Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 09:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe
- Size 770KB
- Sample260730-ll3azsvera
- SHA256 d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b
- MD5 2cfa7afaae594d6c8c2444ffacf706a7
- SHA1 81fcec20bb9d008530b5e12aa1b0a9988b24296e
- SHA512 71feb354f1bd995dae787070da6948bd195e24abe1ada413d27a911f31f86184839ba7356b3b52894f22724969ca8717405a38a6760e3dcf0695f3e2d31bdfa5
- SSDEEP 24576:O7eit0t9EsyC1XS64DbvYwdzv1n4WwwS6u3sK:O7eimfEsr1X/4wwbn4Wpi
- TLSH T1DFF402D1E5B54CA2F0F70E7D90AA91718ABFB85EF971818E2B84085D0A33DD38E147D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe DropboxUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe\DisableExceptionChainValidation = "0" DropboxUpdate.exe - Executes dropped EXE 11 IoCs
pid Process 5580 DropboxUpdate.exe 2432 DropboxUpdate.exe 4652 DropboxUpdate.exe 4240 DropboxUpdate.exe 4880 DropboxUpdate.exe 4972 DropboxUpdate.exe 4576 DropboxUpdate.exe 2316 DropboxUpdate.exe 1124 DropboxUpdate.exe 1280 DropboxUpdate.exe 4800 DropboxUpdate.exe - Loads dropped DLL 21 IoCs
pid Process 5580 DropboxUpdate.exe 2432 DropboxUpdate.exe 4652 DropboxUpdate.exe 4240 DropboxUpdate.exe 4880 DropboxUpdate.exe 4880 DropboxUpdate.exe 4880 DropboxUpdate.exe 4880 DropboxUpdate.exe 5580 DropboxUpdate.exe 4972 DropboxUpdate.exe 4576 DropboxUpdate.exe 2316 DropboxUpdate.exe 2316 DropboxUpdate.exe 4576 DropboxUpdate.exe 1124 DropboxUpdate.exe 5580 DropboxUpdate.exe 1280 DropboxUpdate.exe 1280 DropboxUpdate.exe 1280 DropboxUpdate.exe 1280 DropboxUpdate.exe 4800 DropboxUpdate.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 3 2340 msiexec.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DropboxUpdate.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DropboxUpdate.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
description ioc Process Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe\DisableExceptionChainValidation DropboxUpdate.exe - Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B1C7267527E2135ED2C5C2AE13A93217_C911B16A18301CEC813C002CC8DB91D1 DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B DropboxUpdate.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B1C7267527E2135ED2C5C2AE13A93217_C911B16A18301CEC813C002CC8DB91D1 DropboxUpdate.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\DropboxUpdate.exe DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_id.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_ko.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_uk.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\DropboxUpdateOnDemand.exe DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_ko.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_pl.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File opened for modification C:\Program Files (x86)\Dropbox\Temp\GUT6F8A.tmp d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\DropboxUpdateBroker.exe d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_en.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_es-419.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\DropboxUpdateOnDemand.exe d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_es.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_ms.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_no.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_zh-TW.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\@PaxHeader d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_ja.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_nl.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_ru.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\npDropboxUpdate3.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdate.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_es.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_sv.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_da.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_it.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_zh-CN.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_zh-TW.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_fr.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_ja.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\psuser.dll DropboxUpdate.exe File opened for modification C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\@PaxHeader d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\DropboxCrashHandler.exe d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_th.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_pl.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_th.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_fr.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_it.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_zh-CN.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_ms.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_nl.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_ru.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\DropboxUpdate.exe d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_es-419.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\psmachine.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\DropboxUpdateBroker.exe DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_de.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdate.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_pt-BR.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\DropboxCleanup.exe DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_en.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\goopdateres_de.dll DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\npDropboxUpdate3.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\psuser.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\DropboxCleanup.exe d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Update\1.3.761.1\DropboxUpdateHelper.msi DropboxUpdate.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\DropboxUpdateHelper.msi d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\psmachine.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_da.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_id.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_no.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_pt-BR.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe File created C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_uk.dll d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe - Drops file in Windows directory 18 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI80AF.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFEF94DE6514D4613A.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF367AB6C764BBC065.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF696817A4EDBA51D2.TMP msiexec.exe File created C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job DropboxUpdate.exe File created C:\Windows\Installer\e597cf6.msi msiexec.exe File opened for modification C:\Windows\Installer\e597cf6.msi msiexec.exe File created C:\Windows\Installer\SourceHash{099218A5-A723-43DC-8DB5-6173656A1E94} msiexec.exe File created C:\Windows\SystemTemp\~DF228313DFD97836AD.TMP msiexec.exe File created C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job DropboxUpdate.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\e597cfa.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI6C39.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF2D0C24D2127FE177.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF0D56C685ED09594B.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFC656409D92F0EA60.TMP msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DropboxUpdate.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4972 DropboxUpdate.exe 1124 DropboxUpdate.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\CLSID = "{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}" DropboxUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\Policy = "3" DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5} DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5} DropboxUpdate.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E DropboxUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" DropboxUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" DropboxUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B35122D2-0036-4536-AEEA-EEA68E54A460}\NumMethods\ = "4" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachineFallback\CurVer\ = "DropboxUpdate.Update3WebMachineFallback.1.0" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoCreateAsync\CurVer DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Dropbox.OneClickProcessLauncherMachine\CurVer\ = "Dropbox.OneClickProcessLauncherMachine.1.0" DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachine.1.0 DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3COMClassService\CurVer DropboxUpdate.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\Clients = 3a0000000000 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.ProcessLauncher\CurVer DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EF028154-CA20-4F73-ACBB-82451B78F1E6}\NumMethods\ = "6" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C416C376-AEC5-4443-9D90-BEBA9434763B}\ProxyStubClsid32\ = "{AF00043F-18CA-495E-95D8-EADBC89BE365}" DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9614AA6E-82BE-4E1C-A68F-C7DFDAB2FEE8} DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachine.1.0\CLSID\ = "{04F3B937-6C9D-4DAC-9477-8C35E24B25D1}" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A496C5D9-84FE-4E84-9D20-7481589E1C23}\VersionIndependentProgID DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E396485-96EB-4906-B2C5-3E0F1E7748C3}\VersionIndependentProgID\ = "DropboxUpdate.CoreMachineClass" DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E38012B-D35D-4278-BBFD-E5AC871D3E60} DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04F3B937-6C9D-4DAC-9477-8C35E24B25D1}\LocalServer32 DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{96D1EED3-701E-4FE5-B996-A543A8465897}\VersionIndependentProgID DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreMachineClass\CurVer DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62} DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebSvc.1.0\CLSID\ = "{E58F67C2-BC84-4C7C-AC35-4FFBB25A47E6}" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76E258F0-DE86-4CEC-9D30-3F728A898741}\VersionIndependentProgID DropboxUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E54806CB-0046-4BCF-B389-3A6F732DC6E6}\Elevation\Enabled = "1" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04F3B937-6C9D-4DAC-9477-8C35E24B25D1}\Elevation\IconReference = "@C:\\Program Files (x86)\\Dropbox\\Update\\1.3.761.1\\goopdate.dll,-1004" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachineFallback.1.0 DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachine\CurVer DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CredentialDialogMachine.1.0 DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreClass\CLSID DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3COMClassService\CurVer DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassSvc\CLSID\ = "{76E258F0-DE86-4CEC-9D30-3F728A898741}" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E54806CB-0046-4BCF-B389-3A6F732DC6E6} DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E54806CB-0046-4BCF-B389-3A6F732DC6E6}\LocalServer32\ = "\"C:\\Program Files (x86)\\Dropbox\\Update\\1.3.761.1\\DropboxUpdateBroker.exe\"" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3363994D-A786-4A32-A745-48B9B6EA709A}\VersionIndependentProgID\ = "DropboxUpdate.ProcessLauncher" DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachineFallback.1.0\CLSID DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebSvc.1.0 DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}\Elevation DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AF89161-A408-4DFD-9DE2-3C3B7BDB14E2}\LocalServer32 DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60ACA18E-54E6-43F8-A1A4-C4176B6C994E} DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76E258F0-DE86-4CEC-9D30-3F728A898741}\ = "Dropbox Update Legacy On Demand" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D8474489-B2C1-4CE8-852D-FF8A916C91F0}\ProxyStubClsid32 DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DropboxUpdate.exe\AppID = "{76E258F0-DE86-4CEC-9D30-3F728A898741}" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05378308-2559-4C71-B758-7DACD5A359BA}\NumMethods\ = "6" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoCreateAsync\CLSID DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62} DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8EEF2D6E-1CE5-4823-88D0-7F727719D0A2}\NumMethods DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachine\CLSID DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5A812990327ACD34D85B163756A6E149 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC2E189E-C306-4710-BBCC-A8968ACAEB2E}\ProxyStubClsid32 DropboxUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CredentialDialogMachine.1.0 DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C416C376-AEC5-4443-9D90-BEBA9434763B}\ProxyStubClsid32 DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF00043F-18CA-495E-95D8-EADBC89BE365} DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C416C376-AEC5-4443-9D90-BEBA9434763B}\NumMethods DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60ACA18E-54E6-43F8-A1A4-C4176B6C994E}\ProxyStubClsid32 DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CECD4BFB-9F43-4540-B72C-706BE66B375E} DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A496C5D9-84FE-4E84-9D20-7481589E1C23}\VersionIndependentProgID\ = "DropboxUpdate.CoCreateAsync" DropboxUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4AF89161-A408-4DFD-9DE2-3C3B7BDB14E2}\ProgID DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B8158CAB-1B7C-4A15-860E-AAA364E77334}\ = "IAppVersionWeb" DropboxUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3COMClassService\CurVer\ = "DropboxUpdate.Update3COMClassService.1.0" DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FDA8FC46-0F9A-4A8C-8764-3B80880A9AEB} DropboxUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EF028154-CA20-4F73-ACBB-82451B78F1E6}\NumMethods DropboxUpdate.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 5580 DropboxUpdate.exe 5580 DropboxUpdate.exe 2340 msiexec.exe 2340 msiexec.exe 1124 DropboxUpdate.exe 1124 DropboxUpdate.exe 5580 DropboxUpdate.exe 5580 DropboxUpdate.exe 5580 DropboxUpdate.exe 5580 DropboxUpdate.exe 5580 DropboxUpdate.exe 5580 DropboxUpdate.exe 2340 msiexec.exe 2340 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5580 DropboxUpdate.exe Token: SeShutdownPrivilege 5580 DropboxUpdate.exe Token: SeIncreaseQuotaPrivilege 5580 DropboxUpdate.exe Token: SeSecurityPrivilege 2340 msiexec.exe Token: SeCreateTokenPrivilege 5580 DropboxUpdate.exe Token: SeAssignPrimaryTokenPrivilege 5580 DropboxUpdate.exe Token: SeLockMemoryPrivilege 5580 DropboxUpdate.exe Token: SeIncreaseQuotaPrivilege 5580 DropboxUpdate.exe Token: SeMachineAccountPrivilege 5580 DropboxUpdate.exe Token: SeTcbPrivilege 5580 DropboxUpdate.exe Token: SeSecurityPrivilege 5580 DropboxUpdate.exe Token: SeTakeOwnershipPrivilege 5580 DropboxUpdate.exe Token: SeLoadDriverPrivilege 5580 DropboxUpdate.exe Token: SeSystemProfilePrivilege 5580 DropboxUpdate.exe Token: SeSystemtimePrivilege 5580 DropboxUpdate.exe Token: SeProfSingleProcessPrivilege 5580 DropboxUpdate.exe Token: SeIncBasePriorityPrivilege 5580 DropboxUpdate.exe Token: SeCreatePagefilePrivilege 5580 DropboxUpdate.exe Token: SeCreatePermanentPrivilege 5580 DropboxUpdate.exe Token: SeBackupPrivilege 5580 DropboxUpdate.exe Token: SeRestorePrivilege 5580 DropboxUpdate.exe Token: SeShutdownPrivilege 5580 DropboxUpdate.exe Token: SeDebugPrivilege 5580 DropboxUpdate.exe Token: SeAuditPrivilege 5580 DropboxUpdate.exe Token: SeSystemEnvironmentPrivilege 5580 DropboxUpdate.exe Token: SeChangeNotifyPrivilege 5580 DropboxUpdate.exe Token: SeRemoteShutdownPrivilege 5580 DropboxUpdate.exe Token: SeUndockPrivilege 5580 DropboxUpdate.exe Token: SeSyncAgentPrivilege 5580 DropboxUpdate.exe Token: SeEnableDelegationPrivilege 5580 DropboxUpdate.exe Token: SeManageVolumePrivilege 5580 DropboxUpdate.exe Token: SeImpersonatePrivilege 5580 DropboxUpdate.exe Token: SeCreateGlobalPrivilege 5580 DropboxUpdate.exe Token: SeRestorePrivilege 2340 msiexec.exe Token: SeTakeOwnershipPrivilege 2340 msiexec.exe Token: SeRestorePrivilege 2340 msiexec.exe Token: SeTakeOwnershipPrivilege 2340 msiexec.exe Token: SeRestorePrivilege 2340 msiexec.exe Token: SeTakeOwnershipPrivilege 2340 msiexec.exe Token: SeRestorePrivilege 2340 msiexec.exe Token: SeTakeOwnershipPrivilege 2340 msiexec.exe Token: SeRestorePrivilege 2340 msiexec.exe Token: SeTakeOwnershipPrivilege 2340 msiexec.exe Token: SeRestorePrivilege 2340 msiexec.exe Token: SeTakeOwnershipPrivilege 2340 msiexec.exe Token: SeRestorePrivilege 2340 msiexec.exe Token: SeTakeOwnershipPrivilege 2340 msiexec.exe Token: SeRestorePrivilege 2340 msiexec.exe Token: SeTakeOwnershipPrivilege 2340 msiexec.exe Token: SeRestorePrivilege 2340 msiexec.exe Token: SeTakeOwnershipPrivilege 2340 msiexec.exe Token: SeRestorePrivilege 2340 msiexec.exe Token: SeTakeOwnershipPrivilege 2340 msiexec.exe Token: SeRestorePrivilege 2340 msiexec.exe Token: SeTakeOwnershipPrivilege 2340 msiexec.exe Token: SeRestorePrivilege 2340 msiexec.exe Token: SeTakeOwnershipPrivilege 2340 msiexec.exe Token: SeRestorePrivilege 2340 msiexec.exe Token: SeTakeOwnershipPrivilege 2340 msiexec.exe Token: SeRestorePrivilege 2340 msiexec.exe Token: SeTakeOwnershipPrivilege 2340 msiexec.exe Token: SeRestorePrivilege 2340 msiexec.exe Token: SeTakeOwnershipPrivilege 2340 msiexec.exe Token: SeRestorePrivilege 2340 msiexec.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2340 msiexec.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4492 wrote to memory of 5580 4492 d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe 89 PID 5580 wrote to memory of 2432 5580 DropboxUpdate.exe 90 PID 5580 wrote to memory of 4880 5580 DropboxUpdate.exe 96 PID 5580 wrote to memory of 4972 5580 DropboxUpdate.exe 97 PID 5580 wrote to memory of 4576 5580 DropboxUpdate.exe 98 PID 2316 wrote to memory of 1124 2316 DropboxUpdate.exe 101 PID 5580 wrote to memory of 1280 5580 DropboxUpdate.exe 102 PID 5580 wrote to memory of 4800 5580 DropboxUpdate.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe"C:\Users\Admin\AppData\Local\Temp\d6f545d90cbca695052070d57134d96afa25296520c522855a6bac697240730b.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\DropboxUpdate.exe" /installsource taggedmi /install "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&experiments=buildid%3Dmain%7CThu%2C%2031%20Dec%202099%2023%3A59%3A59%20GMT&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjplZGdlOjplSndOeTgwS3dqQU1BT0JYR1RtTE5GbWFaQjVWR0lqNEE0SjZHZzRMbGtrSDY0YWctTzc2M2I4UDNLYngwWXg5RnhJc0NxZ1B5eW5VdzRrdjhaazJ3M21McXpidnJtMFhqN0otdmZkekZETXZRbVl3S3lDSG5HT2ZtbmpfWl9RcVphbEc0cnl3aUdNMkpGTGppckZ5UkU1VnZ6X3lleUFoQE1FVEEifQ"2⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Indicator Removal: Clear Persistence
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regsvc3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2432
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regserver3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:4880
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcGxaR2RsT2pwbFNuZE9lVGd3UzNkcVFVMUJUMEpZUjFSdFRFNUdiV0ZhUWpWV1IwbHFORUUwU2paSFp6Uk1iR3RyU0RZMFlXY3RUemMyTTJJNFVETkxZbmd3V1hnNVJuaEpjME54WjFCNWVXNVZkelJyZGpoYWF6SjNNMjFNY1hwaWRuSnRNRmhxTjBvdGRtWmtla1pFVFhaUmJWbDNTM2xEU0c1SFQyWnRibXBmV2w5UmNWcGhiRWMwY25sM2FVZE5Na3BHVEdwcGNrWjVVa1UxVm5aNlgzbGxlVUZvUUUxRlZFRWlmUSIgcHJvdG9jb2w9IjMuMCIgdmVyc2lvbj0iMS4zLjc2MS4xIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0MyMjNFNjE3LTZERjItNDJERC1CRERGLUY2QzkxMDE0NTIwNH0iIHVzZXJpZD0iezU5RTQ2RTg3LTlCNkEtNDIzNS1BMjVGLTUyOUREN0IxODFBM30iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9Ins3NDdGQjM3Ni04NEVELTQ4OTAtOEM0Mi0wRkE3RUEzOTBBQTl9Ij48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yNjEwMC4xNzQyIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RDg5NjhGRjItRTBCMS00QTEzLUEzRTItQzlGMjk5NUYzQkM2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjc2MS4xIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4972
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /handoff "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&experiments=buildid%3Dmain%7CThu%2C%2031%20Dec%202099%2023%3A59%3A59%20GMT&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjplZGdlOjplSndOeTgwS3dqQU1BT0JYR1RtTE5GbWFaQjVWR0lqNEE0SjZHZzRMbGtrSDY0YWctTzc2M2I4UDNLYngwWXg5RnhJc0NxZ1B5eW5VdzRrdjhaazJ3M21McXpidnJtMFhqN0otdmZkekZETXZRbVl3S3lDSG5HT2ZtbmpfWl9RcVphbEc0cnl3aUdNMkpGTGppckZ5UkU1VnZ6X3lleUFoQE1FVEEifQ&nolaunch=0" /installsource taggedmi /sessionid "{C223E617-6DF2-42DD-BDDF-F6C910145204}"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4576
-
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /unregserver3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:1280
-
-
C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\DropboxUpdate.exe" /unregsvc3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4800
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2340
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:4652
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /medsvc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:4240
-
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcGxaR2RsT2pwbFNuZE9lVGd3UzNkcVFVMUJUMEpZUjFSdFRFNUdiV0ZhUWpWV1IwbHFORUUwU2paSFp6Uk1iR3RyU0RZMFlXY3RUemMyTTJJNFVETkxZbmd3V1hnNVJuaEpjME54WjFCNWVXNVZkelJyZGpoYWF6SjNNMjFNY1hwaWRuSnRNRmhxTjBvdGRtWmtla1pFVFhaUmJWbDNTM2xEU0c1SFQyWnRibXBmV2w5UmNWcGhiRWMwY25sM2FVZE5Na3BHVEdwcGNrWjVVa1UxVm5aNlgzbGxlVUZvUUUxRlZFRWlMQ0p5WlhGMVpYTjBYM05sY1hWbGJtTmxJam93ZlEiIHByb3RvY29sPSIzLjAiIHZlcnNpb249IjEuMy43NjEuMSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntDMjIzRTYxNy02REYyLTQyREQtQkRERi1GNkM5MTAxNDUyMDR9IiB1c2VyaWQ9Ins1OUU0NkU4Ny05QjZBLTQyMzUtQTI1Ri01MjlERDdCMTgxQTN9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgcmVxdWVzdGlkPSJ7RTcxNUQ3RDItQzE0QS00QzhELThBNkYtRTRGM0IwRkZGMTRDfSI-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0ie0NDNDYwODBFLTRDMzMtNDk4MS04NTlBLUJCQTJGNzgwRjMxRX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImJ1aWxkaWQ9bWFpbnxUaHUsIDMxIERlYyAyMDk5IDIzOjU5OjU5IEdNVCIgaW5zdGFsbGFnZT0iLTEiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDEyODc5IiBleHRyYWNvZGUxPSIyNjg0MzU0NTkiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1124
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e597cf9.rbs
- Size 7KB
- SHA256 3a56820b5351116ac81db8cf8b905573fd579094b15a47f73d07a142aec6918d
- MD5 17763b446522ae1712115195adc67db1
- SHA1 06b11cd8c1f7664d33281c999baf95a04fd3f3ee
- SHA512 5913498ca1f1b8804b1d4813e0ceb823edcd6358aacdd1d010f4b6f2296407dcc7e9bc610a47c1c4e04072fcef12ba702249c86f2fcf1192a1d6317c47c757aa
- SSDEEP 96:48nGylACHJ3pU4bCsThqCmU4bC6jeKTq+EThq4HtY5HVWM1Cq7CUsljeKR1Yy:pnaCpi4mIX4mxKswPUUsIKN
- TLSH T1FFF10F41B640C2E2F8DB1B7CD71317523BB3D7C5A341634B48CD86328F977896E5A29A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e597cfd.rbs
- Size 7KB
- SHA256 07de931cbb9b04ce1bdbdf0352396a2e4d2b585bcae72d50980af34685df52fc
- MD5 f19a8cc20be93e44b843413a62b4b30e
- SHA1 7afa404d3672449df2bac48ed384b1f0050ddc02
- SHA512 fc43254a57f320982802faafac0868fdf3bb93a4848ed6c84c5c0357c3258b62f7ae7644b12e1860b5b5fec038d44fdea26a003127365e60d1f3f51a89b921b0
- SSDEEP 96:JnHlx+G8RM3Ox498RC3OCjewC8q+c+14JyqhIdjewbdr59ITdyia:JnQRkO9R2OZnh1Io+
- TLSH T1C5E10041A640C2E3FDEB1F3CD72317613BE3D789A309434740CD55728B9A7896EAE296
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\@PaxHeader
- Size 28B
- SHA256 a81b39c9c01107622858893f7ad60426df9c6028b60fcb17d35331e9a62ac9bf
- MD5 a5501e155ddaed0eef5d38bf800314c4
- SHA1 7249e2e5a870a1c505ef40a3f000b7a2caf0071e
- SHA512 9dfdf8e51306ff0abe112fd10c3cdc4681dd4871b3eb25c0cb0aa550aa3382bd8e20e54a9b0fa311a8c7576c99b4daa859775697fffb956e579b7598b0a387f9
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\DropboxCleanup.exe
- Size 299KB
- SHA256 0d9c6de8a57443bffe718d3256fdd467b8970124ba65d8accb6f47dc54d46d72
- MD5 8fa7f9a62ea19f3691e8a24833a5bc25
- SHA1 23f0825ce2f4731cc73e82ca814872b512d333dd
- SHA512 3d8243c4a42f96d549b09797f39b0f2fbef54d643ee4048c24eb6a1b748ef07ecd6bfdc142fe4c13838b0c07957b5e558ebf98fb7bdcc841d49fcff0a06eccf4
- SSDEEP 6144:4b/v8TwC+G634GKoC9U3+VEH3Z9E4argvgvv+AOFcmFdNH3P:4b/4+G634GKH9U3ZDqWw4NH3P
- TLSH T148547DD0B551CC72F4F31432183CAB7655AEB528FB6146DB63940A2DCE336C39E31AA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\DropboxCrashHandler.exe
- Size 129KB
- SHA256 02618e6399ae8e99df5a4f523239451e5a5d23a8c80ea5afeecfeb29de4be4a7
- MD5 4d0ccec5560d013004c6143a8b46b4fd
- SHA1 4881c84035d327999e156555233b85e2d5e252b0
- SHA512 f2f5c6784f100a933328b8c2a403c233e42f81ee339c189c088afbb48f3e73a2bea2500e69e88ac6ddd0c27204eaf91811c6b35bd3d42ca67288cede6cb62f3b
- SSDEEP 3072:9ZOOxLE4GTnZcyg2QltfW8cEzeIKnOZnLtFXsq/JVKjEWclhxu:uOxLEbTzKz0
- TLSH T181D3C5C1F5B84CB9F4F359391429867295BFB83CFA32865E2994015D0E23DC38E257E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\DropboxUpdate.exe
- Size 127KB
- SHA256 7655221b493047c61285e1de78807d0584920b0d14d150e2487da9728b1926f3
- MD5 8ad76e0b347bb690697535ce95b1c656
- SHA1 10d2622a3965d21215a953ed924d01788a9805ed
- SHA512 35fbda7f05865b3a50454dba5ba3738eb8a5fd6d2eea5e9415d8d517811d51c50cca6c7b47a5b19f1ff1f4101567137fe18805f4f740289456da1ff2af682504
- SSDEEP 3072:SvZOOxLE4GTnQcyL2QltfWLgo/iE+DiV7X5pbwmjNBOfoXcz:SwOxLEbTQXLz
- TLSH T1EDD3C5C1F6B84CB9F4F35A390429867295BFB93DF922864E2994015D0E23DC38E257E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\DropboxUpdateBroker.exe
- Size 75KB
- SHA256 244584df7838f51b0125dbdc8ece45c3f734c281afe26ced86bc1d11f187d416
- MD5 4d3a85b133ad6bc102c7849638ae5e6f
- SHA1 5a065bb75c30a6e4b0988cb8aec9cb7e863a2ed9
- SHA512 8800ec0d2a6aa4f068dbffb90c3f0e966a0836e5a3c4d2590707653ca8cbfa04b33bccb4a99d94f3a92b8c184b1b5f0d755aa732fb5e1c9486f67ba3534688d5
- SSDEEP 768:SsbwKvIIfEr5EJFQp18EMUpVP2R6lkxSXBNQlhgtfWdIyyDGa5PxWEux:Ssbwk6WQfAUDPPZQlhgtfWulPx8
- TLSH T15173D3D1E4708CF2F0F75D7C206C96726AEFB51DF6A08046365852AD4B63EC35E292CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\DropboxUpdateHelper.msi
- Size 26KB
- SHA256 3af0421ca92962c0154145dc06a223bfecc59a58966d860d232703a32d08a820
- MD5 fb467307098a998d3836ca8b87157a4a
- SHA1 c3733d4f6e14198f3e7125bdd71f7cdc1115a793
- SHA512 851c2919cfda7e38325ce7ad1bb3f4b129e1508da65c7592ec53f4854ec012d925464bc52597c3ce0591e829347e56ecfe3f1ea6fa7f10f825ce6e6317831fa9
- SSDEEP 384:Ax5Pey3M5IC0ioXvsSkAohDGsjPxh8E9VF0NyhaLwetYoXNXYpkuL43/:EeWMmCEsXDGiPxWErB2dYp7A
- TLSH T1CDC23A1776005932E8464F3165AAC3B58B35BD459F97405332ABF39C2FB2BC176BA2E0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\DropboxUpdateOnDemand.exe
- Size 75KB
- SHA256 7a016aeb36269947e4961cc030d857557d14e1e954d10bdf6a264f992b647d45
- MD5 934bc0439cc3b11c2d6d9031119326b2
- SHA1 64f3eb19c1ddc3d07da2f868be54a70adcd83455
- SHA512 e0e279d0e68d1c6e2abdd673baa24ad1ce5cf2743f9ac3515687551aaec14407909fc79d439d58d86e4347182b16c7e1a8bfa00216b330cbbd721a8b75633ef4
- SSDEEP 768:gJb4KvIIfEr5EJFQp18EMUpVP2e6lTxSXBNQ2hgtfWdIy5DGXPxWEnhI:gJb4k6WQfAUDPMgQ2hgtfWuxPxDI
- TLSH T12273E4D1E4708CF2F0F75D7C206C96726AEFB51DF6A04046365852AD4B63EC36E292CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdate.dll
- Size 1.1MB
- SHA256 cc4e06440aaa7d81abb2b8935343f6f3c0b5736c1a20bfb53b0af0b41c49b7bf
- MD5 8cef863dae49754afb4e31853341aa4f
- SHA1 379825bd7d7305eaac49c61fbb553b515cd79f6b
- SHA512 4ba532692cfa675791e329fe665dcbb078a6df7002a8b4a5e2940028ec004e594b25e387a55f0b372a7a939d4c558faceb2e9d7c79e264f2b1609bccf1626bf7
- SSDEEP 24576:juaLeU1ejhl3BGNOM3H4LWpQjRnPQ0eeUXQlFVOVvk:juaLeU1edlxGR4LWpcRo02XQlFV6k
- TLSH T116354BD237E18834F9FB0A38E57AA675ADBE7961F930C50E4750891E19736C2CC3A712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_da.dll
- Size 32KB
- SHA256 1f117457bff89326e78d3bfe7dc2dce747211377c2e31fdbabd7e167905074c8
- MD5 c1289300556d83492daa4f52a65139eb
- SHA1 44d408489dc076ba4319f4a4b54d45ab267d5429
- SHA512 feee885575a91381635e2745f93e885454d8c85fb781462898318e3293a33d0be92d2885b0ae89fc4ad6215d88afa45b6e5ee991aadbf09f84af083a90c81b66
- SSDEEP 384:ae9XpDshgWIPuEQCkuvL51kw9J+BTyDGsDKPxh8E9VF0NytSf:J9XNZWI6CkIV+MDGIKPxWEXK
- TLSH T1C8E2405257F85A18F6FB2F30BCB981604975FC92AD38D62D3244906C0D72786EAB4B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_de.dll
- Size 35KB
- SHA256 4bb880b2382a38c928fabf2d8e6540343a01942a97a889811e04052a7f1b71c5
- MD5 c521b614d63ec286b5c4a0e156910cf1
- SHA1 292c175d80940682072bf95ab1a6b9d7f52618da
- SHA512 16b1a19edc03e1e2d42c091b60705ed4d09ce940379a211ec4ed350430998fa074653dabdafb3e1d27e8f4cd5cc5392f63c51740e6b053f8030066fd836a87f7
- SSDEEP 384:xho9XpDshgWIPuEQCf6w+1KfK9Y3uLSDp0DGsP/GPxh8E9VF0NynhyM:Y9XNZWI6Cfh+1KfK9YpV0DGAGPxWEhwM
- TLSH T1E7F23E4147E85918F2F76F30BD7882654E72FCE2AD75D96E2300A06C1871B45EAB8B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_en.dll
- Size 31KB
- SHA256 73fe9b8c32d0545908852ac342b20bdbdeccc11450ec43361027470f5e398c11
- MD5 fb58b2bcb59b4bcdc4b2142738bebec6
- SHA1 c6f7bd3777bb869ea02ce83775a3b5565e76f99e
- SHA512 2798f2d7b832ba3f1ef18ef11315401cdcb9d1e519bb56dc836a7519c0f9ca75a68e3491500a0a43dcf595ce3877efec13992a381004b5816ee9c9403159518d
- SSDEEP 384:bT9XpDshgWIPuEQCYUfagyyyRJLQDGsb6Pxh8E9VF0NyVXs:/9XNZWI6CYKagyySJ0DGrPxWEj8
- TLSH T1FCE24E4287F81918F6FB6F30B9B895604D35BC52AD38C66D3240D42D5972B82EEB4B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_es-419.dll
- Size 33KB
- SHA256 33c14929455ea3407eac56f69fe139c4808af89b8c4f53c2f2d56f7ce13fc774
- MD5 06ae1601082b29d493dbb8731fac371f
- SHA1 8722c25e4846fb8733ad1fc684c47b18d7e07bac
- SHA512 67ec944daeeab6e76f37391d88cbffbf4469587f6692d8094636260b3ad46a6eeba1ee29094f47e747ee38b4d875bb4260d523e9e28dafba9018aa4112852db8
- SSDEEP 384:9VW59XpDshgWIPuEQC/BAO/yedz9ykDGstPxh8E9VF0NyLDHYhy:9O9XNZWI6C/B//lzwkDGCPxWEJ4hy
- TLSH T195F21B004BF86A46F6F77F30A87856654E3ABC92AC39C55D2200952D0D71F85EEB8B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_es.dll
- Size 33KB
- SHA256 b38ba975563441ad456949a97602d95a6ad0cb277806c56e5a84122fcbd01fbe
- MD5 cbd733f6f431980bbded51780f807a4f
- SHA1 5fdbd3ba5cd93357807b7b2147df87359c6fd8c4
- SHA512 b0e7d1388f3ce70a168809b4b73a16032bca599796643ca94e04600ef736f4de2b3a5ff18c6c01cdfeb30526811e28a66a3ae5f0ba38e9bb9d7d4905653ff32a
- SSDEEP 384:rE9XpDshgWIPuEQCblD7LLWS27adtFDGsZdBPxh8E9VF0NyYxd6S:o9XNZWI6CblnL/27avFDGeBPxWESb6S
- TLSH T143E22D108BF92A46F6F76F34B87851654D3ABD62AC38C65D2210912D0D71F81EEB8B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_fr.dll
- Size 34KB
- SHA256 edd23030a7f718224168ba619b96519fe13171d7039805304e9e68bdaf53327f
- MD5 d6c2a3a4680bbfa54c8fd105db5f6071
- SHA1 adbf86ebba0d83302c8bf2cd9d07a5a4ba310dc6
- SHA512 335efc531479d0a88d377a0c4ec3025d71e0b3c764042737cc5f3fe6aa01bc6a8b089299f4719889de27eadf58a845da654d0fc5720d42550e5366a0b7f05fad
- SSDEEP 384:AR9XpDshgWIPuEQCDxFdPtF0IK9qMhGxFDGs6kPxh8E9VF0NyO6tc:A9XNZWI6CDPdPts9wHDG/kPxWEw0c
- TLSH T1F9F2F91297E85A01F6FB7F31B8B981204E3ABC9A9D35C52D2241D09D1D31B41EEB8B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_id.dll
- Size 31KB
- SHA256 e91dc5fedc46d162e4af252974dd6d3ecc20c4f8133cfe8a934627435b09203f
- MD5 7aaaf7daa74593d3f4f26bacbd87ae1e
- SHA1 b49641ba3a3690567e7eeacc4683c893f9672c2f
- SHA512 27c11bef4e3b420b7931de7f4a35761f8fa31fb38bbf192feece6b56b0f0abf8d59303abe4f69bc0d43c01f8b9d7720251325ef331b76fd881ec683b7625f350
- SSDEEP 384:Nj9XpDshgWIPuEQCD+1HDWq6elDoWoRncvCPHlU6jKDGsXEPxh8E9VF0NyLzG:19XNZWI6CDUbEvu9DGMEPxWERC
- TLSH T1C9E23C9143E86908FAFB8F3065B856640A37FC63BD34826D3344A5285D727C2EE35B76
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_it.dll
- Size 33KB
- SHA256 30de5ef5d420fa72c80ceccedefb1c74e4b13ab3ceae05086244600c4370dd2f
- MD5 e4be28c214d66ff84d507d2ddaa41a68
- SHA1 5f7043e2c373144ae5aa8ff295c050455ba5b54a
- SHA512 df59b8e9ae09c2fe47d1b951c164c4b539c39ca033931c770b8f2aaa638522a874b1af7934eda8d3d286a4f6bcd01e1f1c00b0a06629d74f4bc4b962f000e4e9
- SSDEEP 384:339XpDshgWIPuEQCRO4Qr0mhz48sOVpEDGskH/Pxh8E9VF0NyFV+n:n9XNZWI6CRGr0mhzICSDGvfPxWE/8n
- TLSH T1D9F2721157F82A04F6F77F30B83896694D36FD52AD39C62E2241D45C0932A91EEB4B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_ja.dll
- Size 27KB
- SHA256 b9a6bd0e5e6532f5f0ee4d625d13bf820674e487fbdf9c3f090072aa34ed3bf7
- MD5 14f49d411f86f6f73d4ba696800d5280
- SHA1 c681a09a04cbc3e7ae9b69066d803fea2c06364c
- SHA512 47b87103391bf5f00c5187050b99410dc6d4211ab573942e1177e844c7753ddb381450da7a2214ae3052a3837667ad7cb3e019c0d2ee0a65314c25c49cd96d0f
- SSDEEP 384:lML9XpDshgWIPuEQCrM29uttlSa/9sW0DGs+Pxh8E9VF0NymW2H:k9XNZWI6CrvyOW0DGDPxWE4T
- TLSH T1DED23A4957E08C0AF5FACE319094A5381A38FC32ADD24D623140E41A1D71BC7AB67FBE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_ko.dll
- Size 27KB
- SHA256 ee343316f429686295fd62c66e3bee4b006760e6d4b1841f3a3d70b0765b8f76
- MD5 3c648323082d51a2aa0beb8d4b068d99
- SHA1 8b232373b3b8f5c122cdea4259220b21f9b47c25
- SHA512 26be89433ce1591564fb8688e0bf648df6053eac979f1d04d92e17303f83d82584d415eb0a1d5ef5269b610b34e30b6079fa8d234255282cc7dcd2cfab440e92
- SSDEEP 768:b9XNZWI6CYmecZDPkWfB//DGb8PxWErIb:b9XThBYmecZLkWfC8Pxab
- TLSH T1D8D22A1242A4AC01F9B9DD3260C58BBA5235ED21AE178167B380F0785E727C2EF797DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_ms.dll
- Size 31KB
- SHA256 a675677c5db2529e0c0b3bada5dc0adbf8046246b11d46f8fb5b8a2428e3f7d8
- MD5 5735bedbd9ecb7f3264671a747431a22
- SHA1 cefe8703b0f7bc334d704601a736d4c49897d561
- SHA512 4ffd2c3ac40a9c872d0096345942283a4fe258947feb6ba3d8cf8498b582cca071689fbc5766b2eca68ee1a4d250fe587600a7589e647d867dc04467c10692ae
- SSDEEP 384:cD9XpDshgWIPuEQCsL3YV7ZZgZuG3yK6jFJHgcO/2WfdqJBAQCRNDKlDGsvwPxhS:+9XNZWI6CskqDzwDGSwPxWEuBR
- TLSH T171E22C9143DC6948FEFB8F3069F856614A27FD93BD39826D2340A5284D31AC2DE35B36
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_nl.dll
- Size 34KB
- SHA256 f0629fd15bf50a051d8cefa88955bbdbcb43168b4df5cc1ffa94381710a48080
- MD5 6feeeec9d49faea1d07d35f618ff2f23
- SHA1 13bca7bdb651cf980b15f8cf831f0f192549e129
- SHA512 6f92583fdc7be218989e92900efcb8b490201ed3c14aa7038a4667a8b2f8d6730fcc91a8d8d2d0db6a691905fb3862c183dfcfa1b595d430d49ee8af158b171b
- SSDEEP 384:hZ349XpDshgWIPuEQCgnOBYUEz8BxUUNOXDGsQkPxh8E9VF0NyLwf1:hN49XNZWI6CgjlQEGIDGrkPxWEla1
- TLSH T13BF2E94247F85918F6F76F30BDB885608E76FC92AD34C66D2240A56C5C32681EEB4B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_no.dll
- Size 32KB
- SHA256 daa873a1e8474e955544dd08c239651f5ca71fcec4da725f3a9018942285d8b1
- MD5 c6d0bb6d261d4673764028a860b047c4
- SHA1 81d01245f156d84ff8c195b1c806005d2a28d882
- SHA512 9099a62cadd41f33d05c3b6eb0af1d37509d3b1f2fcd402024b19a1dd744223e9ec8601959808d1175ad1aca01a2a6ca97cc1d74f37839c39c7b164c0b7b5be4
- SSDEEP 384:UAKaq6Kaq6Kafv/Pe9XpDshgWIPuEQC9Kh/IGDMsiKVtmDGs/lPxh8E9VF0Ny9yN:Q9XNZWI6C9ItDviKVMDGEPxWEDtwv
- TLSH T190E2715197E85919F2FB6F30BCB845604975FCA1AE38C61D3244E06C0D327C6EAB4B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_pl.dll
- Size 33KB
- SHA256 e5634445f290c02062f328923a17f6cf64d97b8ec2f39b2dcdc17abd68b5804c
- MD5 f41720449445622dbe926ab2223dae35
- SHA1 b09cd888ea2100ace9025863a7718715c8f52cad
- SHA512 25b13cb517c6001b9e4b49960ca9006719b646c351e70f425d90dd8a79d7697bd3ff101c62afb389d94e1406fd6685d65d346ba49397a68fda65b301fb839cc9
- SSDEEP 384:Ix9XpDshgWIPuEQCAJDL7bHNzcjANLsMnZbDGsCoZPxh8E9VF0NyH8bFg:Y9XNZWI6CARTLZ9DGxoZPxWENsg
- TLSH T14AF2660197F81940F6F7AF3075B962658F7ABC22BD3481AF364091190A71AC1EEB4B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_pt-BR.dll
- Size 32KB
- SHA256 acc7058a00f86c96ee393d1c9b9edc072346c540492607114879ce912a6a077a
- MD5 4cd53b5d1df90f73457c89a16686c8ef
- SHA1 b3dfe49d83a9bb7229a2eb0d90baeb8d3757b744
- SHA512 aa3915284922ac976bff80ba0fa180b2659ed4ec8918161bb4b54180426ef2032cb031cf5818100277a7b109304dcca1ff47cbd8201e92d53c64a7e3cc2bacdd
- SSDEEP 384:p1q9XpDshgWIPuEQC2qylFEZnK+J1tDGsKPxh8E9VF0Ny4UV+:jq9XNZWI6C25nEZHLDGLPxWE2w+
- TLSH T10CE2504187F81A44F6FB7F31687856258D37BD62AC38C25D2210D0691D71B82EEB9B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_ru.dll
- Size 33KB
- SHA256 21517e571c100bc5d46b71e3c3dac9469fccdb7111317689f4bf3a61299d4637
- MD5 8683871b8e01236278c1aebb7a1272dc
- SHA1 dce879e813dca7ebf3e72cbcc112beb9b3913b57
- SHA512 2108f15a684d49dd489f7f779ea633700cd9f2330635e179c1cacaa81d2f674f90d3c04feb020b632af38404597e1645ef6278aa2ee524d3817902559fd4f1e0
- SSDEEP 384:hH9XpDshgWIPuEQC/4qKN+5N+JnYOk3oyq3Lbq9DYNdDdHt/ymnDGsaPxh8E9VFe:R9XNZWI6C/BjoyHZmnNnDGhPxWEQPJ
- TLSH T127E2860FEBBC9800F468D6711A6589E72064FF206B1985E6719FFC70646437277293CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_sv.dll
- Size 32KB
- SHA256 7a1bc16bca6cf3fd914df3b485321be79cc339e8d590693702ca36da8b084028
- MD5 5ec05b764e42833537994957353d2613
- SHA1 aa1f98972522b263ed686bcb180fe3575fbb2370
- SHA512 71d71525dd29dff48c423b2ace985098794f26c52c4cdcc57ad52a0ab8bf55c6eafb8a990880c016ccac6c0c7d7709bf53293ec520bc97eee32843a27d6fd1e8
- SSDEEP 384:k79XpDshgWIPuEQCtG3D3ciot2QQEgz5DGsBPxh8E9VF0Ny/uyTj:C9XNZWI6CtKciotgEADGGPxWEVl
- TLSH T1BEE2324257E85918F6F75F30BCB986214875FCA1AD79D62D3300D5AC0C31B86EAB4B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_th.dll
- Size 31KB
- SHA256 f36f30e19a55a2194087eb6373f08a6f7ad68bf939da12c69132e346dc79242d
- MD5 e88b95b7cb9bdcc4d770cb6fa8fb292c
- SHA1 1493522b0d008256f5c53f39547e770a800ad123
- SHA512 b65dbc0a408bc38fda0e520c8c3cc5803d8b711bcf3fce684a9e9401282200c9ff4b06d296189ba8e960ba9fee009af7f8383bea8e82f16848782cd5d8e6283d
- SSDEEP 768:u49XNZWI6C1wRUkGGq2aaLxo2qQ5qDGxPxWEi6:u49XThB1wRUkGGq2aaLxoZQVPxt
- TLSH T1B6E2A47482B12B02D56BC8F0E1C48E737C2CED21DC1AC1A1A16FDD345A317A6ABF995D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_uk.dll
- Size 32KB
- SHA256 ae96fc8006b7201b041473a10c498ae4889c6eb81cdf0bee4270ca7a2745395a
- MD5 a2b1957643377100b1c777316b813438
- SHA1 1e83f73e3bd0f24ab7b41079ec22c270ec92cd65
- SHA512 e5efb0bd54e237a5b7d2bcec805aa093b71ed92ec1ebc739d1c499d1579072e065e2906b377624faac5722739d24c8694cc805f2a5f9a5d1c8ed19b793363c85
- SSDEEP 384:EM9XpDshgWIPuEQCfbgb0sS5kU40ryH5oHXmUzdkPhJzDGss4RPxh8E9VF0NyqKG:19XNZWI6CfMvoHSxDGdQPxWEQCQ7
- TLSH T1D1E2840FE6B88910F658D9315A9285E71478FF202F98C2D6724FF831282977377256DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_zh-CN.dll
- Size 25KB
- SHA256 07f5d695f61c2885f22149c5cef669c365e1086a825e0ea20cf5f49db71b3ffd
- MD5 08b03f0884831793e56960403b4e0987
- SHA1 f3ded14d42c162b5bd831bb1b7a109e6959239da
- SHA512 cf53ebcbd25f302e2e4f43eab00b8436640797b0d05a01eeb4bb0b6cae478db8f29e5191cc105d971069a816a4938467b0321c1e64aa5d4d4c4f2d1934cf9c04
- SSDEEP 384:sw9XpDshgWIPuEQCeP7KP0DGsksanPxh8E9VF0NyH5GeQ:V9XNZWI6CeTKP0DGDnPxWEx8V
- TLSH T1B9C23C0647D41C01F7BE8D31A089D9359631FD226D9186BB3144E4351EB2B83EF7ABAE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\goopdateres_zh-TW.dll
- Size 25KB
- SHA256 44fcaf1bb65cc2b6a670363341330aaebbb1f47d6b42990af20671d9f83be4be
- MD5 381d2ce762cb24b3aa67424ea6598990
- SHA1 03d4280434452da4b8116345ea183752a8db9560
- SHA512 09cadcba6ee86f4dbcfcecee4173c146c22ec78b8edb111f9665cab289ddfd448494e32c6e3e11dcf9fea2f782751f777c4bb59a96d6691d337c55d69f3ac523
- SSDEEP 384:sP9XpDshgWIPuEQCRJS6ql73inVv0WGcDGsSUsOPxh8E9VF0NyReKm:e9XNZWI6CR4l7nrcDGVUZPxWEnM
- TLSH T1E0C2290247D42C01F9AE9D3260988536C632FD222F5581A63189E4715EB2B83FF7E76E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\npDropboxUpdate3.dll
- Size 273KB
- SHA256 4275c513a038d1a3eb3f64030aabb17d2ad7fadd314f67baed452405d94938f6
- MD5 7d4353547b80786631735c397cf3b82a
- SHA1 c51f475af0e95cd56f11565cf503f2f92fe1ef78
- SHA512 5e4df0b91ef9d3a9bf9c08684d376a68c4cfcbf2a500d0e0d9f6c54aa32f777a24d4b2efe312c9db73c4819f009e3b3dad7720f4fa9932f48900e57820a09cbd
- SSDEEP 6144:WA7vNv8mV2DMQ5wnGlZEspqba7W6ue1TtJU5zZIJQ1PcS:R7B8mVQVwnGlZEyQZh3
- TLSH T1B5549D123FD58076E8B718349AA3DA526AF97D325930C84FF788884DAF71B82D935313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\psmachine.dll
- Size 211KB
- SHA256 8e7cb942bbac612139b9a23c3c88cae2f2f468b0985c5e232371ef06075bd9fd
- MD5 23b51c1f7a2a52176837de18b5ee30ad
- SHA1 cd78068f1d3101c922a9313693d0ea796f70920f
- SHA512 e3b9d18b0ec79d8c0176a595656f6b06fcaf5b1033037b6394ebdf9d064e0ad3219159aa659d6c6c3dca859e2fd0489821310f9bc08117d3cb6ded948a19fdf5
- SSDEEP 3072:xJne7kj/ktzQQET+lMk7q7SHwoBOlAl7QXrQoW3UK3833zQWH+gxY:x0C2U3T++k7YSHwoB0+sXjW304J
- TLSH T195248D1132D0C036D66F103944ABC7626BB97D306FA4C58B3798BA6D5E70786EB36393
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Dropbox\Temp\GUM6F89.tmp\psuser.dll
- Size 211KB
- SHA256 58d2cba2d3d3b35976f4f64a799d6ee35bf8f133adc6042a622b17f19edb3fb2
- MD5 ea45813115295a608fefca9601dbeef5
- SHA1 5d5d0f6162cc07fc9f06b8da6a97dde099c7f78b
- SHA512 9d2f162368005e79e0849e5378b66ae076c4dea742511880a3e4bacd55da4742683c2b7ccfc69e493e22ddf19fa437d5b1bb9987e3ec577782fc322a8b94ce79
- SSDEEP 3072:9JXe7kj/ktzQQET+lMk7q7SHwoBOlto7QXrQSW3UK3833zQWW+/xQ:9UC2U3T++k7YSHwoB02sXVW30rO
- TLSH T1C3248D0132D0C036D66F103944ABC7626BB97D306FA4C58B3798BA6D5E71786EB36393
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B
- Size 314B
- SHA256 7cd33cdb446821474b661bf104697afac519c7f2a8982d056e5413dae3d30c9e
- MD5 ffdba429a1a6650e38efc25880090f07
- SHA1 2fe3221c11d898652fd15c1c211947b710d6a15f
- SHA512 8eee9ca899b8239eccd34a3c2e9a6e8aa25503d09c90f0061ad1335c7baf63ac08cd696ec8be8e484915c1343a511fa7d897396bd85ceace96f375aaa78b81e2
- TLSH T194E07DD3A2F6DC8809A7448090F08D343C3265A750D7DC283932875C31B3A3A2043012
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B1C7267527E2135ED2C5C2AE13A93217_C911B16A18301CEC813C002CC8DB91D1
- Size 312B
- SHA256 2d81bc3d14e54ed0837f52dc2b0bfa1b016169673ae23802dafbfb30eef42563
- MD5 19f45ffff886cbb46f7e3beec5de6d9e
- SHA1 f268a014ac66573323002edc8a998539ffed132f
- SHA512 38d4c374cb66030584c3090336435096e14d8c171fb67dad6f2715a3a55e032238c99c6a204c17144d28d82c3ba36c1fef98d114e9ae0e06c135fa943baf8291
- TLSH T1DCE07D550343DD52773BE5853AF1457D341552E536C13607282912B9956BA159702118
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B
- Size 400B
- SHA256 f04f8c23dfb562c127fcc9cf800ce89c9e04ffbc1a933425456ed3ae7931af03
- MD5 295693772701dc8ac9d8fdeee761d370
- SHA1 c3ebc8d03a0a087468b67c94404fef10b6ebfd16
- SHA512 e3ddfd101b58b4d045a926e19a62a115a14f6207ac39c8e9567c5d135e280d52f58523367c9528cf73f13c62fdbe6f3dfa8c162cc922e4938c10400855e975b6
- TLSH T12CE026203BFB012CF5787A7486E596A84A6EF2260D44C7B60FD0045A6A07682FE31875
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B1C7267527E2135ED2C5C2AE13A93217_C911B16A18301CEC813C002CC8DB91D1
- Size 412B
- SHA256 98b9748956748fa08e344af5512f7d362ed66881cee70845a49613eedee75d70
- MD5 88f11f6dcc2b14ddfa19ca8fe2112ec8
- SHA1 3637fd49800d6673bcfc546e8a76740d52556d78
- SHA512 bbed903ccc3f3bbfebf972df8050c04a9a6fd76ae911d5b777f43095e25569c8807a5946ff4d390c9eebef8341b6f630114565fab98b4d9f97fe79c7fe36cde6
- TLSH T1A8E0201453FE450CF563993547D064700CA4E566050347713BA053047B16754AC22E76
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
- Size 924B
- SHA256 75cc93dcb3d01f873cf7cfd69f04074194f1d09b02f0568561bd6881387d64d3
- MD5 bdb91ac53f57a57791a615e0fcb78556
- SHA1 622ded201d423e48262d261022c927b129e55a17
- SHA512 3a8a9e2cf458aef0797823c6d5bafd9f045451467f98d8c1216aefdf4ccc0cad9f9347bcdfae30a146a62352902d90e2fb891c5d125b2d44146403f8cf64900e
- TLSH T14A112591BBFA4124FAF77F316AB05AA54A7BBC22BE35C65C1011444D4CB7A90C970B23
- MD5 SHA1 SHA512 TLSH