254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
Size 770KB
Sample260422-cb2r2aa19s
SHA256 254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab
MD5 aaf60de000c896edc4636957e6ab31b1
SHA1 e70c68ca06a80e2ec021a2d6d0e6062adef0a328
SHA512 6fc740f6d75d5e6ddbcf889446bb9111360247c9b6edca82afae53d09dd618f8e72a1dcbb446b372faf38ca439c47e69eb71cf04f6186b0dcb5d35ba26fb8a67
SSDEEP 24576:O7eit0t9EsyC1XS64DbvYwdzv1n4WwwS6u3sK:O7eimfEsr1X/4wwbn4Wpi
TLSH
T1E5F402D1E5B54CA2F0F70E7D90AA91718ABFB85EF971818E2B84085D0A33DD38E247D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe	DropboxUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe\DisableExceptionChainValidation = "0"	DropboxUpdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	DropboxUpdate.exe

Executes dropped EXE 11 IoCs

pid	Process
820	DropboxUpdate.exe
5024	DropboxUpdate.exe
2032	DropboxUpdate.exe
512	DropboxUpdate.exe
5848	DropboxUpdate.exe
1740	DropboxUpdate.exe
1800	DropboxUpdate.exe
3520	DropboxUpdate.exe
3788	DropboxUpdate.exe
5256	DropboxUpdate.exe
5960	DropboxUpdate.exe

Loads dropped DLL 21 IoCs

pid	Process
820	DropboxUpdate.exe
5024	DropboxUpdate.exe
2032	DropboxUpdate.exe
512	DropboxUpdate.exe
5848	DropboxUpdate.exe
5848	DropboxUpdate.exe
5848	DropboxUpdate.exe
5848	DropboxUpdate.exe
820	DropboxUpdate.exe
1740	DropboxUpdate.exe
1800	DropboxUpdate.exe
3520	DropboxUpdate.exe
3520	DropboxUpdate.exe
1800	DropboxUpdate.exe
3788	DropboxUpdate.exe
820	DropboxUpdate.exe
5256	DropboxUpdate.exe
5256	DropboxUpdate.exe
5256	DropboxUpdate.exe
5256	DropboxUpdate.exe
5960	DropboxUpdate.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
9	1040	msiexec.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DropboxUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DropboxUpdate.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe\DisableExceptionChainValidation	DropboxUpdate.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B1C7267527E2135ED2C5C2AE13A93217_C911B16A18301CEC813C002CC8DB91D1	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B1C7267527E2135ED2C5C2AE13A93217_C911B16A18301CEC813C002CC8DB91D1	DropboxUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_it.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_de.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_it.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\DropboxUpdateOnDemand.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_ko.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_ja.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_nl.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\DropboxCleanup.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_th.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_ko.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_pt-BR.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_ms.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_nl.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_sv.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\npDropboxUpdate3.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_pt-BR.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\DropboxUpdateOnDemand.exe	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_fr.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\DropboxUpdateBroker.exe	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe	DropboxUpdate.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\@PaxHeader	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_es-419.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_th.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\npDropboxUpdate3.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_es.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\DropboxCrashHandler.exe	DropboxUpdate.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Temp\GUTC70.tmp	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_da.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_de.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_uk.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\@PaxHeader	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\DropboxUpdateHelper.msi	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_id.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_ja.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_pl.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_ru.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_uk.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\DropboxUpdateHelper.msi	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\DropboxCleanup.exe	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\DropboxUpdate.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_id.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\psmachine.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\DropboxUpdateBroker.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\psmachine.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_pl.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_ru.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_es.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_fr.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_ms.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_sv.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_zh-TW.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\DropboxUpdate.exe	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdate.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\psuser.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_zh-CN.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_zh-TW.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_en.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_no.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\DropboxUpdate.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_no.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_zh-CN.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\psuser.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_es-419.dll	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdate.dll	DropboxUpdate.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job	DropboxUpdate.exe
File created	C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job	DropboxUpdate.exe
File created	C:\Windows\Installer\e581596.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{099218A5-A723-43DC-8DB5-6173656A1E94}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI17F8.tmp	msiexec.exe
File created	C:\Windows\Installer\e58159a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e581596.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6166.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DropboxUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1740	DropboxUpdate.exe
3788	DropboxUpdate.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\CLSID = "{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}"	DropboxUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\Policy = "3"	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}	DropboxUpdate.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DropboxUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DropboxUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	DropboxUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AF89161-A408-4DFD-9DE2-3C3B7BDB14E2}	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AF89161-A408-4DFD-9DE2-3C3B7BDB14E2}\VersionIndependentProgID	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassSvc.1.0	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F448B4EA-A094-491A-BF61-9AF6CD450C7D}\ = "IProgressWndEvents"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\VersionIndependentProgID\ = "Dropbox.OneClickProcessLauncherMachine"	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC2E189E-C306-4710-BBCC-A8968ACAEB2E}\NumMethods	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.ProcessLauncher\CLSID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachineFallback\CLSID	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.ProcessLauncher\CurVer	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{76E258F0-DE86-4CEC-9D30-3F728A898741}	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A89190B-400F-47DB-960A-7D5A1325A2C8}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F84F5221-63AA-431E-A57C-D7D03649E3E6}\NumMethods\ = "8"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\ProgID	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EF028154-CA20-4F73-ACBB-82451B78F1E6}	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{831F99E1-2250-4065-8975-7408E726825F}\NumMethods	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9614AA6E-82BE-4E1C-A68F-C7DFDAB2FEE8}\InprocHandler32	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachine.1.0	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassSvc.1.0	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60ACA18E-54E6-43F8-A1A4-C4176B6C994E}\NumMethods	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C52C4100-E8C6-438B-AEAC-43C99F7CCC26}\ProxyStubClsid32	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F448B4EA-A094-491A-BF61-9AF6CD450C7D}\ProxyStubClsid32	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.ProcessLauncher\ = "Dropbox Update Process Launcher Class"	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CredentialDialogMachine	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9614AA6E-82BE-4E1C-A68F-C7DFDAB2FEE8}\InprocHandler32	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96D1EED3-701E-4FE5-B996-A543A8465897}\VersionIndependentProgID	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DE7C611-9E6D-468F-8AA2-26C08DB4A687}\ProxyStubClsid32\ = "{AF00043F-18CA-495E-95D8-EADBC89BE365}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F448B4EA-A094-491A-BF61-9AF6CD450C7D}\ProxyStubClsid32\ = "{AF00043F-18CA-495E-95D8-EADBC89BE365}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebSvc.1.0\CLSID\ = "{E58F67C2-BC84-4C7C-AC35-4FFBB25A47E6}"	DropboxUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D412914-1C4F-447D-80D2-E7F9BB302B05}\ = "IGoogleUpdateCore"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B8158CAB-1B7C-4A15-860E-AAA364E77334}	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C416C376-AEC5-4443-9D90-BEBA9434763B}\NumMethods	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9614AA6E-82BE-4E1C-A68F-C7DFDAB2FEE8}\InprocHandler32	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D8474489-B2C1-4CE8-852D-FF8A916C91F0}\NumMethods	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{90AC42F5-B136-4079-B7A1-0A61FC86685D}	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachine.1.0\CLSID	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05378308-2559-4C71-B758-7DACD5A359BA}\ = "IProcessLauncher"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B8158CAB-1B7C-4A15-860E-AAA364E77334}\NumMethods\ = "10"	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9614AA6E-82BE-4E1C-A68F-C7DFDAB2FEE8}	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E54806CB-0046-4BCF-B389-3A6F732DC6E6}\LocalServer32	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Dropbox.OneClickProcessLauncherMachine.1.0\CLSID	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E396485-96EB-4906-B2C5-3E0F1E7748C3}	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28F751F5-74E3-4C46-8174-D8D8A6BAF83F}\ProgID	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96D1EED3-701E-4FE5-B996-A543A8465897}	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreClass.1\CLSID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A496C5D9-84FE-4E84-9D20-7481589E1C23}	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.ProcessLauncher.1.0	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DC422F86-7267-4AF2-8F4F-A20C060621DE}\NumMethods	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E396485-96EB-4906-B2C5-3E0F1E7748C3}\Elevation	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B8158CAB-1B7C-4A15-860E-AAA364E77334}\NumMethods	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96D1EED3-701E-4FE5-B996-A543A8465897}\ProgID\ = "DropboxUpdate.Update3COMClassService.1.0"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\ProductName = "Dropbox Update Helper"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AF89161-A408-4DFD-9DE2-3C3B7BDB14E2}\VersionIndependentProgID	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachine\CurVer	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B35122D2-0036-4536-AEEA-EEA68E54A460}\ProxyStubClsid32	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreMachineClass.1	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachineFallback	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassSvc\CLSID\ = "{76E258F0-DE86-4CEC-9D30-3F728A898741}"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{90AC42F5-B136-4079-B7A1-0A61FC86685D}\ProxyStubClsid32	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78F1393A-63FD-494A-BA89-2C3ECA4E8EC8}\InprocServer32	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A496C5D9-84FE-4E84-9D20-7481589E1C23}\ = "CoCreateAsync"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreMachineClass.1\CLSID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28F751F5-74E3-4C46-8174-D8D8A6BAF83F}\LocalServer32	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DC422F86-7267-4AF2-8F4F-A20C060621DE}	DropboxUpdate.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
820	DropboxUpdate.exe
820	DropboxUpdate.exe
1040	msiexec.exe
1040	msiexec.exe
3788	DropboxUpdate.exe
3788	DropboxUpdate.exe
820	DropboxUpdate.exe
820	DropboxUpdate.exe
820	DropboxUpdate.exe
820	DropboxUpdate.exe
820	DropboxUpdate.exe
820	DropboxUpdate.exe
1040	msiexec.exe
1040	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	820	DropboxUpdate.exe
Token: SeShutdownPrivilege	820	DropboxUpdate.exe
Token: SeIncreaseQuotaPrivilege	820	DropboxUpdate.exe
Token: SeSecurityPrivilege	1040	msiexec.exe
Token: SeCreateTokenPrivilege	820	DropboxUpdate.exe
Token: SeAssignPrimaryTokenPrivilege	820	DropboxUpdate.exe
Token: SeLockMemoryPrivilege	820	DropboxUpdate.exe
Token: SeIncreaseQuotaPrivilege	820	DropboxUpdate.exe
Token: SeMachineAccountPrivilege	820	DropboxUpdate.exe
Token: SeTcbPrivilege	820	DropboxUpdate.exe
Token: SeSecurityPrivilege	820	DropboxUpdate.exe
Token: SeTakeOwnershipPrivilege	820	DropboxUpdate.exe
Token: SeLoadDriverPrivilege	820	DropboxUpdate.exe
Token: SeSystemProfilePrivilege	820	DropboxUpdate.exe
Token: SeSystemtimePrivilege	820	DropboxUpdate.exe
Token: SeProfSingleProcessPrivilege	820	DropboxUpdate.exe
Token: SeIncBasePriorityPrivilege	820	DropboxUpdate.exe
Token: SeCreatePagefilePrivilege	820	DropboxUpdate.exe
Token: SeCreatePermanentPrivilege	820	DropboxUpdate.exe
Token: SeBackupPrivilege	820	DropboxUpdate.exe
Token: SeRestorePrivilege	820	DropboxUpdate.exe
Token: SeShutdownPrivilege	820	DropboxUpdate.exe
Token: SeDebugPrivilege	820	DropboxUpdate.exe
Token: SeAuditPrivilege	820	DropboxUpdate.exe
Token: SeSystemEnvironmentPrivilege	820	DropboxUpdate.exe
Token: SeChangeNotifyPrivilege	820	DropboxUpdate.exe
Token: SeRemoteShutdownPrivilege	820	DropboxUpdate.exe
Token: SeUndockPrivilege	820	DropboxUpdate.exe
Token: SeSyncAgentPrivilege	820	DropboxUpdate.exe
Token: SeEnableDelegationPrivilege	820	DropboxUpdate.exe
Token: SeManageVolumePrivilege	820	DropboxUpdate.exe
Token: SeImpersonatePrivilege	820	DropboxUpdate.exe
Token: SeCreateGlobalPrivilege	820	DropboxUpdate.exe
Token: SeRestorePrivilege	1040	msiexec.exe
Token: SeTakeOwnershipPrivilege	1040	msiexec.exe
Token: SeRestorePrivilege	1040	msiexec.exe
Token: SeTakeOwnershipPrivilege	1040	msiexec.exe
Token: SeRestorePrivilege	1040	msiexec.exe
Token: SeTakeOwnershipPrivilege	1040	msiexec.exe
Token: SeRestorePrivilege	1040	msiexec.exe
Token: SeTakeOwnershipPrivilege	1040	msiexec.exe
Token: SeRestorePrivilege	1040	msiexec.exe
Token: SeTakeOwnershipPrivilege	1040	msiexec.exe
Token: SeRestorePrivilege	1040	msiexec.exe
Token: SeTakeOwnershipPrivilege	1040	msiexec.exe
Token: SeRestorePrivilege	1040	msiexec.exe
Token: SeTakeOwnershipPrivilege	1040	msiexec.exe
Token: SeRestorePrivilege	1040	msiexec.exe
Token: SeTakeOwnershipPrivilege	1040	msiexec.exe
Token: SeRestorePrivilege	1040	msiexec.exe
Token: SeTakeOwnershipPrivilege	1040	msiexec.exe
Token: SeRestorePrivilege	1040	msiexec.exe
Token: SeTakeOwnershipPrivilege	1040	msiexec.exe
Token: SeRestorePrivilege	1040	msiexec.exe
Token: SeTakeOwnershipPrivilege	1040	msiexec.exe
Token: SeRestorePrivilege	1040	msiexec.exe
Token: SeTakeOwnershipPrivilege	1040	msiexec.exe
Token: SeRestorePrivilege	1040	msiexec.exe
Token: SeTakeOwnershipPrivilege	1040	msiexec.exe
Token: SeRestorePrivilege	1040	msiexec.exe
Token: SeTakeOwnershipPrivilege	1040	msiexec.exe
Token: SeRestorePrivilege	1040	msiexec.exe
Token: SeTakeOwnershipPrivilege	1040	msiexec.exe
Token: SeRestorePrivilege	1040	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 820	972	254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe	85
PID 820 wrote to memory of 5024	820	DropboxUpdate.exe	86
PID 820 wrote to memory of 5848	820	DropboxUpdate.exe	93
PID 820 wrote to memory of 1740	820	DropboxUpdate.exe	94
PID 820 wrote to memory of 1800	820	DropboxUpdate.exe	95
PID 3520 wrote to memory of 3788	3520	DropboxUpdate.exe	101
PID 820 wrote to memory of 5256	820	DropboxUpdate.exe	105
PID 820 wrote to memory of 5960	820	DropboxUpdate.exe	106

C:\Users\Admin\AppData\Local\Temp\254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe
"C:\Users\Admin\AppData\Local\Temp\254a538aabf4636d70bbf4c6bbe5d2ae7a24a1d4da02dd70457a5778b1203cab.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:972
- C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\DropboxUpdate.exe
  "C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\DropboxUpdate.exe" /installsource taggedmi /install "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&experiments=buildid%3Dmain%7CThu%2C%2031%20Dec%202099%2023%3A59%3A59%20GMT&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKd055OEVLZ2tBVUJkQmZrVmxIZUZfVHU3Nldra0tiRmhGdUpSeExFMFpEcTBYMDczWDI1LU11ejZXcmwzRm9vOXNsYnVvTy1UR2M3LS1HT2czeFVWM2o3YlVQNWFtd0VsWFJyS0Vaa2RyVzFLMFNON2Z6M0kteDdzTV9nNTZxOEpUTXZGRTJWRThnRlhvSUlRSWoxTDRfTlZnZ2RRfn5ATUVUQSJ9"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Indicator Removal: Clear Persistence
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
    "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regsvc
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5024
- - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
    "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regserver
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:5848
- - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
    "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcGphSEp2YldVNk9tVktkMDU1T0VWTFoydEJWVUprUW1aclZteElaVVpmVkhVM05sZHJhMHRpUm1oR2RVcFNlRXhGTUZwRWNUQllNRGN6V0RJMUxVMTFlalpYY213elJtOXZPWE5zWW5WdlR5MVVSMk0zTFMxSFQyY3plRlZXTTJvM1lsVlFOV0Z0ZDBWc1dGSnlTMFZhYTJSeVZ6RkxNRk5PTjJaNk0wa3RlRGR6VFY5bk5UWnhPRXBVVFhaR1JUSldSVGhuUmxodlNVbFJTV294VERSZlRsWm5aMlJSZm41QVRVVlVRU0o5IiBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuNzYxLjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTFENzY3QzgtOEI5Qi00QkRDLTg0QzAtMjAxRTU1OEI0MjBEfSIgdXNlcmlkPSJ7OTIxNkUwM0QtQUM2Mi00Q0I1LUJCOTAtMEE5NkIwQ0E3OUZDfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezlFMDJGMjk3LUU4OTItNEU3Ny1CNUQ2LTlGQkZDODYxNUY0NX0iPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntEODk2OEZGMi1FMEIxLTRBMTMtQTNFMi1DOUYyOTk1RjNCQzZ9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuNzYxLjEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48L3JlcXVlc3Q-
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1740
- - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
    "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /handoff "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&experiments=buildid%3Dmain%7CThu%2C%2031%20Dec%202099%2023%3A59%3A59%20GMT&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKd055OEVLZ2tBVUJkQmZrVmxIZUZfVHU3Nldra0tiRmhGdUpSeExFMFpEcTBYMDczWDI1LU11ejZXcmwzRm9vOXNsYnVvTy1UR2M3LS1HT2czeFVWM2o3YlVQNWFtd0VsWFJyS0Vaa2RyVzFLMFNON2Z6M0kteDdzTV9nNTZxOEpUTXZGRTJWRThnRlhvSUlRSWoxTDRfTlZnZ2RRfn5ATUVUQSJ9&nolaunch=0" /installsource taggedmi /sessionid "{51D767C8-8B9B-4BDC-84C0-201E558B420D}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1800
- - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
    "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /unregserver
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:5256
- - C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\DropboxUpdate.exe
    "C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\DropboxUpdate.exe" /unregsvc
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5960

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1040

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:2032

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /medsvc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:512

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
  "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcGphSEp2YldVNk9tVktkMDU1T0VWTFoydEJWVUprUW1aclZteElaVVpmVkhVM05sZHJhMHRpUm1oR2RVcFNlRXhGTUZwRWNUQllNRGN6V0RJMUxVMTFlalpYY213elJtOXZPWE5zWW5WdlR5MVVSMk0zTFMxSFQyY3plRlZXTTJvM1lsVlFOV0Z0ZDBWc1dGSnlTMFZhYTJSeVZ6RkxNRk5PTjJaNk0wa3RlRGR6VFY5bk5UWnhPRXBVVFhaR1JUSldSVGhuUmxodlNVbFJTV294VERSZlRsWm5aMlJSZm41QVRVVlVRU0lzSW5KbGNYVmxjM1JmYzJWeGRXVnVZMlVpT2pCOSIgcHJvdG9jb2w9IjMuMCIgdmVyc2lvbj0iMS4zLjc2MS4xIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezUxRDc2N0M4LThCOUItNEJEQy04NEMwLTIwMUU1NThCNDIwRH0iIHVzZXJpZD0iezkyMTZFMDNELUFDNjItNENCNS1CQjkwLTBBOTZCMENBNzlGQ30iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9IntGQjkyM0FCRS02NzhFLTQ2REYtQkZCOS1FQUM4NzM4QjNGNzN9Ij48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7Q0M0NjA4MEUtNEMzMy00OTgxLTg1OUEtQkJBMkY3ODBGMzFFfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iYnVpbGRpZD1tYWlufFRodSwgMzEgRGVjIDIwOTkgMjM6NTk6NTkgR01UIiBpbnN0YWxsYWdlPSItMSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMTI4NzkiIGV4dHJhY29kZTE9IjI2ODQzNTQ1OSIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e581599.rbs

Path C:\Config.Msi\e581599.rbs
Size 7KB
SHA256 792af33b23c8f2cb3f8172acaf3dce721659ab43072d884a7f4ff2314de05089
MD5 bcf2368988f2bf0540002f7a614ed1ac
SHA1 c2abf20ef7cda87fd80675dff90e51427aba2b3f
SHA512 2ff1fdbeb85db5828b7a999d8e967fd8f7f6d8e819e97b3039e9575354eee3f786b9d40fa7ff1ef07f4517592cb8622f7de12ea232678a1798da3d4ee27da7cb
SSDEEP 96:onqwyFRetcd3pU+bCsThqCmU+bC6jeKTq+EThq4HNY5HVWM1Cq7CUsljeKR1Yy:onWeci+mIX+mxKsIPUUsIKN
TLSH
T1AFF10F41B640C2E2F8DB1B7CD71717923BB3D7C5A341630B48CD85328F9B7896E5A29A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58159d.rbs

Path C:\Config.Msi\e58159d.rbs
Size 7KB
SHA256 bf5389f26c2cd96300e74cbbc82a11150499532f471ea26f02249c2b98915aec
MD5 f6896a214404d9ac6132340ed49321f0
SHA1 e8a4aa39121a217a1dc8b121ce2a2ca2c57d1df9
SHA512 78cdd6dac7937b0ccdcc5cdf5500fde23141424fc300120d51fd2b86b167ac8ad4ef5835f6c3aed36c831ac3898834681c7c28552f78a39f185e6d1ccaf95f1d
SSDEEP 96:inql9+G8Rm3Ox498RY3OCjewC8q+c+14JyqhIdjewbpr59ozdyia:inrR6O9RgOZnh1SE+
TLSH
T1C6E10141A640C2E2FDEB1F3CD72317A13BE3D7C5A309434740CD55728B9A7896EAE296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

@PaxHeader

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\@PaxHeader
Size 28B
SHA256 eda44a4f693e403e750d25d0f957d6c8234e152d8738bc2d8d1395dfe5ca0677
MD5 ba85c94bda75fe06a509820becc62a18
SHA1 bf7cee0c1c1c8b181d8a8397ef1da239ce5f5161
SHA512 09dfd4c3882357a8a57956df0c1f96bd059b2db414efbafbbbd6a68a9a6f5fd1bb0cde75a633eb270cb024aab5c7eee1b967ef95dafd4642b9df3f4e53251cfb
MD5 SHA1 SHA512

Submit Download

@PaxHeader

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\@PaxHeader
Size 28B
SHA256 a81b39c9c01107622858893f7ad60426df9c6028b60fcb17d35331e9a62ac9bf
MD5 a5501e155ddaed0eef5d38bf800314c4
SHA1 7249e2e5a870a1c505ef40a3f000b7a2caf0071e
SHA512 9dfdf8e51306ff0abe112fd10c3cdc4681dd4871b3eb25c0cb0aa550aa3382bd8e20e54a9b0fa311a8c7576c99b4daa859775697fffb956e579b7598b0a387f9
MD5 SHA1 SHA512

Submit Download

DropboxCleanup.exe

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\DropboxCleanup.exe
Size 299KB
SHA256 0d9c6de8a57443bffe718d3256fdd467b8970124ba65d8accb6f47dc54d46d72
MD5 8fa7f9a62ea19f3691e8a24833a5bc25
SHA1 23f0825ce2f4731cc73e82ca814872b512d333dd
SHA512 3d8243c4a42f96d549b09797f39b0f2fbef54d643ee4048c24eb6a1b748ef07ecd6bfdc142fe4c13838b0c07957b5e558ebf98fb7bdcc841d49fcff0a06eccf4
SSDEEP 6144:4b/v8TwC+G634GKoC9U3+VEH3Z9E4argvgvv+AOFcmFdNH3P:4b/4+G634GKH9U3ZDqWw4NH3P
TLSH
T148547DD0B551CC72F4F31432183CAB7655AEB528FB6146DB63940A2DCE336C39E31AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DropboxCrashHandler.exe

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\DropboxCrashHandler.exe
Size 129KB
SHA256 02618e6399ae8e99df5a4f523239451e5a5d23a8c80ea5afeecfeb29de4be4a7
MD5 4d0ccec5560d013004c6143a8b46b4fd
SHA1 4881c84035d327999e156555233b85e2d5e252b0
SHA512 f2f5c6784f100a933328b8c2a403c233e42f81ee339c189c088afbb48f3e73a2bea2500e69e88ac6ddd0c27204eaf91811c6b35bd3d42ca67288cede6cb62f3b
SSDEEP 3072:9ZOOxLE4GTnZcyg2QltfW8cEzeIKnOZnLtFXsq/JVKjEWclhxu:uOxLEbTzKz0
TLSH
T181D3C5C1F5B84CB9F4F359391429867295BFB83CFA32865E2994015D0E23DC38E257E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DropboxUpdate.exe

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\DropboxUpdate.exe
Size 127KB
SHA256 7655221b493047c61285e1de78807d0584920b0d14d150e2487da9728b1926f3
MD5 8ad76e0b347bb690697535ce95b1c656
SHA1 10d2622a3965d21215a953ed924d01788a9805ed
SHA512 35fbda7f05865b3a50454dba5ba3738eb8a5fd6d2eea5e9415d8d517811d51c50cca6c7b47a5b19f1ff1f4101567137fe18805f4f740289456da1ff2af682504
SSDEEP 3072:SvZOOxLE4GTnQcyL2QltfWLgo/iE+DiV7X5pbwmjNBOfoXcz:SwOxLEbTQXLz
TLSH
T1EDD3C5C1F6B84CB9F4F35A390429867295BFB93DF922864E2994015D0E23DC38E257E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DropboxUpdateBroker.exe

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\DropboxUpdateBroker.exe
Size 75KB
SHA256 244584df7838f51b0125dbdc8ece45c3f734c281afe26ced86bc1d11f187d416
MD5 4d3a85b133ad6bc102c7849638ae5e6f
SHA1 5a065bb75c30a6e4b0988cb8aec9cb7e863a2ed9
SHA512 8800ec0d2a6aa4f068dbffb90c3f0e966a0836e5a3c4d2590707653ca8cbfa04b33bccb4a99d94f3a92b8c184b1b5f0d755aa732fb5e1c9486f67ba3534688d5
SSDEEP 768:SsbwKvIIfEr5EJFQp18EMUpVP2R6lkxSXBNQlhgtfWdIyyDGa5PxWEux:Ssbwk6WQfAUDPPZQlhgtfWulPx8
TLSH
T15173D3D1E4708CF2F0F75D7C206C96726AEFB51DF6A08046365852AD4B63EC35E292CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DropboxUpdateHelper.msi

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\DropboxUpdateHelper.msi
Size 26KB
SHA256 3af0421ca92962c0154145dc06a223bfecc59a58966d860d232703a32d08a820
MD5 fb467307098a998d3836ca8b87157a4a
SHA1 c3733d4f6e14198f3e7125bdd71f7cdc1115a793
SHA512 851c2919cfda7e38325ce7ad1bb3f4b129e1508da65c7592ec53f4854ec012d925464bc52597c3ce0591e829347e56ecfe3f1ea6fa7f10f825ce6e6317831fa9
SSDEEP 384:Ax5Pey3M5IC0ioXvsSkAohDGsjPxh8E9VF0NyhaLwetYoXNXYpkuL43/:EeWMmCEsXDGiPxWErB2dYp7A
TLSH
T1CDC23A1776005932E8464F3165AAC3B58B35BD459F97405332ABF39C2FB2BC176BA2E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DropboxUpdateOnDemand.exe

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\DropboxUpdateOnDemand.exe
Size 75KB
SHA256 7a016aeb36269947e4961cc030d857557d14e1e954d10bdf6a264f992b647d45
MD5 934bc0439cc3b11c2d6d9031119326b2
SHA1 64f3eb19c1ddc3d07da2f868be54a70adcd83455
SHA512 e0e279d0e68d1c6e2abdd673baa24ad1ce5cf2743f9ac3515687551aaec14407909fc79d439d58d86e4347182b16c7e1a8bfa00216b330cbbd721a8b75633ef4
SSDEEP 768:gJb4KvIIfEr5EJFQp18EMUpVP2e6lTxSXBNQ2hgtfWdIy5DGXPxWEnhI:gJb4k6WQfAUDPMgQ2hgtfWuxPxDI
TLSH
T12273E4D1E4708CF2F0F75D7C206C96726AEFB51DF6A04046365852AD4B63EC36E292CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdate.dll

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdate.dll
Size 1.1MB
SHA256 cc4e06440aaa7d81abb2b8935343f6f3c0b5736c1a20bfb53b0af0b41c49b7bf
MD5 8cef863dae49754afb4e31853341aa4f
SHA1 379825bd7d7305eaac49c61fbb553b515cd79f6b
SHA512 4ba532692cfa675791e329fe665dcbb078a6df7002a8b4a5e2940028ec004e594b25e387a55f0b372a7a939d4c558faceb2e9d7c79e264f2b1609bccf1626bf7
SSDEEP 24576:juaLeU1ejhl3BGNOM3H4LWpQjRnPQ0eeUXQlFVOVvk:juaLeU1edlxGR4LWpcRo02XQlFV6k
TLSH
T116354BD237E18834F9FB0A38E57AA675ADBE7961F930C50E4750891E19736C2CC3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_da.dll

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_da.dll
Size 32KB
SHA256 1f117457bff89326e78d3bfe7dc2dce747211377c2e31fdbabd7e167905074c8
MD5 c1289300556d83492daa4f52a65139eb
SHA1 44d408489dc076ba4319f4a4b54d45ab267d5429
SHA512 feee885575a91381635e2745f93e885454d8c85fb781462898318e3293a33d0be92d2885b0ae89fc4ad6215d88afa45b6e5ee991aadbf09f84af083a90c81b66
SSDEEP 384:ae9XpDshgWIPuEQCkuvL51kw9J+BTyDGsDKPxh8E9VF0NytSf:J9XNZWI6CkIV+MDGIKPxWEXK
TLSH
T1C8E2405257F85A18F6FB2F30BCB981604975FC92AD38D62D3244906C0D72786EAB4B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_en.dll

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_en.dll
Size 31KB
SHA256 73fe9b8c32d0545908852ac342b20bdbdeccc11450ec43361027470f5e398c11
MD5 fb58b2bcb59b4bcdc4b2142738bebec6
SHA1 c6f7bd3777bb869ea02ce83775a3b5565e76f99e
SHA512 2798f2d7b832ba3f1ef18ef11315401cdcb9d1e519bb56dc836a7519c0f9ca75a68e3491500a0a43dcf595ce3877efec13992a381004b5816ee9c9403159518d
SSDEEP 384:bT9XpDshgWIPuEQCYUfagyyyRJLQDGsb6Pxh8E9VF0NyVXs:/9XNZWI6CYKagyySJ0DGrPxWEj8
TLSH
T1FCE24E4287F81918F6FB6F30B9B895604D35BC52AD38C66D3240D42D5972B82EEB4B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_es-419.dll

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_es-419.dll
Size 33KB
SHA256 33c14929455ea3407eac56f69fe139c4808af89b8c4f53c2f2d56f7ce13fc774
MD5 06ae1601082b29d493dbb8731fac371f
SHA1 8722c25e4846fb8733ad1fc684c47b18d7e07bac
SHA512 67ec944daeeab6e76f37391d88cbffbf4469587f6692d8094636260b3ad46a6eeba1ee29094f47e747ee38b4d875bb4260d523e9e28dafba9018aa4112852db8
SSDEEP 384:9VW59XpDshgWIPuEQC/BAO/yedz9ykDGstPxh8E9VF0NyLDHYhy:9O9XNZWI6C/B//lzwkDGCPxWEJ4hy
TLSH
T195F21B004BF86A46F6F77F30A87856654E3ABC92AC39C55D2200952D0D71F85EEB8B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_es.dll

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_es.dll
Size 33KB
SHA256 b38ba975563441ad456949a97602d95a6ad0cb277806c56e5a84122fcbd01fbe
MD5 cbd733f6f431980bbded51780f807a4f
SHA1 5fdbd3ba5cd93357807b7b2147df87359c6fd8c4
SHA512 b0e7d1388f3ce70a168809b4b73a16032bca599796643ca94e04600ef736f4de2b3a5ff18c6c01cdfeb30526811e28a66a3ae5f0ba38e9bb9d7d4905653ff32a
SSDEEP 384:rE9XpDshgWIPuEQCblD7LLWS27adtFDGsZdBPxh8E9VF0NyYxd6S:o9XNZWI6CblnL/27avFDGeBPxWESb6S
TLSH
T143E22D108BF92A46F6F76F34B87851654D3ABD62AC38C65D2210912D0D71F81EEB8B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_fr.dll

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_fr.dll
Size 34KB
SHA256 edd23030a7f718224168ba619b96519fe13171d7039805304e9e68bdaf53327f
MD5 d6c2a3a4680bbfa54c8fd105db5f6071
SHA1 adbf86ebba0d83302c8bf2cd9d07a5a4ba310dc6
SHA512 335efc531479d0a88d377a0c4ec3025d71e0b3c764042737cc5f3fe6aa01bc6a8b089299f4719889de27eadf58a845da654d0fc5720d42550e5366a0b7f05fad
SSDEEP 384:AR9XpDshgWIPuEQCDxFdPtF0IK9qMhGxFDGs6kPxh8E9VF0NyO6tc:A9XNZWI6CDPdPts9wHDG/kPxWEw0c
TLSH
T1F9F2F91297E85A01F6FB7F31B8B981204E3ABC9A9D35C52D2241D09D1D31B41EEB8B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_id.dll

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_id.dll
Size 31KB
SHA256 e91dc5fedc46d162e4af252974dd6d3ecc20c4f8133cfe8a934627435b09203f
MD5 7aaaf7daa74593d3f4f26bacbd87ae1e
SHA1 b49641ba3a3690567e7eeacc4683c893f9672c2f
SHA512 27c11bef4e3b420b7931de7f4a35761f8fa31fb38bbf192feece6b56b0f0abf8d59303abe4f69bc0d43c01f8b9d7720251325ef331b76fd881ec683b7625f350
SSDEEP 384:Nj9XpDshgWIPuEQCD+1HDWq6elDoWoRncvCPHlU6jKDGsXEPxh8E9VF0NyLzG:19XNZWI6CDUbEvu9DGMEPxWERC
TLSH
T1C9E23C9143E86908FAFB8F3065B856640A37FC63BD34826D3344A5285D727C2EE35B76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_it.dll

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_it.dll
Size 33KB
SHA256 30de5ef5d420fa72c80ceccedefb1c74e4b13ab3ceae05086244600c4370dd2f
MD5 e4be28c214d66ff84d507d2ddaa41a68
SHA1 5f7043e2c373144ae5aa8ff295c050455ba5b54a
SHA512 df59b8e9ae09c2fe47d1b951c164c4b539c39ca033931c770b8f2aaa638522a874b1af7934eda8d3d286a4f6bcd01e1f1c00b0a06629d74f4bc4b962f000e4e9
SSDEEP 384:339XpDshgWIPuEQCRO4Qr0mhz48sOVpEDGskH/Pxh8E9VF0NyFV+n:n9XNZWI6CRGr0mhzICSDGvfPxWE/8n
TLSH
T1D9F2721157F82A04F6F77F30B83896694D36FD52AD39C62E2241D45C0932A91EEB4B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_ja.dll

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_ja.dll
Size 27KB
SHA256 b9a6bd0e5e6532f5f0ee4d625d13bf820674e487fbdf9c3f090072aa34ed3bf7
MD5 14f49d411f86f6f73d4ba696800d5280
SHA1 c681a09a04cbc3e7ae9b69066d803fea2c06364c
SHA512 47b87103391bf5f00c5187050b99410dc6d4211ab573942e1177e844c7753ddb381450da7a2214ae3052a3837667ad7cb3e019c0d2ee0a65314c25c49cd96d0f
SSDEEP 384:lML9XpDshgWIPuEQCrM29uttlSa/9sW0DGs+Pxh8E9VF0NymW2H:k9XNZWI6CrvyOW0DGDPxWE4T
TLSH
T1DED23A4957E08C0AF5FACE319094A5381A38FC32ADD24D623140E41A1D71BC7AB67FBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_ko.dll

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_ko.dll
Size 27KB
SHA256 ee343316f429686295fd62c66e3bee4b006760e6d4b1841f3a3d70b0765b8f76
MD5 3c648323082d51a2aa0beb8d4b068d99
SHA1 8b232373b3b8f5c122cdea4259220b21f9b47c25
SHA512 26be89433ce1591564fb8688e0bf648df6053eac979f1d04d92e17303f83d82584d415eb0a1d5ef5269b610b34e30b6079fa8d234255282cc7dcd2cfab440e92
SSDEEP 768:b9XNZWI6CYmecZDPkWfB//DGb8PxWErIb:b9XThBYmecZLkWfC8Pxab
TLSH
T1D8D22A1242A4AC01F9B9DD3260C58BBA5235ED21AE178167B380F0785E727C2EF797DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_ms.dll

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_ms.dll
Size 31KB
SHA256 a675677c5db2529e0c0b3bada5dc0adbf8046246b11d46f8fb5b8a2428e3f7d8
MD5 5735bedbd9ecb7f3264671a747431a22
SHA1 cefe8703b0f7bc334d704601a736d4c49897d561
SHA512 4ffd2c3ac40a9c872d0096345942283a4fe258947feb6ba3d8cf8498b582cca071689fbc5766b2eca68ee1a4d250fe587600a7589e647d867dc04467c10692ae
SSDEEP 384:cD9XpDshgWIPuEQCsL3YV7ZZgZuG3yK6jFJHgcO/2WfdqJBAQCRNDKlDGsvwPxhS:+9XNZWI6CskqDzwDGSwPxWEuBR
TLSH
T171E22C9143DC6948FEFB8F3069F856614A27FD93BD39826D2340A5284D31AC2DE35B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_nl.dll

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_nl.dll
Size 34KB
SHA256 f0629fd15bf50a051d8cefa88955bbdbcb43168b4df5cc1ffa94381710a48080
MD5 6feeeec9d49faea1d07d35f618ff2f23
SHA1 13bca7bdb651cf980b15f8cf831f0f192549e129
SHA512 6f92583fdc7be218989e92900efcb8b490201ed3c14aa7038a4667a8b2f8d6730fcc91a8d8d2d0db6a691905fb3862c183dfcfa1b595d430d49ee8af158b171b
SSDEEP 384:hZ349XpDshgWIPuEQCgnOBYUEz8BxUUNOXDGsQkPxh8E9VF0NyLwf1:hN49XNZWI6CgjlQEGIDGrkPxWEla1
TLSH
T13BF2E94247F85918F6F76F30BDB885608E76FC92AD34C66D2240A56C5C32681EEB4B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_no.dll

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_no.dll
Size 32KB
SHA256 daa873a1e8474e955544dd08c239651f5ca71fcec4da725f3a9018942285d8b1
MD5 c6d0bb6d261d4673764028a860b047c4
SHA1 81d01245f156d84ff8c195b1c806005d2a28d882
SHA512 9099a62cadd41f33d05c3b6eb0af1d37509d3b1f2fcd402024b19a1dd744223e9ec8601959808d1175ad1aca01a2a6ca97cc1d74f37839c39c7b164c0b7b5be4
SSDEEP 384:UAKaq6Kaq6Kafv/Pe9XpDshgWIPuEQC9Kh/IGDMsiKVtmDGs/lPxh8E9VF0Ny9yN:Q9XNZWI6C9ItDviKVMDGEPxWEDtwv
TLSH
T190E2715197E85919F2FB6F30BCB845604975FCA1AE38C61D3244E06C0D327C6EAB4B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_pl.dll

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_pl.dll
Size 33KB
SHA256 e5634445f290c02062f328923a17f6cf64d97b8ec2f39b2dcdc17abd68b5804c
MD5 f41720449445622dbe926ab2223dae35
SHA1 b09cd888ea2100ace9025863a7718715c8f52cad
SHA512 25b13cb517c6001b9e4b49960ca9006719b646c351e70f425d90dd8a79d7697bd3ff101c62afb389d94e1406fd6685d65d346ba49397a68fda65b301fb839cc9
SSDEEP 384:Ix9XpDshgWIPuEQCAJDL7bHNzcjANLsMnZbDGsCoZPxh8E9VF0NyH8bFg:Y9XNZWI6CARTLZ9DGxoZPxWENsg
TLSH
T14AF2660197F81940F6F7AF3075B962658F7ABC22BD3481AF364091190A71AC1EEB4B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_pt-BR.dll

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_pt-BR.dll
Size 32KB
SHA256 acc7058a00f86c96ee393d1c9b9edc072346c540492607114879ce912a6a077a
MD5 4cd53b5d1df90f73457c89a16686c8ef
SHA1 b3dfe49d83a9bb7229a2eb0d90baeb8d3757b744
SHA512 aa3915284922ac976bff80ba0fa180b2659ed4ec8918161bb4b54180426ef2032cb031cf5818100277a7b109304dcca1ff47cbd8201e92d53c64a7e3cc2bacdd
SSDEEP 384:p1q9XpDshgWIPuEQC2qylFEZnK+J1tDGsKPxh8E9VF0Ny4UV+:jq9XNZWI6C25nEZHLDGLPxWE2w+
TLSH
T10CE2504187F81A44F6FB7F31687856258D37BD62AC38C25D2210D0691D71B82EEB9B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_ru.dll

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_ru.dll
Size 33KB
SHA256 21517e571c100bc5d46b71e3c3dac9469fccdb7111317689f4bf3a61299d4637
MD5 8683871b8e01236278c1aebb7a1272dc
SHA1 dce879e813dca7ebf3e72cbcc112beb9b3913b57
SHA512 2108f15a684d49dd489f7f779ea633700cd9f2330635e179c1cacaa81d2f674f90d3c04feb020b632af38404597e1645ef6278aa2ee524d3817902559fd4f1e0
SSDEEP 384:hH9XpDshgWIPuEQC/4qKN+5N+JnYOk3oyq3Lbq9DYNdDdHt/ymnDGsaPxh8E9VFe:R9XNZWI6C/BjoyHZmnNnDGhPxWEQPJ
TLSH
T127E2860FEBBC9800F468D6711A6589E72064FF206B1985E6719FFC70646437277293CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_sv.dll

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_sv.dll
Size 32KB
SHA256 7a1bc16bca6cf3fd914df3b485321be79cc339e8d590693702ca36da8b084028
MD5 5ec05b764e42833537994957353d2613
SHA1 aa1f98972522b263ed686bcb180fe3575fbb2370
SHA512 71d71525dd29dff48c423b2ace985098794f26c52c4cdcc57ad52a0ab8bf55c6eafb8a990880c016ccac6c0c7d7709bf53293ec520bc97eee32843a27d6fd1e8
SSDEEP 384:k79XpDshgWIPuEQCtG3D3ciot2QQEgz5DGsBPxh8E9VF0Ny/uyTj:C9XNZWI6CtKciotgEADGGPxWEVl
TLSH
T1BEE2324257E85918F6F75F30BCB986214875FCA1AD79D62D3300D5AC0C31B86EAB4B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_th.dll

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_th.dll
Size 31KB
SHA256 f36f30e19a55a2194087eb6373f08a6f7ad68bf939da12c69132e346dc79242d
MD5 e88b95b7cb9bdcc4d770cb6fa8fb292c
SHA1 1493522b0d008256f5c53f39547e770a800ad123
SHA512 b65dbc0a408bc38fda0e520c8c3cc5803d8b711bcf3fce684a9e9401282200c9ff4b06d296189ba8e960ba9fee009af7f8383bea8e82f16848782cd5d8e6283d
SSDEEP 768:u49XNZWI6C1wRUkGGq2aaLxo2qQ5qDGxPxWEi6:u49XThB1wRUkGGq2aaLxoZQVPxt
TLSH
T1B6E2A47482B12B02D56BC8F0E1C48E737C2CED21DC1AC1A1A16FDD345A317A6ABF995D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_uk.dll

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_uk.dll
Size 32KB
SHA256 ae96fc8006b7201b041473a10c498ae4889c6eb81cdf0bee4270ca7a2745395a
MD5 a2b1957643377100b1c777316b813438
SHA1 1e83f73e3bd0f24ab7b41079ec22c270ec92cd65
SHA512 e5efb0bd54e237a5b7d2bcec805aa093b71ed92ec1ebc739d1c499d1579072e065e2906b377624faac5722739d24c8694cc805f2a5f9a5d1c8ed19b793363c85
SSDEEP 384:EM9XpDshgWIPuEQCfbgb0sS5kU40ryH5oHXmUzdkPhJzDGss4RPxh8E9VF0NyqKG:19XNZWI6CfMvoHSxDGdQPxWEQCQ7
TLSH
T1D1E2840FE6B88910F658D9315A9285E71478FF202F98C2D6724FF831282977377256DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_zh-TW.dll

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\goopdateres_zh-TW.dll
Size 25KB
SHA256 44fcaf1bb65cc2b6a670363341330aaebbb1f47d6b42990af20671d9f83be4be
MD5 381d2ce762cb24b3aa67424ea6598990
SHA1 03d4280434452da4b8116345ea183752a8db9560
SHA512 09cadcba6ee86f4dbcfcecee4173c146c22ec78b8edb111f9665cab289ddfd448494e32c6e3e11dcf9fea2f782751f777c4bb59a96d6691d337c55d69f3ac523
SSDEEP 384:sP9XpDshgWIPuEQCRJS6ql73inVv0WGcDGsSUsOPxh8E9VF0NyReKm:e9XNZWI6CR4l7nrcDGVUZPxWEnM
TLSH
T1E0C2290247D42C01F9AE9D3260988536C632FD222F5581A63189E4715EB2B83FF7E76E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

npDropboxUpdate3.dll

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\npDropboxUpdate3.dll
Size 273KB
SHA256 4275c513a038d1a3eb3f64030aabb17d2ad7fadd314f67baed452405d94938f6
MD5 7d4353547b80786631735c397cf3b82a
SHA1 c51f475af0e95cd56f11565cf503f2f92fe1ef78
SHA512 5e4df0b91ef9d3a9bf9c08684d376a68c4cfcbf2a500d0e0d9f6c54aa32f777a24d4b2efe312c9db73c4819f009e3b3dad7720f4fa9932f48900e57820a09cbd
SSDEEP 6144:WA7vNv8mV2DMQ5wnGlZEspqba7W6ue1TtJU5zZIJQ1PcS:R7B8mVQVwnGlZEyQZh3
TLSH
T1B5549D123FD58076E8B718349AA3DA526AF97D325930C84FF788884DAF71B82D935313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

psmachine.dll

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\psmachine.dll
Size 211KB
SHA256 8e7cb942bbac612139b9a23c3c88cae2f2f468b0985c5e232371ef06075bd9fd
MD5 23b51c1f7a2a52176837de18b5ee30ad
SHA1 cd78068f1d3101c922a9313693d0ea796f70920f
SHA512 e3b9d18b0ec79d8c0176a595656f6b06fcaf5b1033037b6394ebdf9d064e0ad3219159aa659d6c6c3dca859e2fd0489821310f9bc08117d3cb6ded948a19fdf5
SSDEEP 3072:xJne7kj/ktzQQET+lMk7q7SHwoBOlAl7QXrQoW3UK3833zQWH+gxY:x0C2U3T++k7YSHwoB0+sXjW304J
TLSH
T195248D1132D0C036D66F103944ABC7626BB97D306FA4C58B3798BA6D5E70786EB36393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

psuser.dll

Path C:\Program Files (x86)\Dropbox\Temp\GUMC6F.tmp\psuser.dll
Size 211KB
SHA256 58d2cba2d3d3b35976f4f64a799d6ee35bf8f133adc6042a622b17f19edb3fb2
MD5 ea45813115295a608fefca9601dbeef5
SHA1 5d5d0f6162cc07fc9f06b8da6a97dde099c7f78b
SHA512 9d2f162368005e79e0849e5378b66ae076c4dea742511880a3e4bacd55da4742683c2b7ccfc69e493e22ddf19fa437d5b1bb9987e3ec577782fc322a8b94ce79
SSDEEP 3072:9JXe7kj/ktzQQET+lMk7q7SHwoBOlto7QXrQSW3UK3833zQWW+/xQ:9UC2U3T++k7YSHwoB02sXVW30rO
TLSH
T1C3248D0132D0C036D66F103944ABC7626BB97D306FA4C58B3798BA6D5E71786EB36393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_de.dll

Path C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_de.dll
Size 35KB
SHA256 4bb880b2382a38c928fabf2d8e6540343a01942a97a889811e04052a7f1b71c5
MD5 c521b614d63ec286b5c4a0e156910cf1
SHA1 292c175d80940682072bf95ab1a6b9d7f52618da
SHA512 16b1a19edc03e1e2d42c091b60705ed4d09ce940379a211ec4ed350430998fa074653dabdafb3e1d27e8f4cd5cc5392f63c51740e6b053f8030066fd836a87f7
SSDEEP 384:xho9XpDshgWIPuEQCf6w+1KfK9Y3uLSDp0DGsP/GPxh8E9VF0NynhyM:Y9XNZWI6Cfh+1KfK9YpV0DGAGPxWEhwM
TLSH
T1E7F23E4147E85918F2F76F30BD7882654E72FCE2AD75D96E2300A06C1871B45EAB8B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goopdateres_zh-CN.dll

Path C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_zh-CN.dll
Size 25KB
SHA256 07f5d695f61c2885f22149c5cef669c365e1086a825e0ea20cf5f49db71b3ffd
MD5 08b03f0884831793e56960403b4e0987
SHA1 f3ded14d42c162b5bd831bb1b7a109e6959239da
SHA512 cf53ebcbd25f302e2e4f43eab00b8436640797b0d05a01eeb4bb0b6cae478db8f29e5191cc105d971069a816a4938467b0321c1e64aa5d4d4c4f2d1934cf9c04
SSDEEP 384:sw9XpDshgWIPuEQCeP7KP0DGsksanPxh8E9VF0NyH5GeQ:V9XNZWI6CeTKP0DGDnPxWEx8V
TLSH
T1B9C23C0647D41C01F7BE8D31A089D9359631FD226D9186BB3144E4351EB2B83EF7ABAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DropboxUpdateTaskMachineUA.job

Path C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
Size 924B
SHA256 cc59882f34ffd0092fbd202291fd933f7cf4968db949de3b218e6c5b04159dd0
MD5 7066b70871ec60bb6ba1f13f1e2530a5
SHA1 987e27c83bebd2b9de92de7ea1e8741a87b559d1
SHA512 ee5db74cc4b7b66bc42ed69f95ce1ef9d882bf5f33d88cd29498274d735d1a91725c7f7fb20f0123eb9965feeed56fe32036f272659b5c8ec65b9f6b07cdd392
TLSH
T171112951B7FA4124F6F77F756EB019914A7BBD22BD34C64D1011044D9CB2A90C970B23
MD5 SHA1 SHA512 TLSH

Submit Download

memory/512-334-0x0000000000E20000-0x0000000000EFC000-memory.dmp

Download

memory/820-452-0x0000000006A10000-0x0000000006AAF000-memory.dmp

Download

memory/820-451-0x0000000001650000-0x000000000172C000-memory.dmp

Download

memory/820-67-0x0000000003850000-0x0000000003851000-memory.dmp

Download

memory/820-405-0x0000000001650000-0x000000000172C000-memory.dmp

Download

memory/820-406-0x0000000006A10000-0x0000000006AAF000-memory.dmp

Download

memory/820-450-0x0000000000430000-0x0000000000453000-memory.dmp

Download

memory/972-454-0x0000000001400000-0x00000000014DC000-memory.dmp

Download

memory/972-404-0x0000000001400000-0x00000000014DC000-memory.dmp

Download

memory/1040-407-0x000001BDB3710000-0x000001BDB371C000-memory.dmp

Download

memory/1740-398-0x00000000009C0000-0x0000000000A9C000-memory.dmp

Download

memory/1800-408-0x0000000000D80000-0x0000000000E5C000-memory.dmp

Download

memory/1800-425-0x0000000000D80000-0x0000000000E5C000-memory.dmp

Download

memory/2032-328-0x0000000001710000-0x00000000017EC000-memory.dmp

Download

memory/3520-419-0x0000000001280000-0x000000000135C000-memory.dmp

Download

memory/3520-420-0x0000000003520000-0x00000000035BF000-memory.dmp

Download

memory/3520-410-0x0000000003520000-0x00000000035BF000-memory.dmp

Download

memory/3520-409-0x0000000001280000-0x000000000135C000-memory.dmp

Download

memory/3788-413-0x0000000000BC0000-0x0000000000C9C000-memory.dmp

Download

memory/5024-301-0x0000000001380000-0x000000000145C000-memory.dmp

Download

memory/5256-437-0x0000000000F20000-0x0000000000FFC000-memory.dmp

Download

memory/5848-350-0x00000000007E0000-0x00000000008BC000-memory.dmp

Download

memory/5960-447-0x0000000001130000-0x000000000120C000-memory.dmp

Download