1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34

Analysis

max time kernel
288s
max time network
346s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe
Size

72KB
MD5

0c894426557f37b7c404e14a9466cd6f
SHA1

8541f317cfe71176051bac583f79289eb8280450
SHA256

1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34
SHA512

8c88141fc4f7dc3d9b128da792fe0cf73c20d76f6c39e7c2c43af7a5fb7b9664fb2e2d2e146fba265802f631ed636baa3ff0cb3007e8a62e07ba9891df2edd2f
SSDEEP

384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf26:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPu

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 18 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe

Disables RegEdit via registry modification 36 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe

Executes dropped EXE 20 IoCs

pid	Process
3716	backup.exe
380	backup.exe
3076	backup.exe
5112	backup.exe
1016	backup.exe
1340	backup.exe
2684	backup.exe
60	backup.exe
1320	backup.exe
4064	backup.exe
4532	backup.exe
2948	backup.exe
3952	backup.exe
3108	backup.exe
3676	backup.exe
1952	backup.exe
2152	backup.exe
5084	backup.exe
2140	backup.exe
2448	System Restore.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\System Restore.exe	backup.exe
File opened for modification	C:\Program Files\7-Zip\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\backup.exe	backup.exe
File opened for modification	C:\Program Files\7-Zip\Lang\backup.exe	backup.exe
File opened for modification	C:\Program Files\Google\backup.exe	backup.exe
File opened for modification	C:\Program Files (x86)\Adobe\backup.exe	backup.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\backup.exe	backup.exe
File opened for modification	C:\Program Files\Internet Explorer\backup.exe	backup.exe
File opened for modification	C:\Program Files\backup.exe	backup.exe
File opened for modification	C:\Program Files\Google\Chrome\backup.exe	backup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\backup.exe	backup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
3028	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe
3716	backup.exe
380	backup.exe
3076	backup.exe
5112	backup.exe
1016	backup.exe
1340	backup.exe
2684	backup.exe
60	backup.exe
1320	backup.exe
4064	backup.exe
4532	backup.exe
2948	backup.exe
3108	backup.exe
3952	backup.exe
3676	backup.exe
1952	backup.exe
2152	backup.exe
5084	backup.exe
2140	backup.exe
2448	System Restore.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 3716	3028	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe	81
PID 3028 wrote to memory of 3716	3028	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe	81
PID 3028 wrote to memory of 3716	3028	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe	81
PID 3028 wrote to memory of 380	3028	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe	82
PID 3028 wrote to memory of 380	3028	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe	82
PID 3028 wrote to memory of 380	3028	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe	82
PID 3028 wrote to memory of 3076	3028	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe	83
PID 3028 wrote to memory of 3076	3028	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe	83
PID 3028 wrote to memory of 3076	3028	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe	83
PID 3028 wrote to memory of 5112	3028	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe	84
PID 3028 wrote to memory of 5112	3028	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe	84
PID 3028 wrote to memory of 5112	3028	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe	84
PID 3028 wrote to memory of 1016	3028	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe	86
PID 3028 wrote to memory of 1016	3028	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe	86
PID 3028 wrote to memory of 1016	3028	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe	86
PID 3716 wrote to memory of 1340	3716	backup.exe	87
PID 3716 wrote to memory of 1340	3716	backup.exe	87
PID 3716 wrote to memory of 1340	3716	backup.exe	87
PID 3028 wrote to memory of 2684	3028	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe	88
PID 3028 wrote to memory of 2684	3028	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe	88
PID 3028 wrote to memory of 2684	3028	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe	88
PID 1340 wrote to memory of 60	1340	backup.exe	89
PID 1340 wrote to memory of 60	1340	backup.exe	89
PID 1340 wrote to memory of 60	1340	backup.exe	89
PID 3028 wrote to memory of 1320	3028	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe	90
PID 3028 wrote to memory of 1320	3028	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe	90
PID 3028 wrote to memory of 1320	3028	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe	90
PID 1340 wrote to memory of 4064	1340	backup.exe	91
PID 1340 wrote to memory of 4064	1340	backup.exe	91
PID 1340 wrote to memory of 4064	1340	backup.exe	91
PID 1340 wrote to memory of 4532	1340	backup.exe	92
PID 1340 wrote to memory of 4532	1340	backup.exe	92
PID 1340 wrote to memory of 4532	1340	backup.exe	92
PID 4532 wrote to memory of 2948	4532	backup.exe	93
PID 4532 wrote to memory of 2948	4532	backup.exe	93
PID 4532 wrote to memory of 2948	4532	backup.exe	93
PID 4532 wrote to memory of 3952	4532	backup.exe	95
PID 4532 wrote to memory of 3952	4532	backup.exe	95
PID 4532 wrote to memory of 3952	4532	backup.exe	95
PID 1340 wrote to memory of 3108	1340	backup.exe	94
PID 1340 wrote to memory of 3108	1340	backup.exe	94
PID 1340 wrote to memory of 3108	1340	backup.exe	94
PID 2948 wrote to memory of 3676	2948	backup.exe	96
PID 2948 wrote to memory of 3676	2948	backup.exe	96
PID 2948 wrote to memory of 3676	2948	backup.exe	96
PID 3108 wrote to memory of 2152	3108	backup.exe	99
PID 3108 wrote to memory of 2152	3108	backup.exe	99
PID 3108 wrote to memory of 2152	3108	backup.exe	99
PID 1340 wrote to memory of 1952	1340	backup.exe	101
PID 1340 wrote to memory of 1952	1340	backup.exe	101
PID 1340 wrote to memory of 1952	1340	backup.exe	101
PID 4532 wrote to memory of 5084	4532	backup.exe	100
PID 4532 wrote to memory of 5084	4532	backup.exe	100
PID 4532 wrote to memory of 5084	4532	backup.exe	100
PID 3952 wrote to memory of 2140	3952	backup.exe	102
PID 3952 wrote to memory of 2140	3952	backup.exe	102
PID 3952 wrote to memory of 2140	3952	backup.exe	102
PID 3952 wrote to memory of 2448	3952	backup.exe	103
PID 3952 wrote to memory of 2448	3952	backup.exe	103
PID 3952 wrote to memory of 2448	3952	backup.exe	103

System policy modification 1 TTPs 64 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	backup.exe

C:\Users\Admin\AppData\Local\Temp\1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe
"C:\Users\Admin\AppData\Local\Temp\1cdabe6ca30cf0e5b22f0819f32a3fdf8dd26bf46b4fd8a44183562158b25f34.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3028
- C:\Users\Admin\AppData\Local\Temp\3017157104\backup.exe
  C:\Users\Admin\AppData\Local\Temp\3017157104\backup.exe C:\Users\Admin\AppData\Local\Temp\3017157104\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3716
- - C:\backup.exe
    \backup.exe \
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1340
  - - C:\odt\backup.exe
      C:\odt\backup.exe C:\odt\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:60
  - - C:\PerfLogs\backup.exe
      C:\PerfLogs\backup.exe C:\PerfLogs\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:4064
  - - C:\Program Files\backup.exe
      "C:\Program Files\backup.exe" C:\Program Files\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4532
    - - C:\Program Files\7-Zip\backup.exe
        
        "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2948
      - C:\Program Files\7-Zip\Lang\backup.exe
        
        "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:3676
    - - C:\Program Files\Common Files\backup.exe
        
        "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3952
      - C:\Program Files\Common Files\DESIGNER\backup.exe
        
        "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
        6⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2140
      - C:\Program Files\Common Files\microsoft shared\System Restore.exe
        
        "C:\Program Files\Common Files\microsoft shared\System Restore.exe" C:\Program Files\Common Files\microsoft shared\
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2448
    - - C:\Program Files\Google\backup.exe
        
        "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:5084
  - - C:\Program Files (x86)\backup.exe
      "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3108
    - - C:\Program Files (x86)\Adobe\backup.exe
        
        "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
        5⤵
        Modifies visibility of file extensions in Explorer
        Disables RegEdit via registry modification
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:2152
  - - C:\Users\backup.exe
      C:\Users\backup.exe C:\Users\
      4⤵
      Modifies visibility of file extensions in Explorer
      Disables RegEdit via registry modification
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:1952
- C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:380
- C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:3076
- C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5112
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1016
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:2684
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\backup.exe

Filesize
72KB

MD5
690ce2f2e11bc765fdeb3c58a031316b

SHA1
7e2b9da682d8fe517e6817559426c9d9d5cd285d

SHA256
d8c66b0f75c3f171cd37cd325f38bd348db5652fdd34ad2439976f86ae94243a

SHA512
f8882b61cd2619249bb39a2538223c167910ef384f8fed3e8930d311209a0efd5e15248bca5c5d529946685fe43b41ad78388cb070e4cfd429b74a9a94b594fb

Download Submit
C:\PerfLogs\backup.exe

Filesize
72KB

MD5
690ce2f2e11bc765fdeb3c58a031316b

SHA1
7e2b9da682d8fe517e6817559426c9d9d5cd285d

SHA256
d8c66b0f75c3f171cd37cd325f38bd348db5652fdd34ad2439976f86ae94243a

SHA512
f8882b61cd2619249bb39a2538223c167910ef384f8fed3e8930d311209a0efd5e15248bca5c5d529946685fe43b41ad78388cb070e4cfd429b74a9a94b594fb

Download Submit
C:\Program Files (x86)\Adobe\backup.exe

Filesize
72KB

MD5
c5274c288d2306741e61f0e4a29e57dc

SHA1
de0f65119c21ac3a30edde9e79b92d87f2e226dd

SHA256
9b1820158275e605ef3ed3c5e6ef1dd3955ee7d4f98cb834859fed02ee1336dc

SHA512
3861f3792f3e14219ba4fe989131e77eadf8deba57a474b5ce7d204424a784d6fec4497ba573500488f42385137be4256097fe63830afff8d1196e94e046d95e

Download Submit
C:\Program Files (x86)\Adobe\backup.exe

Filesize
72KB

MD5
c5274c288d2306741e61f0e4a29e57dc

SHA1
de0f65119c21ac3a30edde9e79b92d87f2e226dd

SHA256
9b1820158275e605ef3ed3c5e6ef1dd3955ee7d4f98cb834859fed02ee1336dc

SHA512
3861f3792f3e14219ba4fe989131e77eadf8deba57a474b5ce7d204424a784d6fec4497ba573500488f42385137be4256097fe63830afff8d1196e94e046d95e

Download Submit
C:\Program Files (x86)\backup.exe

Filesize
72KB

MD5
eb7f7afb1bbe3677ec8d8ce369d809ea

SHA1
72132330dfa5fefb9989a5bd49771e06945319f4

SHA256
fe9075fb2d3af99e311cde9ec3eee9ebba27208803c8064626eca9d5d5c22fae

SHA512
740e54e5f9ee7b12213af083ad3077bf8c2c1cbd8520ccec01b59fd4c35a8b9b5888e1a490e8bc2ea147f18e5e1d58f0dd0eacd166b45758ef3e726238a29561

Download Submit
C:\Program Files (x86)\backup.exe

Filesize
72KB

MD5
eb7f7afb1bbe3677ec8d8ce369d809ea

SHA1
72132330dfa5fefb9989a5bd49771e06945319f4

SHA256
fe9075fb2d3af99e311cde9ec3eee9ebba27208803c8064626eca9d5d5c22fae

SHA512
740e54e5f9ee7b12213af083ad3077bf8c2c1cbd8520ccec01b59fd4c35a8b9b5888e1a490e8bc2ea147f18e5e1d58f0dd0eacd166b45758ef3e726238a29561

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
060f0fb4c9c5c2d764fca3392cdbde1d

SHA1
c91f05333bfda4df0ef72a5052f31ea0fef49eeb

SHA256
d1c5da5c9170b764705e9d725fcaf0e7c997a06d78380fbc6ab66369eb344dd4

SHA512
23394c05f5ab1fc68d682948691028d6aceb4520f1a0d14ab2524504260e20391e544b1608153e9b36bd728eecd5c836fa98167198ef36965a5436a991e6c086

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
72KB

MD5
060f0fb4c9c5c2d764fca3392cdbde1d

SHA1
c91f05333bfda4df0ef72a5052f31ea0fef49eeb

SHA256
d1c5da5c9170b764705e9d725fcaf0e7c997a06d78380fbc6ab66369eb344dd4

SHA512
23394c05f5ab1fc68d682948691028d6aceb4520f1a0d14ab2524504260e20391e544b1608153e9b36bd728eecd5c836fa98167198ef36965a5436a991e6c086

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
5208fe148f3bd8761fa46d8eb3778755

SHA1
a1fe13ff353cae766f1892701dacfdb339c4f126

SHA256
93cade2927e378d1cc52b21001222cde5ab4ac46d60b1c2e4971da0539883ef9

SHA512
cc8591f551c4bd68c9419f8b523057b671db92706c54192b325d9b41960417cd36d1ed58f605eee1690c51a55c5c011decfa25b8a2c7ed5e55549faf39763beb

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
72KB

MD5
5208fe148f3bd8761fa46d8eb3778755

SHA1
a1fe13ff353cae766f1892701dacfdb339c4f126

SHA256
93cade2927e378d1cc52b21001222cde5ab4ac46d60b1c2e4971da0539883ef9

SHA512
cc8591f551c4bd68c9419f8b523057b671db92706c54192b325d9b41960417cd36d1ed58f605eee1690c51a55c5c011decfa25b8a2c7ed5e55549faf39763beb

Download Submit
C:\Program Files\Common Files\DESIGNER\backup.exe

Filesize
72KB

MD5
d4e98bfced872de91d8ddf508dcabd7a

SHA1
fe929812d60f8c6b10a6b97445dc077b8e00bf01

SHA256
9ce721b39e4cf9111003efe7bd6303add59ab10687f6f7d4d4023586b91eddb3

SHA512
7c5812b0691114a081425551066a42ef080c4c6f1867b1b6ec7b6312e3b541463f8efac8e34c8ff726352c6df86e24feb0eeabb69ab755a692644c7c048a6797

Download Submit
C:\Program Files\Common Files\DESIGNER\backup.exe

Filesize
72KB

MD5
d4e98bfced872de91d8ddf508dcabd7a

SHA1
fe929812d60f8c6b10a6b97445dc077b8e00bf01

SHA256
9ce721b39e4cf9111003efe7bd6303add59ab10687f6f7d4d4023586b91eddb3

SHA512
7c5812b0691114a081425551066a42ef080c4c6f1867b1b6ec7b6312e3b541463f8efac8e34c8ff726352c6df86e24feb0eeabb69ab755a692644c7c048a6797

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
2613c5554282a3dc4b7586495d9ffd7f

SHA1
f49ab494639976e825ec32c495c228678165ffd2

SHA256
3b691b8e88f70133ed9bd459a229c3360cbfe888f140a25056d6a7166f22363d

SHA512
93eb3d938a9bca0c2d961d1041ac354afac42d7c1a0101927c4e7cce7bf74232e8ee0d3164b0deff5d652c36eaea134ccdca46b708c0b406f46ceca55d1cc0c7

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
72KB

MD5
2613c5554282a3dc4b7586495d9ffd7f

SHA1
f49ab494639976e825ec32c495c228678165ffd2

SHA256
3b691b8e88f70133ed9bd459a229c3360cbfe888f140a25056d6a7166f22363d

SHA512
93eb3d938a9bca0c2d961d1041ac354afac42d7c1a0101927c4e7cce7bf74232e8ee0d3164b0deff5d652c36eaea134ccdca46b708c0b406f46ceca55d1cc0c7

Download Submit
C:\Program Files\Common Files\microsoft shared\System Restore.exe

Filesize
72KB

MD5
da41d622e6c942ca99c7ffa6b8358b06

SHA1
802fcfc59581f3939e057fa3b40c7a33a931e3e9

SHA256
8daa338a0d7861bd3d1d8300107919b90ff3cfe5b52c337c493461643e141b74

SHA512
39ae1ff4fbae89f3a5be9445357f4f76a7c15f280933bff398bf3fea39702f633f5d42f05b55df62d27a93d7327b7987c340c2daee4b2cf7e9bb483a2b6acb2f

Download Submit
C:\Program Files\Common Files\microsoft shared\System Restore.exe

Filesize
72KB

MD5
da41d622e6c942ca99c7ffa6b8358b06

SHA1
802fcfc59581f3939e057fa3b40c7a33a931e3e9

SHA256
8daa338a0d7861bd3d1d8300107919b90ff3cfe5b52c337c493461643e141b74

SHA512
39ae1ff4fbae89f3a5be9445357f4f76a7c15f280933bff398bf3fea39702f633f5d42f05b55df62d27a93d7327b7987c340c2daee4b2cf7e9bb483a2b6acb2f

Download Submit
C:\Program Files\Google\backup.exe

Filesize
72KB

MD5
ac46c43147a901229bb3a6395f61d64d

SHA1
a2575891b656466bda5ad75f1137d99c51d56ce2

SHA256
be24b4f54e8c1ec4137690769d372542d4490a5151d66c4ef65b58648c076e84

SHA512
0a6824f6251d951624a73906a167ea2a6e1b869bad5406efa3df4f3c02df9e609c6da34e68845befaa6559f98962705636c82b419b6cd84517a6112dd0d19dd8

Download Submit
C:\Program Files\Google\backup.exe

Filesize
72KB

MD5
ac46c43147a901229bb3a6395f61d64d

SHA1
a2575891b656466bda5ad75f1137d99c51d56ce2

SHA256
be24b4f54e8c1ec4137690769d372542d4490a5151d66c4ef65b58648c076e84

SHA512
0a6824f6251d951624a73906a167ea2a6e1b869bad5406efa3df4f3c02df9e609c6da34e68845befaa6559f98962705636c82b419b6cd84517a6112dd0d19dd8

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
690ce2f2e11bc765fdeb3c58a031316b

SHA1
7e2b9da682d8fe517e6817559426c9d9d5cd285d

SHA256
d8c66b0f75c3f171cd37cd325f38bd348db5652fdd34ad2439976f86ae94243a

SHA512
f8882b61cd2619249bb39a2538223c167910ef384f8fed3e8930d311209a0efd5e15248bca5c5d529946685fe43b41ad78388cb070e4cfd429b74a9a94b594fb

Download Submit
C:\Program Files\backup.exe

Filesize
72KB

MD5
690ce2f2e11bc765fdeb3c58a031316b

SHA1
7e2b9da682d8fe517e6817559426c9d9d5cd285d

SHA256
d8c66b0f75c3f171cd37cd325f38bd348db5652fdd34ad2439976f86ae94243a

SHA512
f8882b61cd2619249bb39a2538223c167910ef384f8fed3e8930d311209a0efd5e15248bca5c5d529946685fe43b41ad78388cb070e4cfd429b74a9a94b594fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\3017157104\backup.exe

Filesize
72KB

MD5
e0d7fbb68e0d0f7ad2c0e4691f7f5d87

SHA1
1218a9bb887610cd7cb1ce2a2a7fb8b8ec31487c

SHA256
821a84ba9a27e2186da6295c9248e2c9e5c83d15d8f6b4351ab33ac71d99ca30

SHA512
858f5fb0015432c19c9a44207b1cea282d2f8cb267b96929c7f38fcad83dd8f8607b12efd4d1a4823fd5a7687de6dcfe20648f9e9590f03892ab336850b12297

Download Submit
C:\Users\Admin\AppData\Local\Temp\3017157104\backup.exe

Filesize
72KB

MD5
e0d7fbb68e0d0f7ad2c0e4691f7f5d87

SHA1
1218a9bb887610cd7cb1ce2a2a7fb8b8ec31487c

SHA256
821a84ba9a27e2186da6295c9248e2c9e5c83d15d8f6b4351ab33ac71d99ca30

SHA512
858f5fb0015432c19c9a44207b1cea282d2f8cb267b96929c7f38fcad83dd8f8607b12efd4d1a4823fd5a7687de6dcfe20648f9e9590f03892ab336850b12297

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
e0d7fbb68e0d0f7ad2c0e4691f7f5d87

SHA1
1218a9bb887610cd7cb1ce2a2a7fb8b8ec31487c

SHA256
821a84ba9a27e2186da6295c9248e2c9e5c83d15d8f6b4351ab33ac71d99ca30

SHA512
858f5fb0015432c19c9a44207b1cea282d2f8cb267b96929c7f38fcad83dd8f8607b12efd4d1a4823fd5a7687de6dcfe20648f9e9590f03892ab336850b12297

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
72KB

MD5
e0d7fbb68e0d0f7ad2c0e4691f7f5d87

SHA1
1218a9bb887610cd7cb1ce2a2a7fb8b8ec31487c

SHA256
821a84ba9a27e2186da6295c9248e2c9e5c83d15d8f6b4351ab33ac71d99ca30

SHA512
858f5fb0015432c19c9a44207b1cea282d2f8cb267b96929c7f38fcad83dd8f8607b12efd4d1a4823fd5a7687de6dcfe20648f9e9590f03892ab336850b12297

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
ce8f1ba63c32b58b0c02c51e0c88625f

SHA1
4a4997c967834ef56d0c7b03a3e42471011edbab

SHA256
2dcf84ed3c6ef197db4017aeb17418a990dbb2576bd6b024c192897f4237daee

SHA512
8dd182f424431b2c74c2377e7f18c4370d2baa2d93ed2d9420bd68d7c349f40bc119d810e9b0f3c46b564d93d7a4aee1cf37547699b98ba3ea7a03897b3f70fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
ce8f1ba63c32b58b0c02c51e0c88625f

SHA1
4a4997c967834ef56d0c7b03a3e42471011edbab

SHA256
2dcf84ed3c6ef197db4017aeb17418a990dbb2576bd6b024c192897f4237daee

SHA512
8dd182f424431b2c74c2377e7f18c4370d2baa2d93ed2d9420bd68d7c349f40bc119d810e9b0f3c46b564d93d7a4aee1cf37547699b98ba3ea7a03897b3f70fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
6f2606eb645f56ab5bbb264688522614

SHA1
070b2340c56ef947e6c76bf5c4240a3147a9641c

SHA256
e86cb9b56fc5355457fb4c33182796eae0ec91e57bb5090d4d6dd8305de5f5d5

SHA512
12a8ba82741f9fc1f034e3d086703e2b204cec08a0f190631076a75924553e80c78c31ff09990c002a28e09caa82d97f31733afce08813bc705d908a2d77b657

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
72KB

MD5
6f2606eb645f56ab5bbb264688522614

SHA1
070b2340c56ef947e6c76bf5c4240a3147a9641c

SHA256
e86cb9b56fc5355457fb4c33182796eae0ec91e57bb5090d4d6dd8305de5f5d5

SHA512
12a8ba82741f9fc1f034e3d086703e2b204cec08a0f190631076a75924553e80c78c31ff09990c002a28e09caa82d97f31733afce08813bc705d908a2d77b657

Download Submit
C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

Filesize
72KB

MD5
e0d7fbb68e0d0f7ad2c0e4691f7f5d87

SHA1
1218a9bb887610cd7cb1ce2a2a7fb8b8ec31487c

SHA256
821a84ba9a27e2186da6295c9248e2c9e5c83d15d8f6b4351ab33ac71d99ca30

SHA512
858f5fb0015432c19c9a44207b1cea282d2f8cb267b96929c7f38fcad83dd8f8607b12efd4d1a4823fd5a7687de6dcfe20648f9e9590f03892ab336850b12297

Download Submit
C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

Filesize
72KB

MD5
e0d7fbb68e0d0f7ad2c0e4691f7f5d87

SHA1
1218a9bb887610cd7cb1ce2a2a7fb8b8ec31487c

SHA256
821a84ba9a27e2186da6295c9248e2c9e5c83d15d8f6b4351ab33ac71d99ca30

SHA512
858f5fb0015432c19c9a44207b1cea282d2f8cb267b96929c7f38fcad83dd8f8607b12efd4d1a4823fd5a7687de6dcfe20648f9e9590f03892ab336850b12297

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
e0d7fbb68e0d0f7ad2c0e4691f7f5d87

SHA1
1218a9bb887610cd7cb1ce2a2a7fb8b8ec31487c

SHA256
821a84ba9a27e2186da6295c9248e2c9e5c83d15d8f6b4351ab33ac71d99ca30

SHA512
858f5fb0015432c19c9a44207b1cea282d2f8cb267b96929c7f38fcad83dd8f8607b12efd4d1a4823fd5a7687de6dcfe20648f9e9590f03892ab336850b12297

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
72KB

MD5
e0d7fbb68e0d0f7ad2c0e4691f7f5d87

SHA1
1218a9bb887610cd7cb1ce2a2a7fb8b8ec31487c

SHA256
821a84ba9a27e2186da6295c9248e2c9e5c83d15d8f6b4351ab33ac71d99ca30

SHA512
858f5fb0015432c19c9a44207b1cea282d2f8cb267b96929c7f38fcad83dd8f8607b12efd4d1a4823fd5a7687de6dcfe20648f9e9590f03892ab336850b12297

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
6f2606eb645f56ab5bbb264688522614

SHA1
070b2340c56ef947e6c76bf5c4240a3147a9641c

SHA256
e86cb9b56fc5355457fb4c33182796eae0ec91e57bb5090d4d6dd8305de5f5d5

SHA512
12a8ba82741f9fc1f034e3d086703e2b204cec08a0f190631076a75924553e80c78c31ff09990c002a28e09caa82d97f31733afce08813bc705d908a2d77b657

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

Filesize
72KB

MD5
6f2606eb645f56ab5bbb264688522614

SHA1
070b2340c56ef947e6c76bf5c4240a3147a9641c

SHA256
e86cb9b56fc5355457fb4c33182796eae0ec91e57bb5090d4d6dd8305de5f5d5

SHA512
12a8ba82741f9fc1f034e3d086703e2b204cec08a0f190631076a75924553e80c78c31ff09990c002a28e09caa82d97f31733afce08813bc705d908a2d77b657

Download Submit
C:\Users\backup.exe

Filesize
72KB

MD5
b9b751a13614483865dcfd8a9dead981

SHA1
77a1c6b746dbd635b50a7a08b11dd93ef69f26df

SHA256
e98875ba935b44697276e8a4617e9d0393425c5966e8c771a57dcf52ac683377

SHA512
ddcfcd4d3fe650021e792b9939c8b39972be2652cf371358f420473acc75ab49bee860ee75b05766d7f46632c7a92acac8c6dbc1d77f58b2bf6fca5feb53268a

Download Submit
C:\Users\backup.exe

Filesize
72KB

MD5
b9b751a13614483865dcfd8a9dead981

SHA1
77a1c6b746dbd635b50a7a08b11dd93ef69f26df

SHA256
e98875ba935b44697276e8a4617e9d0393425c5966e8c771a57dcf52ac683377

SHA512
ddcfcd4d3fe650021e792b9939c8b39972be2652cf371358f420473acc75ab49bee860ee75b05766d7f46632c7a92acac8c6dbc1d77f58b2bf6fca5feb53268a

Download Submit
C:\backup.exe

Filesize
72KB

MD5
823d12d26c2c7cd999998be986b4300a

SHA1
325673f08db2c7b353d99a6ba92719aa56add867

SHA256
87a581e4b5f9278c971f64a7bc73d6df6324d85b78339392443b3c100e084720

SHA512
5864449c2d9438a8d0d70b83d9b9d4092a0e75048dee5ba29317b4118d7e2601b704360b7efe13fd2c4231ecc0fde3c151cd4386a7be1aaa39b653448598d3d4

Download Submit
C:\backup.exe

Filesize
72KB

MD5
823d12d26c2c7cd999998be986b4300a

SHA1
325673f08db2c7b353d99a6ba92719aa56add867

SHA256
87a581e4b5f9278c971f64a7bc73d6df6324d85b78339392443b3c100e084720

SHA512
5864449c2d9438a8d0d70b83d9b9d4092a0e75048dee5ba29317b4118d7e2601b704360b7efe13fd2c4231ecc0fde3c151cd4386a7be1aaa39b653448598d3d4

Download Submit
C:\odt\backup.exe

Filesize
72KB

MD5
690ce2f2e11bc765fdeb3c58a031316b

SHA1
7e2b9da682d8fe517e6817559426c9d9d5cd285d

SHA256
d8c66b0f75c3f171cd37cd325f38bd348db5652fdd34ad2439976f86ae94243a

SHA512
f8882b61cd2619249bb39a2538223c167910ef384f8fed3e8930d311209a0efd5e15248bca5c5d529946685fe43b41ad78388cb070e4cfd429b74a9a94b594fb

Download Submit
C:\odt\backup.exe

Filesize
72KB

MD5
690ce2f2e11bc765fdeb3c58a031316b

SHA1
7e2b9da682d8fe517e6817559426c9d9d5cd285d

SHA256
d8c66b0f75c3f171cd37cd325f38bd348db5652fdd34ad2439976f86ae94243a

SHA512
f8882b61cd2619249bb39a2538223c167910ef384f8fed3e8930d311209a0efd5e15248bca5c5d529946685fe43b41ad78388cb070e4cfd429b74a9a94b594fb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads