41d1ebdd6339e407934a51289c4ab18f405002390129299c9e8e4b1d0c612ae5a1d31370047102c01badfb6b32d9a74

Download Submit
C:\Program Files\Internet Explorer\backup.exe

Filesize
72KB

MD5
c7c865d6b791c978c385a67f2888d168

SHA1
f67d9d69133da07888367b0731eb43d35946f66c

SHA256
a95373c802d2c786d1f957bc4dbe510b3b7e61a15d1aaecd2b0fb539567d501b

SHA512
471239c1f72b554264b1253b7340a2269f8e1252d44e0a736981c47fe2357e93f9ca85f79b01122167856a3430d1744d0cb87084109b26ff6926eb24d6018534

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
d274b4e6b47dbbdf7a9ad3e83a62916c

SHA1
2ec89cb74c8e9867f7a9167bff42a9a485497c1a

SHA256
5f93f30342975d21da7c068ad38fd3754054bf04aa98459a5fa3e62b00e22e35

SHA512
d3809a17635574283a7dd2577886dcd138e19f2fc8890719b38d98862da4049cce78ba3b604cc971220cf9a39384cb3b7993e50e4d9ee360d1536277db0b6809

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
d274b4e6b47dbbdf7a9ad3e83a62916c

SHA1
2ec89cb74c8e9867f7a9167bff42a9a485497c1a

SHA256
5f93f30342975d21da7c068ad38fd3754054bf04aa98459a5fa3e62b00e22e35

SHA512
d3809a17635574283a7dd2577886dcd138e19f2fc8890719b38d98862da4049cce78ba3b604cc971220cf9a39384cb3b7993e50e4d9ee360d1536277db0b6809

Download Submit
C:\Users\Admin\AppData\Local\Temp\1825798482\backup.exe

Filesize
72KB

MD5
fc222581bae7d24ff6c6737b0384c343

SHA1
d0bc18031d3a41f8ac20ef48a835b3e10c012fb4

SHA256
375bda4f4bab13468aee91064cd32b928f61f039bd5580a6402f2d0d07776a3c

SHA512
f29b6830e6816f8fbde0d8de4ff4f990d022aac2a99951dc6e0927951437e974bace58f08cb91724e6175490ba253e6a6bc01ea8c6e9561891ece944aa86bbc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1825798482\backup.exe

Filesize
72KB

MD5
fc222581bae7d24ff6c6737b0384c343

SHA1
d0bc18031d3a41f8ac20ef48a835b3e10c012fb4

SHA256
375bda4f4bab13468aee91064cd32b928f61f039bd5580a6402f2d0d07776a3c

SHA512
f29b6830e6816f8fbde0d8de4ff4f990d022aac2a99951dc6e0927951437e974bace58f08cb91724e6175490ba253e6a6bc01ea8c6e9561891ece944aa86bbc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
c2dd15e543039138a617e2d9ae9fb237

SHA1
ed83884a915b1caa4241c168ddda2ac06dd9d37f

SHA256
f54c0ab97279840556b2dc938474069182f969db1fd00871b7cd5216c05f6ffc

SHA512
50ec3593c86fd65a73b5b62c14c472efcf6ba617ef8b5bcfbb7cd9b92fe12ef94290ae4e38c4f8ea78281f989e61e01924abebef66ff4291e2e9c88d4e847355

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
c2dd15e543039138a617e2d9ae9fb237

SHA1
ed83884a915b1caa4241c168ddda2ac06dd9d37f

SHA256
f54c0ab97279840556b2dc938474069182f969db1fd00871b7cd5216c05f6ffc

SHA512
50ec3593c86fd65a73b5b62c14c472efcf6ba617ef8b5bcfbb7cd9b92fe12ef94290ae4e38c4f8ea78281f989e61e01924abebef66ff4291e2e9c88d4e847355

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
43dd9cc752eadcb8bdcf5719a0067ba4

SHA1
bb247633d1215f7024df5619b0d67d1243182f0e

SHA256
e348169bd6c430322efd386b2b17b2e247a4f8bbac17f375488eb26b03d238dd

SHA512
dbea800fcb24619939d27d515ff54820201685348a830d73bb217d2a3adbca9a362dea12cab411099069809086d5182fc954e358533ae554146a49905d2da16f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
43dd9cc752eadcb8bdcf5719a0067ba4

SHA1
bb247633d1215f7024df5619b0d67d1243182f0e

SHA256
e348169bd6c430322efd386b2b17b2e247a4f8bbac17f375488eb26b03d238dd

SHA512
dbea800fcb24619939d27d515ff54820201685348a830d73bb217d2a3adbca9a362dea12cab411099069809086d5182fc954e358533ae554146a49905d2da16f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
43dd9cc752eadcb8bdcf5719a0067ba4

SHA1
bb247633d1215f7024df5619b0d67d1243182f0e

SHA256
e348169bd6c430322efd386b2b17b2e247a4f8bbac17f375488eb26b03d238dd

SHA512
dbea800fcb24619939d27d515ff54820201685348a830d73bb217d2a3adbca9a362dea12cab411099069809086d5182fc954e358533ae554146a49905d2da16f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
43dd9cc752eadcb8bdcf5719a0067ba4

SHA1
bb247633d1215f7024df5619b0d67d1243182f0e

SHA256
e348169bd6c430322efd386b2b17b2e247a4f8bbac17f375488eb26b03d238dd

SHA512
dbea800fcb24619939d27d515ff54820201685348a830d73bb217d2a3adbca9a362dea12cab411099069809086d5182fc954e358533ae554146a49905d2da16f

Download Submit
C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

Filesize
72KB

MD5
fc222581bae7d24ff6c6737b0384c343

SHA1
d0bc18031d3a41f8ac20ef48a835b3e10c012fb4

SHA256
375bda4f4bab13468aee91064cd32b928f61f039bd5580a6402f2d0d07776a3c

SHA512
f29b6830e6816f8fbde0d8de4ff4f990d022aac2a99951dc6e0927951437e974bace58f08cb91724e6175490ba253e6a6bc01ea8c6e9561891ece944aa86bbc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

Filesize
72KB

MD5
fc222581bae7d24ff6c6737b0384c343

SHA1
d0bc18031d3a41f8ac20ef48a835b3e10c012fb4

SHA256
375bda4f4bab13468aee91064cd32b928f61f039bd5580a6402f2d0d07776a3c

SHA512
f29b6830e6816f8fbde0d8de4ff4f990d022aac2a99951dc6e0927951437e974bace58f08cb91724e6175490ba253e6a6bc01ea8c6e9561891ece944aa86bbc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
c2dd15e543039138a617e2d9ae9fb237

SHA1
ed83884a915b1caa4241c168ddda2ac06dd9d37f

SHA256
f54c0ab97279840556b2dc938474069182f969db1fd00871b7cd5216c05f6ffc

SHA512
50ec3593c86fd65a73b5b62c14c472efcf6ba617ef8b5bcfbb7cd9b92fe12ef94290ae4e38c4f8ea78281f989e61e01924abebef66ff4291e2e9c88d4e847355

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
c2dd15e543039138a617e2d9ae9fb237

SHA1
ed83884a915b1caa4241c168ddda2ac06dd9d37f

SHA256
f54c0ab97279840556b2dc938474069182f969db1fd00871b7cd5216c05f6ffc

SHA512
50ec3593c86fd65a73b5b62c14c472efcf6ba617ef8b5bcfbb7cd9b92fe12ef94290ae4e38c4f8ea78281f989e61e01924abebef66ff4291e2e9c88d4e847355

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
43dd9cc752eadcb8bdcf5719a0067ba4

SHA1
bb247633d1215f7024df5619b0d67d1243182f0e

SHA256
e348169bd6c430322efd386b2b17b2e247a4f8bbac17f375488eb26b03d238dd

SHA512
dbea800fcb24619939d27d515ff54820201685348a830d73bb217d2a3adbca9a362dea12cab411099069809086d5182fc954e358533ae554146a49905d2da16f

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
43dd9cc752eadcb8bdcf5719a0067ba4

SHA1
bb247633d1215f7024df5619b0d67d1243182f0e

SHA256
e348169bd6c430322efd386b2b17b2e247a4f8bbac17f375488eb26b03d238dd

SHA512
dbea800fcb24619939d27d515ff54820201685348a830d73bb217d2a3adbca9a362dea12cab411099069809086d5182fc954e358533ae554146a49905d2da16f

Download Submit
C:\Users\backup.exe

Filesize
72KB

MD5
940da7a767f09f5ec23f25ff89ac50b6

SHA1
8ad6195a8149c57aea205bed0689802b4c6d7480

SHA256
dbe6c3b733ff093bd393e0c106fe1e6d56712bdecad0981f9a746667be01ef98

SHA512
5d779b412dff6b530ef6f50c4a9e1d231c39dedccd7753b144dda76d40f9654cbe42e4a6a2fa9286b56acd01d8fc87a3c1c04c4ea8264281f5ec1c10d1cc40a5

Download Submit
C:\Windows\backup.exe

Filesize
72KB

MD5
b9ab5dcc2f9a9b84d7f72c2e71261b65

SHA1
0dae32af7266fca79135deddb48778a565fd7827

SHA256
86e1ca7f8e09551e799df00a8e4888d51bc3f4a10be53aed7254ac5cc7d43efc

SHA512
251556eba9668bd69c8f59feaa55550bb610549577f33e285f98303211e4237f5679fc0e71b29a835a417f5094537c847528974f025097de387b7ec271b45538

Download Submit
C:\backup.exe

Filesize
72KB

MD5
3054718095dc5eaec95d3e20db857e81

SHA1
336e4709dd941262daff409e8ef9a01a4523de1b

SHA256
26a44b8a065996407c93a1aa90179f05d5d60654c5b5c5141ce9a47cbdcaacb2

SHA512
a5320536002bdc27c7a2a626e07387f1889ab7c76dca6c5449bdd94f2159b45050813c2bc903881a46c3d40d786c5ca41ba927b08978fac5fc6ac9fe8e8d6e37

Download Submit
C:\backup.exe

Filesize
72KB

MD5
3054718095dc5eaec95d3e20db857e81

SHA1
336e4709dd941262daff409e8ef9a01a4523de1b

SHA256
26a44b8a065996407c93a1aa90179f05d5d60654c5b5c5141ce9a47cbdcaacb2

SHA512
a5320536002bdc27c7a2a626e07387f1889ab7c76dca6c5449bdd94f2159b45050813c2bc903881a46c3d40d786c5ca41ba927b08978fac5fc6ac9fe8e8d6e37

Download Submit
C:\odt\backup.exe

Filesize
72KB

MD5
062ecf2b7287881da6bbf4f013ae382e

SHA1
11c5fe3c178edb892946be4040ae535499f9d1f2

SHA256
235847c3007dce74451c8650161e817c03210610a9520aaceb5ebe49c0a245c6

SHA512
ef3219d087a9538398cfcb81a7c657014575fe75c38d14b029848e85e1613d7af6f6e9b6d8104e58596a6bba300b9d98bc517e22080e855d1c416c24d097ccaf

Download Submit
C:\odt\backup.exe

Filesize
72KB

MD5
062ecf2b7287881da6bbf4f013ae382e

SHA1
11c5fe3c178edb892946be4040ae535499f9d1f2

SHA256
235847c3007dce74451c8650161e817c03210610a9520aaceb5ebe49c0a245c6

SHA512
ef3219d087a9538398cfcb81a7c657014575fe75c38d14b029848e85e1613d7af6f6e9b6d8104e58596a6bba300b9d98bc517e22080e855d1c416c24d097ccaf

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads