Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2023, 01:00
Static task
static1
Behavioral task
behavioral1
Sample
76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe
Resource
win10v2004-20231215-en
General
-
Target
76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe
-
Size
771KB
-
MD5
2925d05146f77cdf493588ae262b72e5
-
SHA1
8d7051e5c3b7a4553a397aa1f93a255cb291bb01
-
SHA256
76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d
-
SHA512
888def39ac026eaa8cc010d51ccbe31f3b2edfae95a5e1e70508e8d59ea53dfa919d01b4f202a2aeb56bbd9ee6fc912a9904385809d58c409de31e63baca887a
-
SSDEEP
12288:U761vvrXBDZZmDmSh7SHSjX4z4ZV4kzI6OcGfAkx4tOF6j+Z:U7qvrXo7ZNX4z4YbcGfAkx4tNE
Malware Config
Signatures
-
Downloads MZ/PE file
-
Sets file execution options in registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe DropboxUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe\DisableExceptionChainValidation = "0" DropboxUpdate.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation DropboxUpdate.exe -
Executes dropped EXE 7 IoCs
pid Process 4684 DropboxUpdate.exe 2148 DropboxUpdate.exe 2604 DropboxUpdate.exe 4464 DropboxUpdate.exe 3264 DropboxUpdate.exe 1356 DropboxUpdate.exe 3932 DropboxClient_189.4.8395.x64.exe -
Loads dropped DLL 13 IoCs
pid Process 4684 DropboxUpdate.exe 2148 DropboxUpdate.exe 2604 DropboxUpdate.exe 2604 DropboxUpdate.exe 2604 DropboxUpdate.exe 2604 DropboxUpdate.exe 4684 DropboxUpdate.exe 4464 DropboxUpdate.exe 3264 DropboxUpdate.exe 1356 DropboxUpdate.exe 1356 DropboxUpdate.exe 3264 DropboxUpdate.exe 3932 DropboxClient_189.4.8395.x64.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 39 4968 msiexec.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe -
Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04 DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04 DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_1D978D5EA8275AA72D1BFCD66AF4A751 DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_1D978D5EA8275AA72D1BFCD66AF4A751 DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft DropboxUpdate.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\goopdateres_zh-CN.dll 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File opened for modification C:\Program Files (x86)\Dropbox\Temp\GUT9C60.tmp 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\psmachine.dll 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\goopdateres_de.dll 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\goopdateres_es.dll 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\goopdateres_pt-BR.dll 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\goopdateres_th.dll 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_pl.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_ru.dll DropboxUpdate.exe File opened for modification C:\Program Files (x86)\Dropbox\Update\Download\{CC46080E-4C33-4981-859A-BBA2F780F31E}\189.4.8395\DropboxClient_189.4.8395.x64.exe DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Client_189.4.8395\DropboxExt.69.0.dll DropboxClient_189.4.8395.x64.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\@PaxHeader 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxUpdate.exe DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdate.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\goopdateres_ms.dll 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_en.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_fr.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_nl.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_pt-BR.dll DropboxUpdate.exe File opened for modification C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\@PaxHeader 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\goopdateres_ru.dll 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_es.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_sv.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Client_189.4.8395\Dropbox.VisualElementsManifest.xml DropboxClient_189.4.8395.x64.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\goopdateres_ko.dll 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_ms.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\npDropboxUpdate3.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxUpdateOnDemand.exe DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxCrashHandler.exe DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_th.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_zh-CN.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\Download\{CC46080E-4C33-4981-859A-BBA2F780F31E}\189.4.8395\DropboxClient_189.4.8395.x64.exe DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\DropboxUpdate.exe 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\goopdateres_zh-TW.dll 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_da.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxUpdateHelper.msi DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\189.4.8395.manifest DropboxClient_189.4.8395.x64.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\DropboxCrashHandler.exe 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\npDropboxUpdate3.dll 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\DropboxCleanup.exe 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File opened for modification C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxUpdate.exe DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_de.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_zh-TW.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\psmachine.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Client_189.4.8395\DropboxExt64.69.0.dll DropboxClient_189.4.8395.x64.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\goopdateres_da.dll 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\goopdateres_en.dll 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\goopdateres_nl.dll 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\goopdateres_uk.dll 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_ko.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxCleanup.exe DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Client_189.4.8395\Dropbox.exe DropboxClient_189.4.8395.x64.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_id.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_ja.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_uk.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.817.1\psuser.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\goopdateres_id.dll 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\goopdateres_it.dll 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\DropboxOfficeAddIn.14.dll DropboxClient_189.4.8395.x64.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\goopdate.dll 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\DropboxUpdateBroker.exe 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\psuser.dll 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\goopdateres_no.dll 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{099218A5-A723-43DC-8DB5-6173656A1E94} msiexec.exe File opened for modification C:\Windows\Installer\MSI3302.tmp msiexec.exe File created C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job DropboxUpdate.exe File created C:\Windows\Installer\e582ce7.msi msiexec.exe File opened for modification C:\Windows\Installer\e582ce7.msi msiexec.exe File created C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job DropboxUpdate.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\e582ceb.msi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\Policy = "3" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5} DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\CLSID = "{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}" DropboxUpdate.exe -
Modifies data under HKEY_USERS 6 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E DropboxUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" DropboxUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" DropboxUpdate.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}\LocalServer32\ = "\"C:\\Program Files (x86)\\Dropbox\\Update\\1.3.817.1\\DropboxUpdateOnDemand.exe\"" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C52C4100-E8C6-438B-AEAC-43C99F7CCC26}\NumMethods DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28F751F5-74E3-4C46-8174-D8D8A6BAF83F}\Elevation\IconReference = "@C:\\Program Files (x86)\\Dropbox\\Update\\1.3.817.1\\goopdate.dll,-1004" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassSvc\CLSID DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E58F67C2-BC84-4C7C-AC35-4FFBB25A47E6}\VersionIndependentProgID\ = "DropboxUpdate.Update3WebSvc" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C416C376-AEC5-4443-9D90-BEBA9434763B}\ProxyStubClsid32 DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachineFallback\ = "Dropbox Update Legacy On Demand" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3363994D-A786-4A32-A745-48B9B6EA709A}\VersionIndependentProgID\ = "DropboxUpdate.ProcessLauncher" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C416C376-AEC5-4443-9D90-BEBA9434763B}\ = "IGoogleUpdate3" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04F3B937-6C9D-4DAC-9477-8C35E24B25D1} DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B8158CAB-1B7C-4A15-860E-AAA364E77334} DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A378DB55-CBFE-483C-8697-710EAD506BBF}\InProcServer32 DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58237066-0A7A-4C18-B132-D7BE280A6327}\NumMethods DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreMachineClass DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachineFallback\CLSID DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachineFallback\CLSID\ = "{28F751F5-74E3-4C46-8174-D8D8A6BAF83F}" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62} DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E58F67C2-BC84-4C7C-AC35-4FFBB25A47E6}\ = "DropboxUpdate Update3Web" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8EEF2D6E-1CE5-4823-88D0-7F727719D0A2}\ProxyStubClsid32 DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DC422F86-7267-4AF2-8F4F-A20C060621DE}\ProxyStubClsid32 DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CECD4BFB-9F43-4540-B72C-706BE66B375E} DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E396485-96EB-4906-B2C5-3E0F1E7748C3}\VersionIndependentProgID DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}\ProgID\ = "DropboxUpdate.Update3WebMachineFallback.1.0" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}\VersionIndependentProgID DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreClass\ = "Dropbox Update Core Class" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5A812990327ACD34D85B163756A6E149 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E58F67C2-BC84-4C7C-AC35-4FFBB25A47E6}\ProgID DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A337332-37E4-4063-B4F3-6416846C8A33} DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78F1393A-63FD-494A-BA89-2C3ECA4E8EC8}\InprocServer32\ThreadingModel = "Both" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F84F5221-63AA-431E-A57C-D7D03649E3E6}\ = "IRegistrationUpdateHook" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{831F99E1-2250-4065-8975-7408E726825F} DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E396485-96EB-4906-B2C5-3E0F1E7748C3}\LocalServer32\ = "\"C:\\Program Files (x86)\\Dropbox\\Update\\1.3.817.1\\DropboxUpdateOnDemand.exe\"" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3COMClassService.1.0 DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassSvc\ = "Dropbox Update Legacy On Demand" DropboxUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28F751F5-74E3-4C46-8174-D8D8A6BAF83F}\Elevation\Enabled = "1" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58237066-0A7A-4C18-B132-D7BE280A6327}\ = "ICoCreateAsyncStatus" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC2E189E-C306-4710-BBCC-A8968ACAEB2E} DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F448B4EA-A094-491A-BF61-9AF6CD450C7D}\ = "IProgressWndEvents" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04F3B937-6C9D-4DAC-9477-8C35E24B25D1}\LocalServer32 DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}\Elevation\IconReference = "@C:\\Program Files (x86)\\Dropbox\\Update\\1.3.817.1\\goopdate.dll,-1004" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebSvc.1.0\CLSID\ = "{E58F67C2-BC84-4C7C-AC35-4FFBB25A47E6}" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B8158CAB-1B7C-4A15-860E-AAA364E77334}\NumMethods\ = "10" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58237066-0A7A-4C18-B132-D7BE280A6327}\ProxyStubClsid32 DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60ACA18E-54E6-43F8-A1A4-C4176B6C994E}\ = "IOneClickProcessLauncher" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D412914-1C4F-447D-80D2-E7F9BB302B05} DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachine\CurVer\ = "DropboxUpdate.Update3WebMachine.1.0" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\LocalServer32 DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.ProcessLauncher.1.0\CLSID DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28F751F5-74E3-4C46-8174-D8D8A6BAF83F} DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebSvc\CurVer\ = "DropboxUpdate.Update3WebSvc.1.0" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A337332-37E4-4063-B4F3-6416846C8A33}\VersionIndependentProgID\ = "DropboxUpdate.CoreClass" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreMachineClass\CLSID DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3COMClassService\CurVer DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E396485-96EB-4906-B2C5-3E0F1E7748C3}\Elevation\Enabled = "1" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A496C5D9-84FE-4E84-9D20-7481589E1C23}\LocalServer32 DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{831F99E1-2250-4065-8975-7408E726825F}\ProxyStubClsid32 DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04F3B937-6C9D-4DAC-9477-8C35E24B25D1}\ = "Dropbox Update Broker Class Factory" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebSvc.1.0 DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E54806CB-0046-4BCF-B389-3A6F732DC6E6}\ProgID\ = "DropboxUpdate.OnDemandCOMClassMachine.1.0" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CredentialDialogMachine DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05378308-2559-4C71-B758-7DACD5A359BA}\ProxyStubClsid32 DropboxUpdate.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4684 DropboxUpdate.exe 4684 DropboxUpdate.exe 4968 msiexec.exe 4968 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4684 DropboxUpdate.exe Token: SeShutdownPrivilege 4684 DropboxUpdate.exe Token: SeIncreaseQuotaPrivilege 4684 DropboxUpdate.exe Token: SeSecurityPrivilege 4968 msiexec.exe Token: SeCreateTokenPrivilege 4684 DropboxUpdate.exe Token: SeAssignPrimaryTokenPrivilege 4684 DropboxUpdate.exe Token: SeLockMemoryPrivilege 4684 DropboxUpdate.exe Token: SeIncreaseQuotaPrivilege 4684 DropboxUpdate.exe Token: SeMachineAccountPrivilege 4684 DropboxUpdate.exe Token: SeTcbPrivilege 4684 DropboxUpdate.exe Token: SeSecurityPrivilege 4684 DropboxUpdate.exe Token: SeTakeOwnershipPrivilege 4684 DropboxUpdate.exe Token: SeLoadDriverPrivilege 4684 DropboxUpdate.exe Token: SeSystemProfilePrivilege 4684 DropboxUpdate.exe Token: SeSystemtimePrivilege 4684 DropboxUpdate.exe Token: SeProfSingleProcessPrivilege 4684 DropboxUpdate.exe Token: SeIncBasePriorityPrivilege 4684 DropboxUpdate.exe Token: SeCreatePagefilePrivilege 4684 DropboxUpdate.exe Token: SeCreatePermanentPrivilege 4684 DropboxUpdate.exe Token: SeBackupPrivilege 4684 DropboxUpdate.exe Token: SeRestorePrivilege 4684 DropboxUpdate.exe Token: SeShutdownPrivilege 4684 DropboxUpdate.exe Token: SeDebugPrivilege 4684 DropboxUpdate.exe Token: SeAuditPrivilege 4684 DropboxUpdate.exe Token: SeSystemEnvironmentPrivilege 4684 DropboxUpdate.exe Token: SeChangeNotifyPrivilege 4684 DropboxUpdate.exe Token: SeRemoteShutdownPrivilege 4684 DropboxUpdate.exe Token: SeUndockPrivilege 4684 DropboxUpdate.exe Token: SeSyncAgentPrivilege 4684 DropboxUpdate.exe Token: SeEnableDelegationPrivilege 4684 DropboxUpdate.exe Token: SeManageVolumePrivilege 4684 DropboxUpdate.exe Token: SeImpersonatePrivilege 4684 DropboxUpdate.exe Token: SeCreateGlobalPrivilege 4684 DropboxUpdate.exe Token: SeRestorePrivilege 4968 msiexec.exe Token: SeTakeOwnershipPrivilege 4968 msiexec.exe Token: SeRestorePrivilege 4968 msiexec.exe Token: SeTakeOwnershipPrivilege 4968 msiexec.exe Token: SeRestorePrivilege 4968 msiexec.exe Token: SeTakeOwnershipPrivilege 4968 msiexec.exe Token: SeRestorePrivilege 4968 msiexec.exe Token: SeTakeOwnershipPrivilege 4968 msiexec.exe Token: SeRestorePrivilege 4968 msiexec.exe Token: SeTakeOwnershipPrivilege 4968 msiexec.exe Token: SeRestorePrivilege 4968 msiexec.exe Token: SeTakeOwnershipPrivilege 4968 msiexec.exe Token: SeRestorePrivilege 4968 msiexec.exe Token: SeTakeOwnershipPrivilege 4968 msiexec.exe Token: SeRestorePrivilege 4968 msiexec.exe Token: SeTakeOwnershipPrivilege 4968 msiexec.exe Token: SeRestorePrivilege 4968 msiexec.exe Token: SeTakeOwnershipPrivilege 4968 msiexec.exe Token: SeRestorePrivilege 4968 msiexec.exe Token: SeTakeOwnershipPrivilege 4968 msiexec.exe Token: SeRestorePrivilege 4968 msiexec.exe Token: SeTakeOwnershipPrivilege 4968 msiexec.exe Token: SeRestorePrivilege 4968 msiexec.exe Token: SeTakeOwnershipPrivilege 4968 msiexec.exe Token: SeRestorePrivilege 4968 msiexec.exe Token: SeTakeOwnershipPrivilege 4968 msiexec.exe Token: SeRestorePrivilege 4968 msiexec.exe Token: SeTakeOwnershipPrivilege 4968 msiexec.exe Token: SeRestorePrivilege 4968 msiexec.exe Token: SeTakeOwnershipPrivilege 4968 msiexec.exe Token: SeRestorePrivilege 4968 msiexec.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4396 wrote to memory of 4684 4396 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe 91 PID 4396 wrote to memory of 4684 4396 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe 91 PID 4396 wrote to memory of 4684 4396 76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe 91 PID 4684 wrote to memory of 2148 4684 DropboxUpdate.exe 92 PID 4684 wrote to memory of 2148 4684 DropboxUpdate.exe 92 PID 4684 wrote to memory of 2148 4684 DropboxUpdate.exe 92 PID 4684 wrote to memory of 2604 4684 DropboxUpdate.exe 99 PID 4684 wrote to memory of 2604 4684 DropboxUpdate.exe 99 PID 4684 wrote to memory of 2604 4684 DropboxUpdate.exe 99 PID 4684 wrote to memory of 4464 4684 DropboxUpdate.exe 100 PID 4684 wrote to memory of 4464 4684 DropboxUpdate.exe 100 PID 4684 wrote to memory of 4464 4684 DropboxUpdate.exe 100 PID 4684 wrote to memory of 3264 4684 DropboxUpdate.exe 101 PID 4684 wrote to memory of 3264 4684 DropboxUpdate.exe 101 PID 4684 wrote to memory of 3264 4684 DropboxUpdate.exe 101 PID 1356 wrote to memory of 3932 1356 DropboxUpdate.exe 114 PID 1356 wrote to memory of 3932 1356 DropboxUpdate.exe 114 PID 1356 wrote to memory of 3932 1356 DropboxUpdate.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe"C:\Users\Admin\AppData\Local\Temp\76b58cf40c965d1c67a720593b572c369777c97d27b8f478c1bb092656a81f6d.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Temp\GUM9C4F.tmp\DropboxUpdate.exe" /installsource taggedmi /install "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&experiments=buildid%3Dmain%7CThu%2C%2031%20Dec%202099%2023%3A59%3A59%20GMT&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKd055MHNLd2pBUUFOQ3JsS3hGNXBkTXhyV0NDSzZLSUc1S2l3V3IyRkxTUkVTOHU3NzktN2cyTDdkbW1SNzk2RGFWTy1Yek8zZXpkS1hzNDJYN0tqemZkOVFlNjZkSkhlQ3dSZ1ZXSUFyZ1ZwVkxmVXJETkRiRDlaX1JnaGNVSVdWR01fT3M1ZzBpRW1tMEtJcG9EUGo5QVNRUElDNH5ATUVUQSJ9"2⤵
- Sets file execution options in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regsvc3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2148
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regserver3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
PID:2604
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcGphSEp2YldVNk9tVktkMDU1TUhOTGQycEJVVUZPUTNKc1MzaEdOWEJrVFhoeVYwTkRTelpMU1VjMVMybDNWM0l5Umt4VFVrVlRPSFUzTnprdE4yY3lURGRrYlcxU056azJSR0ZXVHkxWWVrOHpaWHBrUzFoek5ESllOMHRxZW1aa09WRmxOalprU2tobFEzZFNaMVpYU1VGeVoxWndWa3htVlhKRVRrUmlSRGxhWDFKbmFHTlZTVmRXUjAxZlQzTTFaekJwUlcxdE1FdEpjRzlFVUdvNVFWTlJVRWxETkg1QVRVVlVRU0o5IiBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuODE3LjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTg2NTA0QUUtMEZENS00RkI0LUEzMDgtNjNGMTNENzIxMDZCfSIgdXNlcmlkPSJ7MTUzMURCRjctQTYzNy00QzIwLTk1MzktODk3RTA1NzcyMEFCfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezZEOTRFRTAwLTQ3QUItNDU3OC05MTExLUM2ODExNTk1OTk2Nn0iPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntEODk2OEZGMi1FMEIxLTRBMTMtQTNFMi1DOUYyOTk1RjNCQzZ9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuODE3LjEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48L3JlcXVlc3Q-3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4464
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /handoff "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&experiments=buildid%3Dmain%7CThu%2C%2031%20Dec%202099%2023%3A59%3A59%20GMT&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKd055MHNLd2pBUUFOQ3JsS3hGNXBkTXhyV0NDSzZLSUc1S2l3V3IyRkxTUkVTOHU3NzktN2cyTDdkbW1SNzk2RGFWTy1Yek8zZXpkS1hzNDJYN0tqemZkOVFlNjZkSkhlQ3dSZ1ZXSUFyZ1ZwVkxmVXJETkRiRDlaX1JnaGNVSVdWR01fT3M1ZzBpRW1tMEtJcG9EUGo5QVNRUElDNH5ATUVUQSJ9&nolaunch=0" /installsource taggedmi /sessionid "{A86504AE-0FD5-4FB4-A308-63F13D72106B}"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3264
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4968
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Program Files (x86)\Dropbox\Update\Install\{698D7976-70E1-4837-9188-5444ACE1C96B}\DropboxClient_189.4.8395.x64.exe"C:\Program Files (x86)\Dropbox\Update\Install\{698D7976-70E1-4837-9188-5444ACE1C96B}\DropboxClient_189.4.8395.x64.exe" /S /DBData:eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKd055MHNLd2pBUUFOQ3JsS3hGNXBkTXhyV0NDSzZLSUc1S2l3V3IyRkxTUkVTOHU3NzktN2cyTDdkbW1SNzk2RGFWTy1Yek8zZXpkS1hzNDJYN0tqemZkOVFlNjZkSkhlQ3dSZ1ZXSUFyZ1ZwVkxmVXJETkRiRDlaX1JnaGNVSVdWR01fT3M1ZzBpRW1tMEtJcG9EUGo5QVNRUElDNH5ATUVUQSIsIm9tYWhhLWluc3RhbGxlci1pZCI6InsxNTMxREJGNy1BNjM3LTRDMjAtOTUzOS04OTdFMDU3NzIwQUJ9IiwicmVxdWVzdF9zZXF1ZW5jZSI6MH0 /InstallType:MACHINE2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:3932
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5077c396635f5b007d805e19ab9875076
SHA123880a668e9e39665079ba95017e0b97ae2bd225
SHA2561eb4d667c738c35d9d7021e2253ce48f2e854e7374cd5ff12e5290fdf38ed250
SHA512b9c750d4b5afa9b56e512935771b9f85e3da01a789f0c405c2dab482be0aa507bbda52e11e0e0829bec96f2da851cd1a56dd4d9e8d00e6c47baa075d5ed4875a
-
Filesize
299KB
MD58fa7f9a62ea19f3691e8a24833a5bc25
SHA123f0825ce2f4731cc73e82ca814872b512d333dd
SHA2560d9c6de8a57443bffe718d3256fdd467b8970124ba65d8accb6f47dc54d46d72
SHA5123d8243c4a42f96d549b09797f39b0f2fbef54d643ee4048c24eb6a1b748ef07ecd6bfdc142fe4c13838b0c07957b5e558ebf98fb7bdcc841d49fcff0a06eccf4
-
Filesize
129KB
MD5e3214461da70a51d0fe6ab76dcc753c1
SHA15ce885de14919fd7ba6ce35726480b098eaf5acc
SHA2562e3925b6c2175a98024551fea9e0b8dbc54f4107322c97b1493add40ed8ab73b
SHA51267668b4ce7102480a0f37113922c9197ebe90619a2cded3a484024902f167bc005fe11f50e3d9509e2d4a4cbad1865f61b20189ddf37e916ff01bbf38e9e2aa6
-
Filesize
127KB
MD58ad76e0b347bb690697535ce95b1c656
SHA110d2622a3965d21215a953ed924d01788a9805ed
SHA2567655221b493047c61285e1de78807d0584920b0d14d150e2487da9728b1926f3
SHA51235fbda7f05865b3a50454dba5ba3738eb8a5fd6d2eea5e9415d8d517811d51c50cca6c7b47a5b19f1ff1f4101567137fe18805f4f740289456da1ff2af682504
-
Filesize
75KB
MD52677fb41f870e8a05cd60d4b7861e300
SHA1b5275ca2df2865b96fc359757564febb44f34278
SHA2564988fdaeb6a33a3169a9ea445f5bc00b7bdacb78f7ed6a98b2ad2eb73b551ff2
SHA512d4aae16b4ba3b0b6b247fa29ca5baaf322ff0f6d941596f6ff2bf5eb1184162e2a1802d97f3040bfac3ab162259c8e4115445d23dab459e65fbad5cdd06e5ed1
-
Filesize
26KB
MD5ad80274ebc288f8bcbfd7bf1e6b784a2
SHA17bfa68f1fa73986dd9c13ee719a2c0bc9bc2b9e8
SHA2560772c75f19a0e35b3b02831563a72897d68fc7eb2b304f2d7cc58eca0a00cfe5
SHA512d6a37fc7da74544d672ba98f07dbe2f521216ac1b383209d943ee0d8ff9aa9a66aa8bfe933a0df5baad7740ad913b559f89cb57de44acf5d4cfcc11f3bd177af
-
Filesize
75KB
MD57d0be196d264cf662aa2edfff9fbde8c
SHA158820a86a093b91ba563402d1e9be233c19de9de
SHA25670272968ff5e1c47883ecb74680cf3a298af7b87ccacb932a57a0198ed69a65e
SHA51278f1621513b5404c53a485258d9a027ba619ca570bfb018e1a1f1eaca23ab4e79bd714c2cc3d1ab55ba0abb84c0af7b64d14bb7ac89225a5d2c817c75d1b9927
-
Filesize
384KB
MD5ad37aef3025b3ce8c38ce078c8361758
SHA142479f21766d3d89f676fc14b35bf2801b28d9f5
SHA2560d0ee4127868ce899408dff0408060b793d23f35931d94348551ee769c6a07e2
SHA5126977003acbdddb8208218879ed55ad2b23352e84e76a4680d3eb36a75e1a9117c2993f90704a7eb8f34e73e3d7818572edc97c54fec153bd530414b2ff046bbd
-
Filesize
70KB
MD55014688568496997feaad831827d5f10
SHA1871e4e5caabee72f3a42d427257c7335f02e796c
SHA2566badfa8aa01843c55b6f8810fec22a84ac355094b5ea39c2f7bae39466eb572c
SHA512a3dd8458af6f2f61a0ece3b7c683e373841ffe65c8cc7b7a43752efa9dc983553fbadb948d74eadf022b6159aa23b375604868ce42221f271110fb0b785e31ce
-
Filesize
32KB
MD51ac5617cafffbb69ab768095c77b4306
SHA1c120a49e4886f839fb96c84f87727dd023fcec19
SHA2568fadf121a5766032bfddd0f6342dd6e2a612996370ed1f5c548f5cbb5ac548f9
SHA512fd26156f9651f5237df3461128547496ab623c5a34c691f410177c3198608de8618a199f48f3a02155ed3fcb8d9717fd3c3cc8834013a99f1dffa4f3d8913ff0
-
Filesize
35KB
MD58ec648743a036ef57ee419488b01387f
SHA1afa9fca0cfb21cc1f05b31f1b55b1f47e18f0a88
SHA2569373bfaac15573f63b42cbcd39e4ef15a06d6a27696541f1274a2aef25570e70
SHA512a7af27890c0fe3f86bff9ae03734442a2c0b4d9315a5a6221531270caa8dd6e55e66659f6c1062d589a08a41a92dc4101f76430d528694b037de73b4407e4e5a
-
Filesize
1KB
MD5c140929e6b3a3d19b8f4bc31fa710309
SHA1b5167a82b696ae039d71d09fcfba9e8cb982ea7f
SHA2564b75a4d1fc48df590792af7bc9a9070471daa37dc396d9c8d9048c600845e7ee
SHA512851c43ac59df94ea8e30c4f794a615b9d4bb66f7c0bc5fc923e7b5ea44b4ba3efcb0a1c7e1e0be3fcd30494873a2e5cabc039251e96698a2dd5d19962fe17b6c
-
Filesize
33KB
MD507cf9b2367462de21cd1c1ee5ef076ae
SHA115676dfe46d54e7a609fea052010b847709535ee
SHA2564d43704f744093b41f9d3315c508933a91c481732b84e0b14bf642aa5d03e020
SHA512a96d4b80215adc19f7af295e863017bf895038ea1346222337842139d9e5de018f8706fbb251d4012db262bc608a9ae4ae21dca08df3a5621d7e00281a491942
-
Filesize
33KB
MD50e13d60b08d0653ccad9cd22cf13ec85
SHA12ac7fef4c9be1efca0c68ce7bb4b623d2824994f
SHA2567dc6bb82fb6133e879309b0200aec7ae7c6346deb05a53daf1803443db3c8cbb
SHA51294909d3e43cb0a90c6fc595fb24c5a90df4f9574bbc4f447dd534e6114c14f6905bb07a758719fd45fd357f28575bdd3043335ac0dbfe498ff3c286654b9ce6a
-
Filesize
33KB
MD5cf26a8d0d58a87db417185922c761687
SHA1e28c3c48594d5aef78966d0e210dd826c2f69a2d
SHA25683c860a5942fd6b307c428869a1debb188fa4a8dc27d2ffe4abe0b8453254e7b
SHA512fad6342c211b0597a9962c0bceb853e07f705f42baf92ac7a288fe5ea608c038923f509d9d77041eaecfa6f5f926138b524ee6cd4154526169eabb675c5ee9b9
-
Filesize
27KB
MD5d22b960d1fa795eb7996d1be6a02aab2
SHA1e526d5ce5719e1de891169305a367677f76e6e7a
SHA256016567f8ee776cb57dfbc7e6a8908bef7004fd9abab4286800863c745c08e1c0
SHA51240064f12538c55c2589bfa40ac8559aef71177ff7379e89c68ccb509c012a4295977eaf87e3a7be50c30e36d276b798217d7ce902240480f54f35fe44497d2ce
-
Filesize
27KB
MD519b6ce8683c1d7a6ed07b93966b5e415
SHA19ec79b491b4cc71fe6a3431ceb5fc26a217fed57
SHA2564638e83c8e01e837078797f8ce2e4015a05aa7e6ee121dda107adc473f4c281b
SHA5121fb52b00a2ed152a199357bff6fe4f994c7ba434bc3f3da960cf2a9ea52f41dae9cd3a0b840c87e25ff463077f1c32fc0f354fb24288c46a251e51b47f57ce80
-
Filesize
31KB
MD56922f23814bd549972b548acc4e6afce
SHA117a6e724904a09175b1c3ecf40e6929b89662585
SHA256d7e3c82e12447a9aa4085317f65447607b75f62fa89edd38fb5621dbaad9211d
SHA512f59d9e56e2a06fbd8853bccae6e69f6b51c07bc9c18c84e559d6e81bdec90c51c555676891d9a9c6233faedfacfd15941abd1c033710e14ba028cf82557109eb
-
Filesize
34KB
MD57d26147723dcf53d0d1b10f98f891d91
SHA1501674d1e4d53d0d6b92875c65118f7f5ceccf66
SHA2565f577d78457e5010c90b3614f94eb3b03f4f66c752191e25ce2b4f397d481ad9
SHA512deefae29107edd6c240308b7e05680b1f9a8f2525fff29a6cc47742345a21f285c6285440c26a36555b97b1d73e8b16a712177f8fcef70aea6d5da0e35123f15
-
Filesize
32KB
MD56bfb6b741d1eb83a8d1a96680bc6da51
SHA19263e45de354b17b9091b688ac63aa31796647e1
SHA2568a1622e758b4cdcdcef80095f59c604ba878b1c853d66a338459b4de32ed5fdb
SHA512d65093e4c85cfa22054c9c09113a36360b23214ccf7f6cdf84df0d4d8a905ffa6a20e8385fb3fcf78fb96d91ce49f29826c07ee81fc62507218b48ef6231a5ed
-
Filesize
33KB
MD51eadd3df335b90ee62a74966c1693af5
SHA121e5152b54f08317f13b6c97ffd67d4d42e76aae
SHA25616ffbd7af2dc7d11199bd769ac3355efb39b4267f0758ef8d60ce4bdf927d394
SHA5129b9776d5e0e47acc6234913faf2421da4c896abe84f7129a928393d5ccc491ff8a92b82ef3b76b493e620bc6942e3248bc364f8669ebe2444fe477ed37956e8c
-
Filesize
32KB
MD52ea9dbc90cf842de5ac5cced84d83a8d
SHA12a63a275a4d4252d4e92a2e2d5827f1cc1789a4b
SHA256b500301065031c6826991f0b0e712e2ac09c465f686b27e0aa5121a9d2bc2529
SHA51257d50c6124273655e4cbd3c476882b7795e3d58c44121c5260bb9efcfed75fb708e622eb4e67dd4e1dfb3fa7e1b9680ae35a51248c8dc901c64c6fc708c46fa2
-
Filesize
33KB
MD5ce5254b7aa5cc2482449b12995976bc0
SHA1d8aba69d1b11eae587c1e5357e08f3c66acc1c1e
SHA2568e5ddf0615b84665e5cb5b13a0d5f72167c82dc4a86cc49616ea445f6b801eaf
SHA5125dc50fec4f9685f74d4638ed0e2f8e4c493ddc10af0416a1fc495782962d16b158bae71171338230bd17d91cc686c3e9b82febb006c634791560385328b3ed3a
-
Filesize
32KB
MD5c8a5dea2d0343249eac44e0dc550b2dd
SHA1681081760d2983f2025e21356397b5bc067c3501
SHA256401263a24666710b8895e0d5fa5857f7d86c4ec21595573894e07517e94b52ff
SHA512bfceea37a5e525738380ee9049daca1913da5603ead0057f5e8f54022961db1cdf0da370e1af8b841997f1e46514eb5f4e3c4492cba66c83d6eaba1a568fe05a
-
Filesize
31KB
MD51881415301940deb7d45b120a39679c7
SHA13bcc72d91e9a1c35f5b52768c9a77a0faf2f16e0
SHA25663e7af52e0f6e41c351d33ed4928647ab3abbca3c767de570891c3ada13d4e1e
SHA5126f35a017af72df217eb3e511f57d8c4796cfd996f30308cedf7b44c16cff3d34fbf5745df00398c1232e7f685425a2269cd1d35184c6b2007afaefed25549188
-
Filesize
32KB
MD517c6392aad88515222ffc54dad9a0f36
SHA19f0dad897f9648167b9f005b7e2ab86c6161e6d5
SHA256cbd96676b5097470250dc8285c6523ed598ccb58a4990c78abba79d4e1a67e9e
SHA512b5bd6ab5325e772347ab8de55ecaae8546b46bd9dc559c17c3b965b4627cfa25c406f4ca6bbe17f22e21678c80a3ec03260242f29b1beb817d78639e37a2f940
-
Filesize
25KB
MD50a62f2c2d232d98a8438a3d449a520f3
SHA1308fef4ccf6926977e5bc1064f554fab0d4ba36a
SHA256084a88a2171690934370cc603c0d809ffb9f0e55aeaa4055f38af2239d0606e5
SHA512db74ca3fce77ce1207041494c9b4d1e86c39e9e796e8e8a31ac53e6db187b4cdc70f3b330d77db0ec0b2282b76fe9da379e7065c042993fd9044e5c1c7dec13a
-
Filesize
25KB
MD5dbd5fa781509ed7d863ca11877f2a28e
SHA11b52ae5bb49c06ec7c25b7675093846978dc6856
SHA2562217e104660a21c2c9be0ad68846fbb4f7ee16510ece768f055d9e9cbbd60a9b
SHA5127d9b04cbc040ed6c4df8e10fbafec70500c9fcfe228a86e8ccbec4945bf04ecca6a475e20f4cbd36e5a89c6847e6107496ee23e36db0d748104bb01af8985505
-
Filesize
273KB
MD552d461eb7ce99d0e6901eef682d83bb5
SHA1c317560a11a91287dd31db5eeb2a1145f711c09d
SHA256e07b2a1d2c932fc38d3fa6401ff0be653250a1e8173311a9312ef9478da28e2a
SHA512429d18c1d8482469916627e32fd938f7d770b391e50f249b79bc7e0553f6b1633fdd0f0e54c069e23a22d8a174047c71dfbfc7740a026b414d56556accfd2bab
-
Filesize
211KB
MD570663a8818622003e50b36bb392b880e
SHA123670b780d232e70a6cfa5b2d350992d43ef722a
SHA2563582062df2b1120e6cbe47a4c5066b0f3e0959518ab572a62f2817e55bab6518
SHA5120a62442874598ed8e7986a99dd9d9d4d07e987586454731feea6427fd9b2190d5d2fc502e2efade839d010ac7e11135daf0921275a911037284ebfbf8bd3c3e0
-
Filesize
177KB
MD5d0f4653a39430cd5aad8aba8a6bd6cf5
SHA18655ee17c1ef46b6ef3ffd7ba9373160b19dfbc8
SHA25643d012b48e369ae311ff6f410599ed4c44d4d23d60d7a88656a67849e1fa07d9
SHA5129f1af81d07397d36334632fcbeca5a3d2a57bf3c4bc533e500927894537c830438dee4c52730a719983956e4cce972190b99c67ed27c4a32777e9f79aa3d782d
-
Filesize
451KB
MD563b6eb82ea28f7a257cdffa95b2a6843
SHA14e4d0b898c4392dd7cf3b9f04692beb800f77d06
SHA256b399748278a0875e9ccc24fe78ebdb7bed02b73fe2dbb87b40594b70ea1341d7
SHA512c2bf23afdfc719bf062f4b9f8702b4f0811a6598a630483dcf1bfaf8f7c08458f4f37554f3b1d70d2c484495e9dc87b30c7f49331b2fccb21d84c86f45a75daf
-
Filesize
511KB
MD5026027c759daf750ecb98a91323ba363
SHA19f77a4ab4557ab983128b6db52f52055f8b4dc5e
SHA256c5710cc7326304bd99f6b3ced6478ec69860a6760477a03ebb9cad2e21d41d34
SHA512004223834af1a37ddf251a601ca39d0da1c5ed53a12a3212fa15dcf5e42db89210f327bdec758454a89fa441f4bbaef846bb34765d756e88709dad111f127191
-
Filesize
1.1MB
MD54afe69cbfdbf9914ec0c597f5bc5a1f9
SHA188e03e83a62e5fc37c94b26e6e5547b4ca7ead9d
SHA25634b68127792f3c80c4a3e616c9c8cff8e53533518f80c4aac78f2aaa26e9615a
SHA5121cc19966856b1495334d606ea8e9269f9203a6cb5d9dbb919c3485b0ff9e1941305af062e3a0e740afd2d2d6be8a4d50882c428c8058a2b1f8dbba4cd59f8fe9
-
Filesize
199KB
MD50cb5e76bb95f5cef599381d782223a10
SHA1d0658dc585019d8d7ada930f76ddeb3438eac19b
SHA256b39a3cc9ce9e24c2e8e03c37148dca996ad147a133b67dd9a7fcfb9a08986d05
SHA512a198d2697e2432db41a3ec03df14101454b08dc23a56d5108b3f9e53f441e3b6ce6deaa250a4912cf5cb49490d6d496f913b3836fcd9df6031a324baa01ae10c
-
Filesize
31KB
MD5fc198c77a954eb0eda8424eac724584f
SHA1d1bdeb781372cd4907e519c2fd81094441385536
SHA25667d5c3f8a6e9415deef22148a4216518a7ee52b468ba6bb1c67020d56d9e3745
SHA51274572d8422a57046ccf5729eae36c396028b9162581dad80f20299fa11426bf453a7ba5a34022ec3103a7b995aa9e77f5dc44ba9de1570b03b964b38559306d6
-
Filesize
34KB
MD5ffdd38e5ae41822c584b092eefed9df0
SHA191da41c12fa3afcac80d0077c0b3fce918b5a4f2
SHA2563f3ac9e29e480d1c6eb271a538bb966953c9464659d044cdccd8c99df7f703a1
SHA512e06d12b1caf8c23496c7a75f7454443ba721691e245d183ec750e95b013423310e921587c0d95e5ecce1a816c8b538290f3018b098c788f0e14403fa3cce9a0c
-
Filesize
31KB
MD55ea2ba9a437c4b6bfbb228356ea3be59
SHA119d27cf893537002313808a4e32581f344e4eaca
SHA256e0d5ea9edec2692553371e4579a63d5dc7c554867f3f90ebec722d97d2af87b5
SHA512fb78b0c4d7066922cfa7a234e6e2023042d3e2f25cc6a6be5eb26782d836bf30f090eb15be77b4c211e9c7fd8bc28b7e92e50cb7bb2a045412c74e8982049fcb
-
Filesize
164KB
MD5c5e687b3a043806c1644ff70f92cb616
SHA1a47d3d12effed5e9c30692c19d91caaf08df11f6
SHA2562483ad11ab7578fd0c626300d02fda4771a152b9f709bf97e503a363cd952c30
SHA512059585ca1bd8540212f30618b341c4ae3b8e4471f649ef45e6a4a61abaa33b175b7114f88d6bc2d590d06473ef18f5a7f8544186218cb330d3b111a253aed0aa
-
Filesize
211KB
MD5732dfd011b5e71f1f18229e93d8ae039
SHA16ff911e082622bb6ba0f43734a17de3963a29c43
SHA25656ec8884c392f95202d07959414d256c737354ad3243971ef47e44a32f011aa5
SHA512376df248b77a07df573b1fb3fe111d0ba4f9e91e4fbedfda24732159bb4eb359e3f6e91de13f6f698896a0a64a39c68b0a8d125efd588b5ece762daf985099fb
-
C:\Program Files (x86)\Dropbox\Update\Install\{698D7976-70E1-4837-9188-5444ACE1C96B}\DropboxClient_189.4.8395.x64.exe
Filesize6.9MB
MD56db8a209e2206c3b5143e4145d748690
SHA1041497ef0d11a89d9c2cd19b838169b4a925ba67
SHA2568697759833fdd929c89753bdc339d5cc7bf7b97fce2ed7ecad28c9eb66fe1de7
SHA512fbdeeabc888077baf54204b44f3216011028519f5252437cdd457a231d918dd3e15e8baf859076a573cff60948fd36fc73778543bf1320841a48fefdad22d034
-
C:\Program Files (x86)\Dropbox\Update\Install\{698D7976-70E1-4837-9188-5444ACE1C96B}\DropboxClient_189.4.8395.x64.exe
Filesize116KB
MD5d76be6579666cef2ad3e6b8e24ed0c69
SHA155426a4af777f95eb4564536f993bd174fce33a4
SHA25687e148c3a1556c3642577c482c02aea7378ebff09458d28e15dc57a84b933d9e
SHA512feb0a2a9579512ade108ffc9e591acdccd1d1b92947b539ca75ba257767e8a7a03f93eacd785919389b30bd47db3e7aa6d2476b8a968a331ebc11c7f126712e1
-
C:\Program Files (x86)\Dropbox\Update\Install\{698D7976-70E1-4837-9188-5444ACE1C96B}\DropboxClient_189.4.8395.x64.exe
Filesize81KB
MD5812331e43b40ad910a8402cfeeda1d04
SHA1b127f2f7fb3d02b9c4967971ee0f9cc61cedcd7c
SHA2567e860ca25c3b43a8a70155f0101826fca560ac81224ae776f7034112aca517c2
SHA512af11f1cf0481841549d899914ec67b7a56b4bdfc5cbff75ffd6dd4a235618cb6fd59d6f46e9e69f9d137389c372cc6d03d5312f2d400f5c543a498ac2f3fd6d8
-
Filesize
11KB
MD5c6e19f882ac7c89c517ec158d8bee0e3
SHA14bd07cb821aca4d2eb32e7f74ae620780d8b958d
SHA256817929ce4af784af2f28db0eea5cc9a16fa28e8ed0b3bd497ed8dda0619207a3
SHA512cbf559f48b66e2bdf9e0de75d48f169fe2a112e34981c1463856e50807ff05f63afb512afd99503126d9f700ed4eda9bfa45fd38ded5d55d4c8738043ec7e62f
-
Filesize
924B
MD5f00923a522d8aa865419d44b82a295c7
SHA193745ce34e0d022f40bf71868da6d2a0fb294b84
SHA256fb0639bfc5970400b84106759ad00c91a5a24c2524bb5a05cc1acff51e098c37
SHA512842b9fe3ed517b689d27763701232ae4c4b9e441bb6ca8f4ded17e0f8445345fa8095ebb92747490050f9882a222d6f49041d2769b65a8545099ccd3706063eb