Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 01:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
General
- Target ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe
- Size 770KB
- Sample260707-b3vmcscw2k
- SHA256 ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c
- MD5 05bb2a05d83f02551e0a7356af1b24f3
- SHA1 4c2000855daa053c4ed7f1c80c58ec45f1cc6ef9
- SHA512 65bfc8d11cced399e2dec80f462c393a6ed4ee63031588b23d15fdeeacbe75d952b2f66ede7f797133b64b85673281678162544dcdffdcf2ed5346bb436037c5
- SSDEEP 24576:O7eit0t9EsyC1XS64DbvYwdzv1n4WwwS6u3sK:O7eimfEsr1X/4wwbn4Wpi
- TLSH T199F402D1E5B54CA2F0F70E7D50AA91718ABFB85EF971818E2B84085D0A33DD38E247D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe DropboxUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe\DisableExceptionChainValidation = "0" DropboxUpdate.exe - Executes dropped EXE 11 IoCs
pid Process 5836 DropboxUpdate.exe 1716 DropboxUpdate.exe 3980 DropboxUpdate.exe 2288 DropboxUpdate.exe 5084 DropboxUpdate.exe 4200 DropboxUpdate.exe 4104 DropboxUpdate.exe 1816 DropboxUpdate.exe 4780 DropboxUpdate.exe 5936 DropboxUpdate.exe 1456 DropboxUpdate.exe - Loads dropped DLL 21 IoCs
pid Process 5836 DropboxUpdate.exe 1716 DropboxUpdate.exe 3980 DropboxUpdate.exe 2288 DropboxUpdate.exe 5084 DropboxUpdate.exe 5084 DropboxUpdate.exe 5084 DropboxUpdate.exe 5084 DropboxUpdate.exe 5836 DropboxUpdate.exe 4200 DropboxUpdate.exe 4104 DropboxUpdate.exe 1816 DropboxUpdate.exe 1816 DropboxUpdate.exe 4104 DropboxUpdate.exe 4780 DropboxUpdate.exe 5836 DropboxUpdate.exe 5936 DropboxUpdate.exe 5936 DropboxUpdate.exe 5936 DropboxUpdate.exe 5936 DropboxUpdate.exe 1456 DropboxUpdate.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DropboxUpdate.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DropboxUpdate.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe -
description ioc Process Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe\DisableExceptionChainValidation DropboxUpdate.exe - Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9D6B3FE9E6E4067193F477ABAD990106 DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B1C7267527E2135ED2C5C2AE13A93217_C911B16A18301CEC813C002CC8DB91D1 DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B1C7267527E2135ED2C5C2AE13A93217_C911B16A18301CEC813C002CC8DB91D1 DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9D6B3FE9E6E4067193F477ABAD990106 DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content DropboxUpdate.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_ja.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_zh-CN.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\@PaxHeader ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_zh-TW.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\DropboxCleanup.exe ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_pl.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_th.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\DropboxUpdateOnDemand.exe DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\DropboxUpdateBroker.exe ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_ms.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdate.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_da.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\npDropboxUpdate3.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\DropboxUpdate.exe ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_uk.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\DropboxUpdateHelper.msi ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_sv.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_en.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_da.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_es-419.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_pt-BR.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_fr.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_nl.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_sv.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_en.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_ko.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_no.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_de.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_es-419.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\DropboxUpdateBroker.exe DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdate.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\DropboxUpdateOnDemand.exe ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_de.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_fr.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_th.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\DropboxUpdate.exe DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_it.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_pt-BR.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_es.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\DropboxCrashHandler.exe DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_id.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_ja.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\psuser.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\DropboxCrashHandler.exe ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\npDropboxUpdate3.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_nl.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_pl.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_uk.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\psmachine.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_es.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_zh-TW.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_id.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_it.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_zh-CN.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_ko.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\psmachine.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_ru.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_no.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\psuser.dll ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_ms.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_ru.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\DropboxCleanup.exe DropboxUpdate.exe File opened for modification C:\Program Files (x86)\Dropbox\Temp\GUT1EB.tmp ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe - Drops file in Windows directory 18 IoCs
description ioc Process File created C:\Windows\Installer\e590e4e.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF42E15878E79E984D.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI1052.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF07C6440A833FF4D3.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFD0E676D12FB8FDF1.TMP msiexec.exe File created C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job DropboxUpdate.exe File created C:\Windows\SystemTemp\~DF09BA29C81F96C652.TMP msiexec.exe File created C:\Windows\Installer\e590e52.msi msiexec.exe File created C:\Windows\SystemTemp\~DFC13D7B4A9210E1FA.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF860B774F82D89508.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI6D8.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{099218A5-A723-43DC-8DB5-6173656A1E94} msiexec.exe File opened for modification C:\Windows\Installer\e590e4e.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF5D461E4BDD689353.TMP msiexec.exe File created C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job DropboxUpdate.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4200 DropboxUpdate.exe 4780 DropboxUpdate.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5} DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\CLSID = "{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}" DropboxUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\Policy = "3" DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5} DropboxUpdate.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E DropboxUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" DropboxUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" DropboxUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F84F5221-63AA-431E-A57C-D7D03649E3E6}\NumMethods DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04F3B937-6C9D-4DAC-9477-8C35E24B25D1}\LocalizedString = "@C:\\Program Files (x86)\\Dropbox\\Update\\1.3.761.1\\goopdate.dll,-3000" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoCreateAsync.1.0 DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CredentialDialogMachine\CLSID\ = "{4AF89161-A408-4DFD-9DE2-3C3B7BDB14E2}" DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04F3B937-6C9D-4DAC-9477-8C35E24B25D1}\ProgID DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassSvc\CLSID DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58237066-0A7A-4C18-B132-D7BE280A6327}\ProxyStubClsid32\ = "{AF00043F-18CA-495E-95D8-EADBC89BE365}" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E396485-96EB-4906-B2C5-3E0F1E7748C3}\VersionIndependentProgID DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28F751F5-74E3-4C46-8174-D8D8A6BAF83F}\ProgID\ = "DropboxUpdate.OnDemandCOMClassMachineFallback.1.0" DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoCreateAsync\CLSID DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.ProcessLauncher\CurVer DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreMachineClass\CLSID DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\SourceList\Net\1 = "C:\\Program Files (x86)\\Dropbox\\Update\\1.3.761.1\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E396485-96EB-4906-B2C5-3E0F1E7748C3}\ = "Dropbox Update Core Class" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DropboxUpdate.exe\AppID = "{96D1EED3-701E-4FE5-B996-A543A8465897}" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E58F67C2-BC84-4C7C-AC35-4FFBB25A47E6}\VersionIndependentProgID DropboxUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC2E189E-C306-4710-BBCC-A8968ACAEB2E}\NumMethods\ = "24" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.ProcessLauncher DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{831F99E1-2250-4065-8975-7408E726825F} DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9614AA6E-82BE-4E1C-A68F-C7DFDAB2FEE8}\InprocHandler32 DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3COMClassService DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E58F67C2-BC84-4C7C-AC35-4FFBB25A47E6}\AppID = "{76E258F0-DE86-4CEC-9D30-3F728A898741}" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FDA8FC46-0F9A-4A8C-8764-3B80880A9AEB}\ProxyStubClsid32\ = "{AF00043F-18CA-495E-95D8-EADBC89BE365}" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8EEF2D6E-1CE5-4823-88D0-7F727719D0A2}\NumMethods\ = "4" DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05378308-2559-4C71-B758-7DACD5A359BA}\NumMethods DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{90AC42F5-B136-4079-B7A1-0A61FC86685D}\NumMethods DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CredentialDialogMachine\CLSID DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CredentialDialogMachine\CurVer DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebSvc\CLSID DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebSvc.1.0\ = "DropboxUpdate Update3Web" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EF028154-CA20-4F73-ACBB-82451B78F1E6}\ProxyStubClsid32 DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B35122D2-0036-4536-AEEA-EEA68E54A460}\NumMethods DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A89190B-400F-47DB-960A-7D5A1325A2C8}\ProxyStubClsid32 DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AF89161-A408-4DFD-9DE2-3C3B7BDB14E2}\VersionIndependentProgID DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D412914-1C4F-447D-80D2-E7F9BB302B05} DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3COMClassService\CurVer\ = "DropboxUpdate.Update3COMClassService.1.0" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E58F67C2-BC84-4C7C-AC35-4FFBB25A47E6}\ = "DropboxUpdate Update3Web" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05378308-2559-4C71-B758-7DACD5A359BA}\ProxyStubClsid32 DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D412914-1C4F-447D-80D2-E7F9BB302B05}\NumMethods DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{96D1EED3-701E-4FE5-B996-A543A8465897}\ServiceParameters = "/comsvc" DropboxUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\Version = "16974585" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EF028154-CA20-4F73-ACBB-82451B78F1E6} DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B35122D2-0036-4536-AEEA-EEA68E54A460}\NumMethods\ = "4" DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C416C376-AEC5-4443-9D90-BEBA9434763B}\NumMethods DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DC422F86-7267-4AF2-8F4F-A20C060621DE} DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DE7C611-9E6D-468F-8AA2-26C08DB4A687}\ProxyStubClsid32\ = "{AF00043F-18CA-495E-95D8-EADBC89BE365}" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DE7C611-9E6D-468F-8AA2-26C08DB4A687}\ = "IAppVersion" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5} DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}\ProgID DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60ACA18E-54E6-43F8-A1A4-C4176B6C994E}\NumMethods DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\LocalServer32 DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04F3B937-6C9D-4DAC-9477-8C35E24B25D1}\ProgID\ = "DropboxUpdate.Update3WebMachine.1.0" DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachine\CurVer DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{96D1EED3-701E-4FE5-B996-A543A8465897}\ = "ServiceModule" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A496C5D9-84FE-4E84-9D20-7481589E1C23}\ProgID DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3363994D-A786-4A32-A745-48B9B6EA709A}\VersionIndependentProgID\ = "DropboxUpdate.ProcessLauncher" DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CECD4BFB-9F43-4540-B72C-706BE66B375E} DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A337332-37E4-4063-B4F3-6416846C8A33} DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96D1EED3-701E-4FE5-B996-A543A8465897}\ProgID\ = "DropboxUpdate.Update3COMClassService.1.0" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC2E189E-C306-4710-BBCC-A8968ACAEB2E}\ = "IAppBundleWeb" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoCreateAsync\CLSID\ = "{A496C5D9-84FE-4E84-9D20-7481589E1C23}" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreMachineClass\CLSID DropboxUpdate.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 5836 DropboxUpdate.exe 5836 DropboxUpdate.exe 3432 msiexec.exe 3432 msiexec.exe 4780 DropboxUpdate.exe 4780 DropboxUpdate.exe 5836 DropboxUpdate.exe 5836 DropboxUpdate.exe 5836 DropboxUpdate.exe 5836 DropboxUpdate.exe 5836 DropboxUpdate.exe 5836 DropboxUpdate.exe 3432 msiexec.exe 3432 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5836 DropboxUpdate.exe Token: SeShutdownPrivilege 5836 DropboxUpdate.exe Token: SeIncreaseQuotaPrivilege 5836 DropboxUpdate.exe Token: SeSecurityPrivilege 3432 msiexec.exe Token: SeCreateTokenPrivilege 5836 DropboxUpdate.exe Token: SeAssignPrimaryTokenPrivilege 5836 DropboxUpdate.exe Token: SeLockMemoryPrivilege 5836 DropboxUpdate.exe Token: SeIncreaseQuotaPrivilege 5836 DropboxUpdate.exe Token: SeMachineAccountPrivilege 5836 DropboxUpdate.exe Token: SeTcbPrivilege 5836 DropboxUpdate.exe Token: SeSecurityPrivilege 5836 DropboxUpdate.exe Token: SeTakeOwnershipPrivilege 5836 DropboxUpdate.exe Token: SeLoadDriverPrivilege 5836 DropboxUpdate.exe Token: SeSystemProfilePrivilege 5836 DropboxUpdate.exe Token: SeSystemtimePrivilege 5836 DropboxUpdate.exe Token: SeProfSingleProcessPrivilege 5836 DropboxUpdate.exe Token: SeIncBasePriorityPrivilege 5836 DropboxUpdate.exe Token: SeCreatePagefilePrivilege 5836 DropboxUpdate.exe Token: SeCreatePermanentPrivilege 5836 DropboxUpdate.exe Token: SeBackupPrivilege 5836 DropboxUpdate.exe Token: SeRestorePrivilege 5836 DropboxUpdate.exe Token: SeShutdownPrivilege 5836 DropboxUpdate.exe Token: SeDebugPrivilege 5836 DropboxUpdate.exe Token: SeAuditPrivilege 5836 DropboxUpdate.exe Token: SeSystemEnvironmentPrivilege 5836 DropboxUpdate.exe Token: SeChangeNotifyPrivilege 5836 DropboxUpdate.exe Token: SeRemoteShutdownPrivilege 5836 DropboxUpdate.exe Token: SeUndockPrivilege 5836 DropboxUpdate.exe Token: SeSyncAgentPrivilege 5836 DropboxUpdate.exe Token: SeEnableDelegationPrivilege 5836 DropboxUpdate.exe Token: SeManageVolumePrivilege 5836 DropboxUpdate.exe Token: SeImpersonatePrivilege 5836 DropboxUpdate.exe Token: SeCreateGlobalPrivilege 5836 DropboxUpdate.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe Token: SeTakeOwnershipPrivilege 3432 msiexec.exe Token: SeRestorePrivilege 3432 msiexec.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3432 msiexec.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5932 wrote to memory of 5836 5932 ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe 87 PID 5836 wrote to memory of 1716 5836 DropboxUpdate.exe 88 PID 5836 wrote to memory of 5084 5836 DropboxUpdate.exe 94 PID 5836 wrote to memory of 4200 5836 DropboxUpdate.exe 95 PID 5836 wrote to memory of 4104 5836 DropboxUpdate.exe 96 PID 1816 wrote to memory of 4780 1816 DropboxUpdate.exe 98 PID 5836 wrote to memory of 5936 5836 DropboxUpdate.exe 99 PID 5836 wrote to memory of 1456 5836 DropboxUpdate.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe"C:\Users\Admin\AppData\Local\Temp\ff9cda248b6b72e20bc1b1207d8959f6643d8380a6fe37fa3ad5fabd4a449d0c.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\DropboxUpdate.exe" /installsource taggedmi /install "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&experiments=buildid%3Dmain%7CThu%2C%2031%20Dec%202099%2023%3A59%3A59%20GMT&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKd055OEVLd2pBTWdPRlhrWjVGbWlWcFVoX0F1LTRnN0RLR1ZoekZGc3pHQlBIZExmekg3Xy02YVYyZTQxSnpLdTY0Y19icUhubTRuQ0NfOHkxdHhhYnpVSzY4OWIxcXRjOTZnS0FpekVycTlvMG5zN21XY2I2M0dZR2k1ODRIaWdFNU1NYVdrS0FYRkNSbEFmUVJmbjl1MkNGQUBNRVRBIn0"2⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Indicator Removal: Clear Persistence
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regsvc3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1716
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regserver3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:5084
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcGphSEp2YldVNk9tVktkMDU1T0VWTGQycEJUV2RQUmxocldqVkdiV2xXY0ZWb1gwRjFMVFJuTjBSTFIxWm9la1pHYzNwSFFsQklaRXhtZWtnM1h5MDJZVll5WlRReFNucExkVFkwWTE5aWNVaHViVFJ1UTBOZk9Ia3hkSGhoWW5wVlN6WTRPV0l4Y1hSak9UWm5TMEZwZWtWeWNUbHZNRzV6TjIxWFkySTJNMGRaUjJrMU9EUklhV2RGTlUxTllWZHJTMEZZUmtOU2JFRm1VVkptYmpsMU1rTkdRVUJOUlZSQkluMCIgcHJvdG9jb2w9IjMuMCIgdmVyc2lvbj0iMS4zLjc2MS4xIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0ZBNEUxRTUwLThBRjEtNEJDNi1CQjg1LTM3NTI5MTZFOTk1MH0iIHVzZXJpZD0ie0U0NUI1NTFCLUVBNkQtNDM1Mi1BRjk3LTE0RkVFNzI0ODlDM30iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9IntBM0RDMEE0MS0yOUNBLTQ2NzYtQTkzRi1FNUVEOTVGNDBBMDl9Ij48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RDg5NjhGRjItRTBCMS00QTEzLUEzRTItQzlGMjk5NUYzQkM2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjc2MS4xIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4200
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /handoff "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&experiments=buildid%3Dmain%7CThu%2C%2031%20Dec%202099%2023%3A59%3A59%20GMT&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjpjaHJvbWU6OmVKd055OEVLd2pBTWdPRlhrWjVGbWlWcFVoX0F1LTRnN0RLR1ZoekZGc3pHQlBIZExmekg3Xy02YVYyZTQxSnpLdTY0Y19icUhubTRuQ0NfOHkxdHhhYnpVSzY4OWIxcXRjOTZnS0FpekVycTlvMG5zN21XY2I2M0dZR2k1ODRIaWdFNU1NYVdrS0FYRkNSbEFmUVJmbjl1MkNGQUBNRVRBIn0&nolaunch=0" /installsource taggedmi /sessionid "{FA4E1E50-8AF1-4BC6-BB85-3752916E9950}"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4104
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /unregserver3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:5936
-
-
C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\DropboxUpdate.exe" /unregsvc3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1456
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3432
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:3980
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /medsvc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:2288
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcGphSEp2YldVNk9tVktkMDU1T0VWTGQycEJUV2RQUmxocldqVkdiV2xXY0ZWb1gwRjFMVFJuTjBSTFIxWm9la1pHYzNwSFFsQklaRXhtZWtnM1h5MDJZVll5WlRReFNucExkVFkwWTE5aWNVaHViVFJ1UTBOZk9Ia3hkSGhoWW5wVlN6WTRPV0l4Y1hSak9UWm5TMEZwZWtWeWNUbHZNRzV6TjIxWFkySTJNMGRaUjJrMU9EUklhV2RGTlUxTllWZHJTMEZZUmtOU2JFRm1VVkptYmpsMU1rTkdRVUJOUlZSQklpd2ljbVZ4ZFdWemRGOXpaWEYxWlc1alpTSTZNSDAiIHByb3RvY29sPSIzLjAiIHZlcnNpb249IjEuMy43NjEuMSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntGQTRFMUU1MC04QUYxLTRCQzYtQkI4NS0zNzUyOTE2RTk5NTB9IiB1c2VyaWQ9IntFNDVCNTUxQi1FQTZELTQzNTItQUY5Ny0xNEZFRTcyNDg5QzN9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgcmVxdWVzdGlkPSJ7MDFDQzdFNUYtRDlENy00QjRBLUE1QjYtNEE5Qjg1NTBGRThBfSI-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0ie0NDNDYwODBFLTRDMzMtNDk4MS04NTlBLUJCQTJGNzgwRjMxRX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImJ1aWxkaWQ9bWFpbnxUaHUsIDMxIERlYyAyMDk5IDIzOjU5OjU5IEdNVCIgaW5zdGFsbGFnZT0iLTEiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDEyODc5IiBleHRyYWNvZGUxPSIyNjg0MzU0NTkiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4780
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e590e51.rbs
- Size 7KB
- SHA256 89050f136dcaf078e36de04524363949db2c406571a1470769cb3de9cdb39602
- MD5 071fc2e91bf43846c20ae96aa70c4297
- SHA1 cf0ab95b4ef72d63bb53cd611785ee2d1f1c5aa5
- SHA512 522953d9816b185221bb65c5f53d6e2003a85173ee2789ee3357efcf4dc77486fbd210ab3a0991fac8bff289f5a85c0baafe15ce3d16bdd30835c936e92d926a
- SSDEEP 96:DnGy+ACv+3pUebCsThqCmUebC6jeKTq+EThq4HtY5HVWM1Cq7CUsljeKR1Yy:DnDCwiemIXemxKswPUUsIKN
- TLSH T16CF11F41B640C2E2F8DB1B7CD71317523BB3D7C8A341634B48CD85328F9B7896E5A29A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e590e55.rbs
- Size 7KB
- SHA256 3b2e8d13f0cff8c331e440fb3bd1002b375d09e6535b7472122f30e2e431995e
- MD5 7b4889f548764524a885decbcc3ccbfb
- SHA1 e79c6c75a62a1cda3ac30e30194c3488c48d0d11
- SHA512 d592a389541d71616171096bb96acc8311a43f6cda9447695454ec2eb57bbde16a5ef868e63e80e2aba562833520e0d9e36ecf90afba0058c0a9fd1d37ba5edd
- SSDEEP 96:ZnHly+G8RF3Ox498R43OCjewC8q+c+14JyqhIdjewbdr59Iodyia:ZnxRpO9RAOZnh1IH+
- TLSH T18EE11241A240C2E3FDEB1F3CD72317613BE3D788A305434744CD55728B5A7896EAE29A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\@PaxHeader
- Size 28B
- SHA256 a81b39c9c01107622858893f7ad60426df9c6028b60fcb17d35331e9a62ac9bf
- MD5 a5501e155ddaed0eef5d38bf800314c4
- SHA1 7249e2e5a870a1c505ef40a3f000b7a2caf0071e
- SHA512 9dfdf8e51306ff0abe112fd10c3cdc4681dd4871b3eb25c0cb0aa550aa3382bd8e20e54a9b0fa311a8c7576c99b4daa859775697fffb956e579b7598b0a387f9
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\DropboxCleanup.exe
- Size 299KB
- SHA256 0d9c6de8a57443bffe718d3256fdd467b8970124ba65d8accb6f47dc54d46d72
- MD5 8fa7f9a62ea19f3691e8a24833a5bc25
- SHA1 23f0825ce2f4731cc73e82ca814872b512d333dd
- SHA512 3d8243c4a42f96d549b09797f39b0f2fbef54d643ee4048c24eb6a1b748ef07ecd6bfdc142fe4c13838b0c07957b5e558ebf98fb7bdcc841d49fcff0a06eccf4
- SSDEEP 6144:4b/v8TwC+G634GKoC9U3+VEH3Z9E4argvgvv+AOFcmFdNH3P:4b/4+G634GKH9U3ZDqWw4NH3P
- TLSH T148547DD0B551CC72F4F31432183CAB7655AEB528FB6146DB63940A2DCE336C39E31AA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\DropboxCrashHandler.exe
- Size 129KB
- SHA256 02618e6399ae8e99df5a4f523239451e5a5d23a8c80ea5afeecfeb29de4be4a7
- MD5 4d0ccec5560d013004c6143a8b46b4fd
- SHA1 4881c84035d327999e156555233b85e2d5e252b0
- SHA512 f2f5c6784f100a933328b8c2a403c233e42f81ee339c189c088afbb48f3e73a2bea2500e69e88ac6ddd0c27204eaf91811c6b35bd3d42ca67288cede6cb62f3b
- SSDEEP 3072:9ZOOxLE4GTnZcyg2QltfW8cEzeIKnOZnLtFXsq/JVKjEWclhxu:uOxLEbTzKz0
- TLSH T181D3C5C1F5B84CB9F4F359391429867295BFB83CFA32865E2994015D0E23DC38E257E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\DropboxUpdate.exe
- Size 127KB
- SHA256 7655221b493047c61285e1de78807d0584920b0d14d150e2487da9728b1926f3
- MD5 8ad76e0b347bb690697535ce95b1c656
- SHA1 10d2622a3965d21215a953ed924d01788a9805ed
- SHA512 35fbda7f05865b3a50454dba5ba3738eb8a5fd6d2eea5e9415d8d517811d51c50cca6c7b47a5b19f1ff1f4101567137fe18805f4f740289456da1ff2af682504
- SSDEEP 3072:SvZOOxLE4GTnQcyL2QltfWLgo/iE+DiV7X5pbwmjNBOfoXcz:SwOxLEbTQXLz
- TLSH T1EDD3C5C1F6B84CB9F4F35A390429867295BFB93DF922864E2994015D0E23DC38E257E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\DropboxUpdateBroker.exe
- Size 75KB
- SHA256 244584df7838f51b0125dbdc8ece45c3f734c281afe26ced86bc1d11f187d416
- MD5 4d3a85b133ad6bc102c7849638ae5e6f
- SHA1 5a065bb75c30a6e4b0988cb8aec9cb7e863a2ed9
- SHA512 8800ec0d2a6aa4f068dbffb90c3f0e966a0836e5a3c4d2590707653ca8cbfa04b33bccb4a99d94f3a92b8c184b1b5f0d755aa732fb5e1c9486f67ba3534688d5
- SSDEEP 768:SsbwKvIIfEr5EJFQp18EMUpVP2R6lkxSXBNQlhgtfWdIyyDGa5PxWEux:Ssbwk6WQfAUDPPZQlhgtfWulPx8
- TLSH T15173D3D1E4708CF2F0F75D7C206C96726AEFB51DF6A08046365852AD4B63EC35E292CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\DropboxUpdateHelper.msi
- Size 26KB
- SHA256 3af0421ca92962c0154145dc06a223bfecc59a58966d860d232703a32d08a820
- MD5 fb467307098a998d3836ca8b87157a4a
- SHA1 c3733d4f6e14198f3e7125bdd71f7cdc1115a793
- SHA512 851c2919cfda7e38325ce7ad1bb3f4b129e1508da65c7592ec53f4854ec012d925464bc52597c3ce0591e829347e56ecfe3f1ea6fa7f10f825ce6e6317831fa9
- SSDEEP 384:Ax5Pey3M5IC0ioXvsSkAohDGsjPxh8E9VF0NyhaLwetYoXNXYpkuL43/:EeWMmCEsXDGiPxWErB2dYp7A
- TLSH T1CDC23A1776005932E8464F3165AAC3B58B35BD459F97405332ABF39C2FB2BC176BA2E0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\DropboxUpdateOnDemand.exe
- Size 75KB
- SHA256 7a016aeb36269947e4961cc030d857557d14e1e954d10bdf6a264f992b647d45
- MD5 934bc0439cc3b11c2d6d9031119326b2
- SHA1 64f3eb19c1ddc3d07da2f868be54a70adcd83455
- SHA512 e0e279d0e68d1c6e2abdd673baa24ad1ce5cf2743f9ac3515687551aaec14407909fc79d439d58d86e4347182b16c7e1a8bfa00216b330cbbd721a8b75633ef4
- SSDEEP 768:gJb4KvIIfEr5EJFQp18EMUpVP2e6lTxSXBNQ2hgtfWdIy5DGXPxWEnhI:gJb4k6WQfAUDPMgQ2hgtfWuxPxDI
- TLSH T12273E4D1E4708CF2F0F75D7C206C96726AEFB51DF6A04046365852AD4B63EC36E292CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdate.dll
- Size 1.1MB
- SHA256 cc4e06440aaa7d81abb2b8935343f6f3c0b5736c1a20bfb53b0af0b41c49b7bf
- MD5 8cef863dae49754afb4e31853341aa4f
- SHA1 379825bd7d7305eaac49c61fbb553b515cd79f6b
- SHA512 4ba532692cfa675791e329fe665dcbb078a6df7002a8b4a5e2940028ec004e594b25e387a55f0b372a7a939d4c558faceb2e9d7c79e264f2b1609bccf1626bf7
- SSDEEP 24576:juaLeU1ejhl3BGNOM3H4LWpQjRnPQ0eeUXQlFVOVvk:juaLeU1edlxGR4LWpcRo02XQlFV6k
- TLSH T116354BD237E18834F9FB0A38E57AA675ADBE7961F930C50E4750891E19736C2CC3A712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_da.dll
- Size 32KB
- SHA256 1f117457bff89326e78d3bfe7dc2dce747211377c2e31fdbabd7e167905074c8
- MD5 c1289300556d83492daa4f52a65139eb
- SHA1 44d408489dc076ba4319f4a4b54d45ab267d5429
- SHA512 feee885575a91381635e2745f93e885454d8c85fb781462898318e3293a33d0be92d2885b0ae89fc4ad6215d88afa45b6e5ee991aadbf09f84af083a90c81b66
- SSDEEP 384:ae9XpDshgWIPuEQCkuvL51kw9J+BTyDGsDKPxh8E9VF0NytSf:J9XNZWI6CkIV+MDGIKPxWEXK
- TLSH T1C8E2405257F85A18F6FB2F30BCB981604975FC92AD38D62D3244906C0D72786EAB4B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_de.dll
- Size 35KB
- SHA256 4bb880b2382a38c928fabf2d8e6540343a01942a97a889811e04052a7f1b71c5
- MD5 c521b614d63ec286b5c4a0e156910cf1
- SHA1 292c175d80940682072bf95ab1a6b9d7f52618da
- SHA512 16b1a19edc03e1e2d42c091b60705ed4d09ce940379a211ec4ed350430998fa074653dabdafb3e1d27e8f4cd5cc5392f63c51740e6b053f8030066fd836a87f7
- SSDEEP 384:xho9XpDshgWIPuEQCf6w+1KfK9Y3uLSDp0DGsP/GPxh8E9VF0NynhyM:Y9XNZWI6Cfh+1KfK9YpV0DGAGPxWEhwM
- TLSH T1E7F23E4147E85918F2F76F30BD7882654E72FCE2AD75D96E2300A06C1871B45EAB8B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_en.dll
- Size 31KB
- SHA256 73fe9b8c32d0545908852ac342b20bdbdeccc11450ec43361027470f5e398c11
- MD5 fb58b2bcb59b4bcdc4b2142738bebec6
- SHA1 c6f7bd3777bb869ea02ce83775a3b5565e76f99e
- SHA512 2798f2d7b832ba3f1ef18ef11315401cdcb9d1e519bb56dc836a7519c0f9ca75a68e3491500a0a43dcf595ce3877efec13992a381004b5816ee9c9403159518d
- SSDEEP 384:bT9XpDshgWIPuEQCYUfagyyyRJLQDGsb6Pxh8E9VF0NyVXs:/9XNZWI6CYKagyySJ0DGrPxWEj8
- TLSH T1FCE24E4287F81918F6FB6F30B9B895604D35BC52AD38C66D3240D42D5972B82EEB4B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_es-419.dll
- Size 33KB
- SHA256 33c14929455ea3407eac56f69fe139c4808af89b8c4f53c2f2d56f7ce13fc774
- MD5 06ae1601082b29d493dbb8731fac371f
- SHA1 8722c25e4846fb8733ad1fc684c47b18d7e07bac
- SHA512 67ec944daeeab6e76f37391d88cbffbf4469587f6692d8094636260b3ad46a6eeba1ee29094f47e747ee38b4d875bb4260d523e9e28dafba9018aa4112852db8
- SSDEEP 384:9VW59XpDshgWIPuEQC/BAO/yedz9ykDGstPxh8E9VF0NyLDHYhy:9O9XNZWI6C/B//lzwkDGCPxWEJ4hy
- TLSH T195F21B004BF86A46F6F77F30A87856654E3ABC92AC39C55D2200952D0D71F85EEB8B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_es.dll
- Size 33KB
- SHA256 b38ba975563441ad456949a97602d95a6ad0cb277806c56e5a84122fcbd01fbe
- MD5 cbd733f6f431980bbded51780f807a4f
- SHA1 5fdbd3ba5cd93357807b7b2147df87359c6fd8c4
- SHA512 b0e7d1388f3ce70a168809b4b73a16032bca599796643ca94e04600ef736f4de2b3a5ff18c6c01cdfeb30526811e28a66a3ae5f0ba38e9bb9d7d4905653ff32a
- SSDEEP 384:rE9XpDshgWIPuEQCblD7LLWS27adtFDGsZdBPxh8E9VF0NyYxd6S:o9XNZWI6CblnL/27avFDGeBPxWESb6S
- TLSH T143E22D108BF92A46F6F76F34B87851654D3ABD62AC38C65D2210912D0D71F81EEB8B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_fr.dll
- Size 34KB
- SHA256 edd23030a7f718224168ba619b96519fe13171d7039805304e9e68bdaf53327f
- MD5 d6c2a3a4680bbfa54c8fd105db5f6071
- SHA1 adbf86ebba0d83302c8bf2cd9d07a5a4ba310dc6
- SHA512 335efc531479d0a88d377a0c4ec3025d71e0b3c764042737cc5f3fe6aa01bc6a8b089299f4719889de27eadf58a845da654d0fc5720d42550e5366a0b7f05fad
- SSDEEP 384:AR9XpDshgWIPuEQCDxFdPtF0IK9qMhGxFDGs6kPxh8E9VF0NyO6tc:A9XNZWI6CDPdPts9wHDG/kPxWEw0c
- TLSH T1F9F2F91297E85A01F6FB7F31B8B981204E3ABC9A9D35C52D2241D09D1D31B41EEB8B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_id.dll
- Size 31KB
- SHA256 e91dc5fedc46d162e4af252974dd6d3ecc20c4f8133cfe8a934627435b09203f
- MD5 7aaaf7daa74593d3f4f26bacbd87ae1e
- SHA1 b49641ba3a3690567e7eeacc4683c893f9672c2f
- SHA512 27c11bef4e3b420b7931de7f4a35761f8fa31fb38bbf192feece6b56b0f0abf8d59303abe4f69bc0d43c01f8b9d7720251325ef331b76fd881ec683b7625f350
- SSDEEP 384:Nj9XpDshgWIPuEQCD+1HDWq6elDoWoRncvCPHlU6jKDGsXEPxh8E9VF0NyLzG:19XNZWI6CDUbEvu9DGMEPxWERC
- TLSH T1C9E23C9143E86908FAFB8F3065B856640A37FC63BD34826D3344A5285D727C2EE35B76
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_it.dll
- Size 33KB
- SHA256 30de5ef5d420fa72c80ceccedefb1c74e4b13ab3ceae05086244600c4370dd2f
- MD5 e4be28c214d66ff84d507d2ddaa41a68
- SHA1 5f7043e2c373144ae5aa8ff295c050455ba5b54a
- SHA512 df59b8e9ae09c2fe47d1b951c164c4b539c39ca033931c770b8f2aaa638522a874b1af7934eda8d3d286a4f6bcd01e1f1c00b0a06629d74f4bc4b962f000e4e9
- SSDEEP 384:339XpDshgWIPuEQCRO4Qr0mhz48sOVpEDGskH/Pxh8E9VF0NyFV+n:n9XNZWI6CRGr0mhzICSDGvfPxWE/8n
- TLSH T1D9F2721157F82A04F6F77F30B83896694D36FD52AD39C62E2241D45C0932A91EEB4B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_ja.dll
- Size 27KB
- SHA256 b9a6bd0e5e6532f5f0ee4d625d13bf820674e487fbdf9c3f090072aa34ed3bf7
- MD5 14f49d411f86f6f73d4ba696800d5280
- SHA1 c681a09a04cbc3e7ae9b69066d803fea2c06364c
- SHA512 47b87103391bf5f00c5187050b99410dc6d4211ab573942e1177e844c7753ddb381450da7a2214ae3052a3837667ad7cb3e019c0d2ee0a65314c25c49cd96d0f
- SSDEEP 384:lML9XpDshgWIPuEQCrM29uttlSa/9sW0DGs+Pxh8E9VF0NymW2H:k9XNZWI6CrvyOW0DGDPxWE4T
- TLSH T1DED23A4957E08C0AF5FACE319094A5381A38FC32ADD24D623140E41A1D71BC7AB67FBE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_ko.dll
- Size 27KB
- SHA256 ee343316f429686295fd62c66e3bee4b006760e6d4b1841f3a3d70b0765b8f76
- MD5 3c648323082d51a2aa0beb8d4b068d99
- SHA1 8b232373b3b8f5c122cdea4259220b21f9b47c25
- SHA512 26be89433ce1591564fb8688e0bf648df6053eac979f1d04d92e17303f83d82584d415eb0a1d5ef5269b610b34e30b6079fa8d234255282cc7dcd2cfab440e92
- SSDEEP 768:b9XNZWI6CYmecZDPkWfB//DGb8PxWErIb:b9XThBYmecZLkWfC8Pxab
- TLSH T1D8D22A1242A4AC01F9B9DD3260C58BBA5235ED21AE178167B380F0785E727C2EF797DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_ms.dll
- Size 31KB
- SHA256 a675677c5db2529e0c0b3bada5dc0adbf8046246b11d46f8fb5b8a2428e3f7d8
- MD5 5735bedbd9ecb7f3264671a747431a22
- SHA1 cefe8703b0f7bc334d704601a736d4c49897d561
- SHA512 4ffd2c3ac40a9c872d0096345942283a4fe258947feb6ba3d8cf8498b582cca071689fbc5766b2eca68ee1a4d250fe587600a7589e647d867dc04467c10692ae
- SSDEEP 384:cD9XpDshgWIPuEQCsL3YV7ZZgZuG3yK6jFJHgcO/2WfdqJBAQCRNDKlDGsvwPxhS:+9XNZWI6CskqDzwDGSwPxWEuBR
- TLSH T171E22C9143DC6948FEFB8F3069F856614A27FD93BD39826D2340A5284D31AC2DE35B36
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_nl.dll
- Size 34KB
- SHA256 f0629fd15bf50a051d8cefa88955bbdbcb43168b4df5cc1ffa94381710a48080
- MD5 6feeeec9d49faea1d07d35f618ff2f23
- SHA1 13bca7bdb651cf980b15f8cf831f0f192549e129
- SHA512 6f92583fdc7be218989e92900efcb8b490201ed3c14aa7038a4667a8b2f8d6730fcc91a8d8d2d0db6a691905fb3862c183dfcfa1b595d430d49ee8af158b171b
- SSDEEP 384:hZ349XpDshgWIPuEQCgnOBYUEz8BxUUNOXDGsQkPxh8E9VF0NyLwf1:hN49XNZWI6CgjlQEGIDGrkPxWEla1
- TLSH T13BF2E94247F85918F6F76F30BDB885608E76FC92AD34C66D2240A56C5C32681EEB4B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_no.dll
- Size 32KB
- SHA256 daa873a1e8474e955544dd08c239651f5ca71fcec4da725f3a9018942285d8b1
- MD5 c6d0bb6d261d4673764028a860b047c4
- SHA1 81d01245f156d84ff8c195b1c806005d2a28d882
- SHA512 9099a62cadd41f33d05c3b6eb0af1d37509d3b1f2fcd402024b19a1dd744223e9ec8601959808d1175ad1aca01a2a6ca97cc1d74f37839c39c7b164c0b7b5be4
- SSDEEP 384:UAKaq6Kaq6Kafv/Pe9XpDshgWIPuEQC9Kh/IGDMsiKVtmDGs/lPxh8E9VF0Ny9yN:Q9XNZWI6C9ItDviKVMDGEPxWEDtwv
- TLSH T190E2715197E85919F2FB6F30BCB845604975FCA1AE38C61D3244E06C0D327C6EAB4B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_pl.dll
- Size 33KB
- SHA256 e5634445f290c02062f328923a17f6cf64d97b8ec2f39b2dcdc17abd68b5804c
- MD5 f41720449445622dbe926ab2223dae35
- SHA1 b09cd888ea2100ace9025863a7718715c8f52cad
- SHA512 25b13cb517c6001b9e4b49960ca9006719b646c351e70f425d90dd8a79d7697bd3ff101c62afb389d94e1406fd6685d65d346ba49397a68fda65b301fb839cc9
- SSDEEP 384:Ix9XpDshgWIPuEQCAJDL7bHNzcjANLsMnZbDGsCoZPxh8E9VF0NyH8bFg:Y9XNZWI6CARTLZ9DGxoZPxWENsg
- TLSH T14AF2660197F81940F6F7AF3075B962658F7ABC22BD3481AF364091190A71AC1EEB4B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_pt-BR.dll
- Size 32KB
- SHA256 acc7058a00f86c96ee393d1c9b9edc072346c540492607114879ce912a6a077a
- MD5 4cd53b5d1df90f73457c89a16686c8ef
- SHA1 b3dfe49d83a9bb7229a2eb0d90baeb8d3757b744
- SHA512 aa3915284922ac976bff80ba0fa180b2659ed4ec8918161bb4b54180426ef2032cb031cf5818100277a7b109304dcca1ff47cbd8201e92d53c64a7e3cc2bacdd
- SSDEEP 384:p1q9XpDshgWIPuEQC2qylFEZnK+J1tDGsKPxh8E9VF0Ny4UV+:jq9XNZWI6C25nEZHLDGLPxWE2w+
- TLSH T10CE2504187F81A44F6FB7F31687856258D37BD62AC38C25D2210D0691D71B82EEB9B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_ru.dll
- Size 33KB
- SHA256 21517e571c100bc5d46b71e3c3dac9469fccdb7111317689f4bf3a61299d4637
- MD5 8683871b8e01236278c1aebb7a1272dc
- SHA1 dce879e813dca7ebf3e72cbcc112beb9b3913b57
- SHA512 2108f15a684d49dd489f7f779ea633700cd9f2330635e179c1cacaa81d2f674f90d3c04feb020b632af38404597e1645ef6278aa2ee524d3817902559fd4f1e0
- SSDEEP 384:hH9XpDshgWIPuEQC/4qKN+5N+JnYOk3oyq3Lbq9DYNdDdHt/ymnDGsaPxh8E9VFe:R9XNZWI6C/BjoyHZmnNnDGhPxWEQPJ
- TLSH T127E2860FEBBC9800F468D6711A6589E72064FF206B1985E6719FFC70646437277293CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_sv.dll
- Size 32KB
- SHA256 7a1bc16bca6cf3fd914df3b485321be79cc339e8d590693702ca36da8b084028
- MD5 5ec05b764e42833537994957353d2613
- SHA1 aa1f98972522b263ed686bcb180fe3575fbb2370
- SHA512 71d71525dd29dff48c423b2ace985098794f26c52c4cdcc57ad52a0ab8bf55c6eafb8a990880c016ccac6c0c7d7709bf53293ec520bc97eee32843a27d6fd1e8
- SSDEEP 384:k79XpDshgWIPuEQCtG3D3ciot2QQEgz5DGsBPxh8E9VF0Ny/uyTj:C9XNZWI6CtKciotgEADGGPxWEVl
- TLSH T1BEE2324257E85918F6F75F30BCB986214875FCA1AD79D62D3300D5AC0C31B86EAB4B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_th.dll
- Size 31KB
- SHA256 f36f30e19a55a2194087eb6373f08a6f7ad68bf939da12c69132e346dc79242d
- MD5 e88b95b7cb9bdcc4d770cb6fa8fb292c
- SHA1 1493522b0d008256f5c53f39547e770a800ad123
- SHA512 b65dbc0a408bc38fda0e520c8c3cc5803d8b711bcf3fce684a9e9401282200c9ff4b06d296189ba8e960ba9fee009af7f8383bea8e82f16848782cd5d8e6283d
- SSDEEP 768:u49XNZWI6C1wRUkGGq2aaLxo2qQ5qDGxPxWEi6:u49XThB1wRUkGGq2aaLxoZQVPxt
- TLSH T1B6E2A47482B12B02D56BC8F0E1C48E737C2CED21DC1AC1A1A16FDD345A317A6ABF995D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_uk.dll
- Size 32KB
- SHA256 ae96fc8006b7201b041473a10c498ae4889c6eb81cdf0bee4270ca7a2745395a
- MD5 a2b1957643377100b1c777316b813438
- SHA1 1e83f73e3bd0f24ab7b41079ec22c270ec92cd65
- SHA512 e5efb0bd54e237a5b7d2bcec805aa093b71ed92ec1ebc739d1c499d1579072e065e2906b377624faac5722739d24c8694cc805f2a5f9a5d1c8ed19b793363c85
- SSDEEP 384:EM9XpDshgWIPuEQCfbgb0sS5kU40ryH5oHXmUzdkPhJzDGss4RPxh8E9VF0NyqKG:19XNZWI6CfMvoHSxDGdQPxWEQCQ7
- TLSH T1D1E2840FE6B88910F658D9315A9285E71478FF202F98C2D6724FF831282977377256DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_zh-CN.dll
- Size 25KB
- SHA256 07f5d695f61c2885f22149c5cef669c365e1086a825e0ea20cf5f49db71b3ffd
- MD5 08b03f0884831793e56960403b4e0987
- SHA1 f3ded14d42c162b5bd831bb1b7a109e6959239da
- SHA512 cf53ebcbd25f302e2e4f43eab00b8436640797b0d05a01eeb4bb0b6cae478db8f29e5191cc105d971069a816a4938467b0321c1e64aa5d4d4c4f2d1934cf9c04
- SSDEEP 384:sw9XpDshgWIPuEQCeP7KP0DGsksanPxh8E9VF0NyH5GeQ:V9XNZWI6CeTKP0DGDnPxWEx8V
- TLSH T1B9C23C0647D41C01F7BE8D31A089D9359631FD226D9186BB3144E4351EB2B83EF7ABAE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\goopdateres_zh-TW.dll
- Size 25KB
- SHA256 44fcaf1bb65cc2b6a670363341330aaebbb1f47d6b42990af20671d9f83be4be
- MD5 381d2ce762cb24b3aa67424ea6598990
- SHA1 03d4280434452da4b8116345ea183752a8db9560
- SHA512 09cadcba6ee86f4dbcfcecee4173c146c22ec78b8edb111f9665cab289ddfd448494e32c6e3e11dcf9fea2f782751f777c4bb59a96d6691d337c55d69f3ac523
- SSDEEP 384:sP9XpDshgWIPuEQCRJS6ql73inVv0WGcDGsSUsOPxh8E9VF0NyReKm:e9XNZWI6CR4l7nrcDGVUZPxWEnM
- TLSH T1E0C2290247D42C01F9AE9D3260988536C632FD222F5581A63189E4715EB2B83FF7E76E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\npDropboxUpdate3.dll
- Size 273KB
- SHA256 4275c513a038d1a3eb3f64030aabb17d2ad7fadd314f67baed452405d94938f6
- MD5 7d4353547b80786631735c397cf3b82a
- SHA1 c51f475af0e95cd56f11565cf503f2f92fe1ef78
- SHA512 5e4df0b91ef9d3a9bf9c08684d376a68c4cfcbf2a500d0e0d9f6c54aa32f777a24d4b2efe312c9db73c4819f009e3b3dad7720f4fa9932f48900e57820a09cbd
- SSDEEP 6144:WA7vNv8mV2DMQ5wnGlZEspqba7W6ue1TtJU5zZIJQ1PcS:R7B8mVQVwnGlZEyQZh3
- TLSH T1B5549D123FD58076E8B718349AA3DA526AF97D325930C84FF788884DAF71B82D935313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\psmachine.dll
- Size 211KB
- SHA256 8e7cb942bbac612139b9a23c3c88cae2f2f468b0985c5e232371ef06075bd9fd
- MD5 23b51c1f7a2a52176837de18b5ee30ad
- SHA1 cd78068f1d3101c922a9313693d0ea796f70920f
- SHA512 e3b9d18b0ec79d8c0176a595656f6b06fcaf5b1033037b6394ebdf9d064e0ad3219159aa659d6c6c3dca859e2fd0489821310f9bc08117d3cb6ded948a19fdf5
- SSDEEP 3072:xJne7kj/ktzQQET+lMk7q7SHwoBOlAl7QXrQoW3UK3833zQWH+gxY:x0C2U3T++k7YSHwoB0+sXjW304J
- TLSH T195248D1132D0C036D66F103944ABC7626BB97D306FA4C58B3798BA6D5E70786EB36393
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM1EA.tmp\psuser.dll
- Size 211KB
- SHA256 58d2cba2d3d3b35976f4f64a799d6ee35bf8f133adc6042a622b17f19edb3fb2
- MD5 ea45813115295a608fefca9601dbeef5
- SHA1 5d5d0f6162cc07fc9f06b8da6a97dde099c7f78b
- SHA512 9d2f162368005e79e0849e5378b66ae076c4dea742511880a3e4bacd55da4742683c2b7ccfc69e493e22ddf19fa437d5b1bb9987e3ec577782fc322a8b94ce79
- SSDEEP 3072:9JXe7kj/ktzQQET+lMk7q7SHwoBOlto7QXrQSW3UK3833zQWW+/xQ:9UC2U3T++k7YSHwoB02sXVW30rO
- TLSH T1C3248D0132D0C036D66F103944ABC7626BB97D306FA4C58B3798BA6D5E71786EB36393
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B
- Size 313B
- SHA256 b3491423a54fedd7211cb43f52338c9b00db27a0ff18b59893e60e9c6a32f86e
- MD5 141c2a48e165878bad2616fbded5f2f4
- SHA1 17a2eea946b9aa9cf2a614ede28b85994f118382
- SHA512 1ed58d38669ef142874e30b01e02b1b397b8d9f80a420192180f260dd372b70a6148149170f13530d942109721c24721ce40deebf68151d15d6f9c4c85255bf5
- TLSH T189E07DD362939C800CE3A4146CB1CD3D342760525193D92828308EA43A5E62FF207408
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B1C7267527E2135ED2C5C2AE13A93217_C911B16A18301CEC813C002CC8DB91D1
- Size 313B
- SHA256 38e8d59fb09dfc928967f6912e3aa2ea6e92d531c583899576f9198aab8e243a
- MD5 c05b809f44dbb37c233fc4b63397f7af
- SHA1 223a6615f9d0f52de10e59165d8ecd436bc2119c
- SHA512 6e02971dd7f4a09c2f966b598ac8c84e78a57c6bc8af7bad3f80de11c90ecc133b82a3a9fc53ba25b556be3dcfc79b83f7e457c9e4066b7705cfe7f2a360f376
- TLSH T161E026DA410A8C3292ABEAD8B8B04A7A3400476237C2602A392A43F7C447E946B0250C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B
- Size 400B
- SHA256 907f4ce84ebf080c4c5b6aa6b035adea9556e49c714fe80b3d1c2d8600e7d190
- MD5 158bd1d35784c4f1ecb07567fbdc3028
- SHA1 c50439d6f4af2af483d136b10991e71e5722a0f7
- SHA512 7fff2e804bb1674564037f92d37c18b0ab99791db247df3778ace48ec2f193353788f1f7662fc6d41bd6d486c9f297452c3ec167e27437e95befdc7e818eaf29
- TLSH T13FE0C0303BEB012CF1747AB486E58DB8426EE22A4904CB750BD004056A07B41DD31932
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B1C7267527E2135ED2C5C2AE13A93217_C911B16A18301CEC813C002CC8DB91D1
- Size 412B
- SHA256 65697f8528e364508231a65390acf73546a8c87aa971a4e861522c86447a41ce
- MD5 d2c14c6c74834d8a7b56a7da4ece1803
- SHA1 0ea9b1887b1505b3be4ccefbd08d1f9babcd6423
- SHA512 a6322c3b93c92533cb77c49cabb2d8f127aa8f2cf9fa61667a6c2bdd10ae868ff59f4d07461036ac27b27ff6f17297f9fabf1da857242c01dea4764735bd3c09
- TLSH T12EE0C02822FE411CF5B3FD7487D464F409ACE05A054243B22FB013046726B009C21ABA
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
- Size 924B
- SHA256 0af2923f8a81a045c67f6583ddfa54f9739e177ffb045a089bb1935999ce75e0
- MD5 d435bfc7a0901a52024bb4d51516ec64
- SHA1 1b05fc2473fdb28a95e75ea59d7ddddd6aa1fdef
- SHA512 62be619e7f59563bbe445c26d90d7a0a6e6edf95a6d48007393df0dcc68c5f2d8714db6a67222cc9e60a1c13c6752258bf3531478cb4610cb0d0c50608fb82d9
- TLSH T13211295177FA4124F6F77F712AB01995467BBC22BE30C64C1111454E4CB7A90C9B0B23
- MD5 SHA1 SHA512 TLSH