7bfde9564a093b42a2c8c6e0f7d10297822d95f228aaefe4ba2921ea60babdb3

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
handybackup-750.msi
Size 23.0MB
Sample260814-pp6pcsbl4w
SHA256 7bfde9564a093b42a2c8c6e0f7d10297822d95f228aaefe4ba2921ea60babdb3
MD5 f415145ecadd81dfe709dffc5bde85be
SHA1 81b7dfddb1ec2003fcb8340872164f45236b555e
SHA512 2d78d8c29a1bb98f288f1ac13b28d25ad4847c3ee1d841c471ee7a9a1fa7b317c3ea3b773a238423c496f21be0ef5b4eb283e2a9d43c6016460e61a5d0ceba55
SSDEEP 393216:0zJPgS4pqZG3wLL9HtU168+GTn6/OJF/MSoE7VnhwoyNqtn312CnXTM1W4:eJPwpqkALZH2T6mJJMNE75OKnFM1W
TLSH
T1C0373321B44095B9D1321736972BE6605F7DAC3C0BF1101AAB6AB74F0D3A790A7B7F42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000b00000001c66b-371.dat	acprotect

Executes dropped EXE 5 IoCs

pid	Process
5744	BackupClient.exe
1424	BackupServer.exe
4920	BackupNetworkCoordinator.exe
1696	BackupNotifyService.exe
1592	BackupWorkstation.exe

Loads dropped DLL 64 IoCs

pid	Process
4416	MsiExec.exe
4416	MsiExec.exe
4416	MsiExec.exe
4416	MsiExec.exe
4416	MsiExec.exe
5888	MsiExec.exe
5888	MsiExec.exe
5744	BackupClient.exe
5744	BackupClient.exe
5744	BackupClient.exe
5744	BackupClient.exe
5744	BackupClient.exe
5744	BackupClient.exe
5744	BackupClient.exe
5744	BackupClient.exe
5744	BackupClient.exe
5744	BackupClient.exe
5744	BackupClient.exe
5744	BackupClient.exe
5744	BackupClient.exe
1424	BackupServer.exe
1424	BackupServer.exe
1424	BackupServer.exe
1424	BackupServer.exe
1424	BackupServer.exe
1424	BackupServer.exe
1424	BackupServer.exe
1424	BackupServer.exe
1424	BackupServer.exe
1424	BackupServer.exe
1424	BackupServer.exe
1424	BackupServer.exe
1424	BackupServer.exe
1424	BackupServer.exe
1424	BackupServer.exe
1424	BackupServer.exe
1424	BackupServer.exe
1424	BackupServer.exe
1424	BackupServer.exe
1424	BackupServer.exe
4920	BackupNetworkCoordinator.exe
4920	BackupNetworkCoordinator.exe
4920	BackupNetworkCoordinator.exe
4920	BackupNetworkCoordinator.exe
4920	BackupNetworkCoordinator.exe
4920	BackupNetworkCoordinator.exe
4920	BackupNetworkCoordinator.exe
4920	BackupNetworkCoordinator.exe
4920	BackupNetworkCoordinator.exe
4920	BackupNetworkCoordinator.exe
4920	BackupNetworkCoordinator.exe
4920	BackupNetworkCoordinator.exe
4920	BackupNetworkCoordinator.exe
4920	BackupNetworkCoordinator.exe
4920	BackupNetworkCoordinator.exe
1696	BackupNotifyService.exe
1696	BackupNotifyService.exe
1696	BackupNotifyService.exe
1696	BackupNotifyService.exe
1696	BackupNotifyService.exe
1696	BackupNotifyService.exe
1696	BackupNotifyService.exe
1696	BackupNotifyService.exe
1696	BackupNotifyService.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Handy Backup 7 = "\"C:\\Program Files (x86)\\Novosoft\\Handy Backup 7\\BackupClient.exe\" -autorun"	msiexec.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	3452	msiexec.exe

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msxml4.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msxml4r.dll	msiexec.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000b00000001c66b-371.dat	upx
behavioral2/memory/5744-382-0x0000000010000000-0x000000001025E000-memory.dmp	upx
behavioral2/memory/5744-444-0x0000000010000000-0x000000001025E000-memory.dmp	upx
behavioral2/memory/5744-460-0x0000000010000000-0x000000001025E000-memory.dmp	upx
behavioral2/memory/5744-463-0x0000000010000000-0x000000001025E000-memory.dmp	upx
behavioral2/memory/5744-466-0x0000000010000000-0x000000001025E000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Plugins\FTP_tur.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Plugins\Online Backup_tur.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\TAO_AnyTypeCode.dll	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Plugins\WebDAV_eng.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Plugins\LibrariesMS.dll	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Filters\cmd_arm.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\UI\images\table-tasks-bg.png	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\UI\images\item.png	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Plugins\MySQL.dll	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Plugins\Network.dll	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Plugins\PostgreSQL_arm.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Plugins\Registry.dll	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Filters\blowfish.dll	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\UI\images\safe.png	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Plugins\MSSQL.dll	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\TAO_Codeset.dll	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Templates\view2link.xsl	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Plugins\FTP_spa.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Templates\Plugins\Amazon S3.xsl	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\BackupServer.exe	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Plugins\NotesPlugin.dll	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\TAO_CosNotification.dll	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\UI\trial-tray.html	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\xdelta_license.txt	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\UI\images\check.png	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Plugins\PostgreSQL_spa.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Plugins\SFTP_eng.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Customizes\Turkish.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Filters\blowfish_cze.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Plugins\Amazon S3_fre.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Customizes\English.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Plugins\PostgreSQL_cze.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Plugins\PostgreSQL_eng.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Server\French.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Plugins\SFTP_cze.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Plugins\SFTP_fre.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\TAO_Notify_Service.dll	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Plugins\DBPlugin.dll	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Plugins\Online Backup_arm.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Plugins\Online Backup_bra.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Plugins\Online Backup_cze.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\psql.exe	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Plugins\WebDAV_spa.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Plugins\Amazon S3_bra.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Filters\cmd_spa.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Templates\Plugins\MySQL.xsl	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Server\Armenian.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\7z.dll	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Plugins\Amazon S3_arm.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Plugins\Amazon S3_spa.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Plugins\Multi-cloud_fre.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Server\Russian.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\svss_xp.dll	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Tips.txt	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Templates\Plugins\FTPS.xsl	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\TAO_CosEvent_Skel.dll	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\close_1c_server_connections.vbs	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Customizes\DR\English.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Plugins\FTPS_spa.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Plugins\SpecialFolders.dll	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\zlib1.dll	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Filters\blowfish_bra.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Customizes\DR\Spanish.xml	msiexec.exe
File created	C:\Program Files (x86)\Novosoft\Handy Backup 7\Lang\Plugins\FTP_rus.xml	msiexec.exe

Drops file in Windows directory 59 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFB649D868FBBDB1DE.TMP	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260814133404213.0\msxml4.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_msvcr100_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100deu_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100jpn_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100rus_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100u_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6B36.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100chs_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5277.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100ita_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfcm100_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfcm100_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5557.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100enu_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Installer\{A1C1B3DF-9223-4365-A84A-5FADCB80E0FE}\Icon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5C9E29DB912CE58A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100cht_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100kor_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100rus_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6420.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5923.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100esn_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100fra_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_msvcr100_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File created	C:\Windows\Installer\{A1C1B3DF-9223-4365-A84A-5FADCB80E0FE}\Icon	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a3f7b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI547B.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfcm100u_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_msvcp100_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI58B4.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260814133404213.0\msxml4.Manifest	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100cht_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100enu_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100u_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_msvcp100_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100ita_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100kor_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5642.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100fra_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260814133404213.0\msxml4.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260814133404309.0\msxml4r.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260814133404309.0\msxml4r.Manifest	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100chs_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100deu_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100esn_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File created	C:\Windows\Installer\e5a3f7b.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A1C1B3DF-9223-4365-A84A-5FADCB80E0FE}	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260814133404309.0\msxml4r.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfc100jpn_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\FD3B1C1A322956348AA4F5DABC080EEF\7.5.0\F_CENTRAL_mfcm100u_x86.AFA96EB4_FA9F_335C_A7CB_36079407553D	msiexec.exe
File created	C:\Windows\Installer\e5a3f7d.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3452	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackupServer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackupNotifyService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackupWorkstation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackupClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackupNetworkCoordinator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
2020	taskkill.exe
3580	taskkill.exe
1896	taskkill.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C6-F192-11D4-A65F-0040963251E5}\ = "Server XML HTTP 4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969D6-F192-11D4-A65F-0040963251E5}\Version\ = "4.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Msxml2.MXNamespaceManager.4.0\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD3B1C1A322956348AA4F5DABC080EEF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.FreeThreadedDOMDocument.4.0\ = "Free Threaded XML DOM Document 4.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C5-F192-11D4-A65F-0040963251E5}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C6-F192-11D4-A65F-0040963251E5}\InProcServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Msxml2.XMLSchemaCache.4.0\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Msxml2.MXXMLWriter.4.0	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Msxml2.MXHTMLWriter.4.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.SAXAttributes.4.0\CLSID\ = "{88D969CA-F192-11D4-A65F-0040963251E5}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD3B1C1A322956348AA4F5DABC080EEF\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\IndexFile\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IndexFile\DefaultIcon\ = "\"C:\\Program Files (x86)\\Novosoft\\Handy Backup 7\\BackupClient.exe\",0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Msxml2.XMLHTTP.4.0	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C5-F192-11D4-A65F-0040963251E5}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C9-F192-11D4-A65F-0040963251E5}\InProcServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD3B1C1A322956348AA4F5DABC080EEF\ProductName = "Handy Backup"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD3B1C1A322956348AA4F5DABC080EEF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C1-F192-11D4-A65F-0040963251E5}\Version\ = "4.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.MXXMLWriter.4.0\CLSID\ = "{88D969C8-F192-11D4-A65F-0040963251E5}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969D6-F192-11D4-A65F-0040963251E5}\ProgID\ = "Msxml2.MXNamespaceManager.4.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C1-F192-11D4-A65F-0040963251E5}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.XMLHTTP.4.0\ = "XML HTTP 4.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C5-F192-11D4-A65F-0040963251E5}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C6-F192-11D4-A65F-0040963251E5}\InProcServer32\ = "C:\\Windows\\SysWOW64\\msxml4.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C2-F192-11D4-A65F-0040963251E5}\Version\ = "4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C8-F192-11D4-A65F-0040963251E5}\ProgID\ = "Msxml2.MXXMLWriter.4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\4.0\0\	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD3B1C1A322956348AA4F5DABC080EEF\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C1-F192-11D4-A65F-0040963251E5}\InProcServer32\ = "C:\\Windows\\SysWOW64\\msxml4.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C4-F192-11D4-A65F-0040963251E5}\ProgID\ = "Msxml2.DSOControl.4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C5-F192-11D4-A65F-0040963251E5}\InProcServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C3-F192-11D4-A65F-0040963251E5}\InProcServer32\ = "C:\\Windows\\SysWOW64\\msxml4.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Msxml2.SAXXMLReader.4.0	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD3B1C1A322956348AA4F5DABC080EEF\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD3B1C1A322956348AA4F5DABC080EEF\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Msxml2.DOMDocument.4.0	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C1-F192-11D4-A65F-0040963251E5}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C1-F192-11D4-A65F-0040963251E5}\InProcServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C4-F192-11D4-A65F-0040963251E5}\ = "XML Data Source Object 4.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Msxml2.XSLTemplate.4.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C8-F192-11D4-A65F-0040963251E5}\ = "MXXMLWriter 4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C9-F192-11D4-A65F-0040963251E5}\ProgID\ = "Msxml2.MXHTMLWriter.4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\4.0\0\win32\ = "C:\\Windows\\SysWOW64\\msxml4.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C5-F192-11D4-A65F-0040963251E5}\Version\ = "4.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{7C6E29BC-8B8B-4C3D-859E-AF6CD158BE0F}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C8-F192-11D4-A65F-0040963251E5}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Msxml2.MXHTMLWriter.4.0\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969CA-F192-11D4-A65F-0040963251E5}\Version	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.DOMDocument.4.0\ = "XML DOM Document 4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.DSOControl.4.0\CLSID\ = "{88D969C4-F192-11D4-A65F-0040963251E5}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.XMLHTTP.4.0\CLSID\ = "{88D969C5-F192-11D4-A65F-0040963251E5}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C6-F192-11D4-A65F-0040963251E5}\Version	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.XSLTemplate.4.0\ = "XSL Template 4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Msxml2.SAXXMLReader.4.0\ = "SAX XML Reader 4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F5078F18-C551-11D3-89B9-0000F81FE221}\4.0\ = "Microsoft XML, v4.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\InProcServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88D969C1-F192-11D4-A65F-0040963251E5}\ = "Free Threaded XML DOM Document 4.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Msxml2.DSOControl.4.0	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C6-F192-11D4-A65F-0040963251E5}\InProcServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{88D969C3-F192-11D4-A65F-0040963251E5}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FD3B1C1A322956348AA4F5DABC080EEF	msiexec.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4416	MsiExec.exe
4416	MsiExec.exe
4416	MsiExec.exe
4416	MsiExec.exe
1540	msiexec.exe
1540	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3452	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3452	msiexec.exe
Token: SeSecurityPrivilege	1540	msiexec.exe
Token: SeCreateTokenPrivilege	3452	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3452	msiexec.exe
Token: SeLockMemoryPrivilege	3452	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3452	msiexec.exe
Token: SeMachineAccountPrivilege	3452	msiexec.exe
Token: SeTcbPrivilege	3452	msiexec.exe
Token: SeSecurityPrivilege	3452	msiexec.exe
Token: SeTakeOwnershipPrivilege	3452	msiexec.exe
Token: SeLoadDriverPrivilege	3452	msiexec.exe
Token: SeSystemProfilePrivilege	3452	msiexec.exe
Token: SeSystemtimePrivilege	3452	msiexec.exe
Token: SeProfSingleProcessPrivilege	3452	msiexec.exe
Token: SeIncBasePriorityPrivilege	3452	msiexec.exe
Token: SeCreatePagefilePrivilege	3452	msiexec.exe
Token: SeCreatePermanentPrivilege	3452	msiexec.exe
Token: SeBackupPrivilege	3452	msiexec.exe
Token: SeRestorePrivilege	3452	msiexec.exe
Token: SeShutdownPrivilege	3452	msiexec.exe
Token: SeDebugPrivilege	3452	msiexec.exe
Token: SeAuditPrivilege	3452	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3452	msiexec.exe
Token: SeChangeNotifyPrivilege	3452	msiexec.exe
Token: SeRemoteShutdownPrivilege	3452	msiexec.exe
Token: SeUndockPrivilege	3452	msiexec.exe
Token: SeSyncAgentPrivilege	3452	msiexec.exe
Token: SeEnableDelegationPrivilege	3452	msiexec.exe
Token: SeManageVolumePrivilege	3452	msiexec.exe
Token: SeImpersonatePrivilege	3452	msiexec.exe
Token: SeCreateGlobalPrivilege	3452	msiexec.exe
Token: SeCreateTokenPrivilege	3452	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3452	msiexec.exe
Token: SeLockMemoryPrivilege	3452	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3452	msiexec.exe
Token: SeMachineAccountPrivilege	3452	msiexec.exe
Token: SeTcbPrivilege	3452	msiexec.exe
Token: SeSecurityPrivilege	3452	msiexec.exe
Token: SeTakeOwnershipPrivilege	3452	msiexec.exe
Token: SeLoadDriverPrivilege	3452	msiexec.exe
Token: SeSystemProfilePrivilege	3452	msiexec.exe
Token: SeSystemtimePrivilege	3452	msiexec.exe
Token: SeProfSingleProcessPrivilege	3452	msiexec.exe
Token: SeIncBasePriorityPrivilege	3452	msiexec.exe
Token: SeCreatePagefilePrivilege	3452	msiexec.exe
Token: SeCreatePermanentPrivilege	3452	msiexec.exe
Token: SeBackupPrivilege	3452	msiexec.exe
Token: SeRestorePrivilege	3452	msiexec.exe
Token: SeShutdownPrivilege	3452	msiexec.exe
Token: SeDebugPrivilege	3452	msiexec.exe
Token: SeAuditPrivilege	3452	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3452	msiexec.exe
Token: SeChangeNotifyPrivilege	3452	msiexec.exe
Token: SeRemoteShutdownPrivilege	3452	msiexec.exe
Token: SeUndockPrivilege	3452	msiexec.exe
Token: SeSyncAgentPrivilege	3452	msiexec.exe
Token: SeEnableDelegationPrivilege	3452	msiexec.exe
Token: SeManageVolumePrivilege	3452	msiexec.exe
Token: SeImpersonatePrivilege	3452	msiexec.exe
Token: SeCreateGlobalPrivilege	3452	msiexec.exe
Token: SeCreateTokenPrivilege	3452	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3452	msiexec.exe
Token: SeLockMemoryPrivilege	3452	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3452	msiexec.exe
5744	BackupClient.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5744	BackupClient.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3452	msiexec.exe
1540	msiexec.exe
3760	MsiExec.exe
4416	MsiExec.exe
5888	MsiExec.exe
5744	BackupClient.exe
5744	BackupClient.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 3760	1540	msiexec.exe	90
PID 1540 wrote to memory of 1368	1540	msiexec.exe	96
PID 1540 wrote to memory of 4416	1540	msiexec.exe	98
PID 4416 wrote to memory of 3580	4416	MsiExec.exe	99
PID 4416 wrote to memory of 1896	4416	MsiExec.exe	102
PID 4416 wrote to memory of 2020	4416	MsiExec.exe	104
PID 1540 wrote to memory of 5888	1540	msiexec.exe	106
PID 5744 wrote to memory of 1424	5744	BackupClient.exe	111
PID 1424 wrote to memory of 4920	1424	BackupServer.exe	114
PID 1424 wrote to memory of 1696	1424	BackupServer.exe	116
PID 1424 wrote to memory of 1592	1424	BackupServer.exe	118

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\handybackup-750.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3452

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5FC18E5A3F03DAABD7AAD5D24BF6EBDC C
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3760
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1368
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E1EE6DFBC7C7976154DF48B015A7406B
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /F /T /IM BackupWorkstation.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3580
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /F /T /IM BackupServer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1896
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /F /T /IM BackupClient.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2020
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D6ACAB5670BC64EC69684CD95B9C8EBE E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5888

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2232

C:\Program Files (x86)\Novosoft\Handy Backup 7\BackupClient.exe
"C:\Program Files (x86)\Novosoft\Handy Backup 7\BackupClient.exe" -autorun
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5744
- C:\Program Files (x86)\Novosoft\Handy Backup 7\BackupServer.exe
  "C:\Program Files (x86)\Novosoft\Handy Backup 7\BackupServer.exe" -n --ListenEndpoints localhost --HostNameInIOR localhost --CoordinatorHost localhost --CoordinatorPort 1755 --StartWorkstation --ReadyEvent 7c298086-97dc-11f1-8000-000000000000
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Program Files (x86)\Novosoft\Handy Backup 7\BackupNetworkCoordinator.exe
    "C:\Program Files (x86)\Novosoft\Handy Backup 7\BackupNetworkCoordinator.exe" -n --ListenEndpoints localhost:1755 --ReadyEvent 7c993b06-97dc-11f1-8000-000000000000
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4920
- - C:\Program Files (x86)\Novosoft\Handy Backup 7\BackupNotifyService.exe
    "C:\Program Files (x86)\Novosoft\Handy Backup 7\BackupNotifyService.exe" -n --ListenEndpoints "localhost" --HostNameInIOR "localhost" --CoordinatorHost "localhost" --CoordinatorPort "1755" --ReadyEvent 7c993b06-97dc-11f1-8000-000000000000
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1696
- - C:\Program Files (x86)\Novosoft\Handy Backup 7\BackupWorkstation.exe
    "C:\Program Files (x86)\Novosoft\Handy Backup 7\BackupWorkstation.exe" -n --ListenEndpoints "localhost" --HostNameInIOR "localhost" --CoordinatorHost "localhost" --CoordinatorPort "1755" --ReadyEvent 7c993b06-97dc-11f1-8000-000000000000 --ShutdownEvent 7c993b06-97dc-11f1-8001-000000000000
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1592

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{4E14FBA2-2E22-11D1-9964-00C04FBBB345}
1⤵
- System Location Discovery: System Language Discovery
PID:2128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ACE.dll

Path C:\Program Files (x86)\Novosoft\Handy Backup 7\ACE.dll
Size 1.2MB
SHA256 2654ff7f0562dd1eaa52ca5a3319321dd34a00b2ad5c79a3dbc4daff14e1d454
MD5 bb6cc0638e194ce2a3078f36744898e8
SHA1 35536eac41695fe32e31e8c246ae7ba999ffdd5c
SHA512 428bd3929ea78cdd41b8c885aa6aa9af83dee1558a8d80f31fc58f188838ebd968dc0cd765522946c94a7b706e92c24bb5d40570ef6bfd470b5131c7752c7e87
SSDEEP 24576:ecVKI80IeS4BOK+ZA8RYI/iHRyp4pd94ey4bRgUAl:rVxtS4BNRrl4evbRgU6
TLSH
T16B455B14B9AE8267E68AA2F14DBD772B4C7D8541073C8BC3610DDB1C18902E76FB7A53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupClient.exe

Path C:\Program Files (x86)\Novosoft\Handy Backup 7\BackupClient.exe
Size 2.6MB
SHA256 70fa2eeb523a6bfe8be7c71c23dd2ff91ffb9db5c077033af5f4db208842acd3
MD5 8160e08f2b02ed1dd82d4ab51588fcd6
SHA1 e97a083f3bfbac388eb347d40f9d60ba715d3933
SHA512 dcb237d830ded94cb08029aab18bc80f02766607e5044d3e20fc267add74a78c01087c20587ac5a1af27d2f53eef44ccd55e3e2217d92a7d0777e9c7143a24a6
SSDEEP 49152:COh1sqguN5Vn2WjHcBWbHsSrekOBotiO526tqmL9Eh3ZQ2ZTlR5lEtT9IO/PtMWU:CO1wBWbHsSakOBotN/2ZTlJI2u6+lOZl
TLSH
T19CD56C227AD7C476F367177ADA68630491ADBCB05B3185B762D83B1E1AB00D3CE34963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupNetworkCoordinator.exe

Path C:\Program Files (x86)\Novosoft\Handy Backup 7\BackupNetworkCoordinator.exe
Size 52KB
SHA256 158c737d37edae0ce19fe404e4e89658d4aad709ce873780f78c9a3a13a66f5b
MD5 6a9ed988280068e9cb5338c4028af113
SHA1 f8a545065eaaad4933f53494c79b684346965ea0
SHA512 05bcf9c220f79f86c6321650c939531239d8ce4a511d6cce970770215bb4e0bcefbf3e4ea071cfccfbbaca94f2eb2f4efdcbed942a4e5efee9775d1b47ca1765
SSDEEP 1536:IoZ4ilihP4IaNNRIg9GQNRfw1GOfrgbzk6hn:l564x/RfZOfrg
TLSH
T13E332A233B5BC173E19219F04D39935E907FB9730B64A2DBB2898A7D08B47D15E3621B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupNotifyService.exe

Path C:\Program Files (x86)\Novosoft\Handy Backup 7\BackupNotifyService.exe
Size 60KB
SHA256 4dbe8a1766624d2f4eba43db22f53baeca404b985e324cec9698a4603d0df9fa
MD5 bf9075964300571af6dcb031e9daaa60
SHA1 fe53deedbe7a974d16784e16e6208a92e54cc801
SHA512 05150276858059c7b057e43771933516132bda474505108ea87fbd7bcaba3b89576152f85c979ddd2bae68cd95571af50263708f989d9eda5ae86a08be5d931b
SSDEEP 768:71fgD3a+ciUSM4O17XcPZrnjaLU033m+jnPp+POv9PLt7po6i1xADf5ph:5Aa/i5Nm7Xcxg3CO9c6iDADfTh
TLSH
T1D553C40363E98121F0B72A74187643295A7BFDB29B74A3DF7A81B95E1870BC08D71727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupServer.exe

Path C:\Program Files (x86)\Novosoft\Handy Backup 7\BackupServer.exe
Size 2.4MB
SHA256 9045e3ea007fbf04286b52b1e4d9d8d3591775f1074be0ba197ad5c4f5b54c8c
MD5 d7733f53f68780af1910dd066baf4338
SHA1 910f15942dfde169dcac3e9446596c386bb03708
SHA512 3207254f369f9c386f451f3940313047356753e2cf85b4658f193608b4ef2bab952e681352d83009072b862a1260ac6acb2529c179529bb7d09312579bc2f1be
SSDEEP 49152:N86bvbpSmoZDVPWfSNq+48dwbHCOk3QRG1lmA9fhmVJQqU8YBY7MkkMUULHpNx73:nUlTYCOk3QRGvThmVJYHBFC
TLSH
T119C55B24BF46C176EBC71176857CAB5FA53CD990072C60D3D28C0A9E1EA06E32F3695B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupWorkstation.exe

Path C:\Program Files (x86)\Novosoft\Handy Backup 7\BackupWorkstation.exe
Size 822KB
SHA256 c7c1a5080a2a8b50b305579a64f319a5b6a545b08622f4dc8f7b9504a963c819
MD5 4daa9176ab3ce824e0fb69ee1a1aaaa1
SHA1 c81f5a140982313f3352085ea1be7b1c01ac5f1e
SHA512 83fad6a5e8f0f772744dcaad72af6e08759060296916fb54cb567eb49a3fb6993d1d4317b007c039c28406c668269c538fc9fe328f7bbc661bacd9adad1b2fb7
SSDEEP 12288:A0ktt4uXUx+8NNIesgfEoBsa3/vaU5zQdl5gFfM:A0K4x0res7oR3/vauEdluFfM
TLSH
T1EA058D373AF5C176D033577645B8AB6860FAB8A04876850763C8CB6C17B4AB19D3DA33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

English.xml

Path C:\Program Files (x86)\Novosoft\Handy Backup 7\Customizes\English.xml
Size 110KB
SHA256 acc4137fdcf34b806c699d5564cf9f593345e4dd3059d8a72568a5512d7bab19
MD5 b5307bc66f312dbe36e00b94ed3531e9
SHA1 a7575d85aba3e42e55d4907a04e81ac6c0556f57
SHA512 73d4e4a35d290af79dd4954cbb167d63bb8c6b1ce394d6a4955434aa7a808fae682bf5309bb279cbf71ed817401c58134a81848f1f9a408a05d582e04a609e61
SSDEEP 1536:Vurx/bj8Xg8zwcvXLuLPnRMxqchkUmTlF54hgUMrXkoiswXJezSqv9mh:ibjZ8zwALuqd2lFCJ2kqwXJezfmh
TLSH
T12CB3860912BCA2198D712016B5F801A9A96DA0DF477B02F1F9DF711EAB6CC368377973
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.cmz

Path C:\Program Files (x86)\Novosoft\Handy Backup 7\Customizes\default.cmz
Size 114KB
SHA256 c2df09c9a71add0beafdddda7a51633ba60393437787647a63ee163c003d693e
MD5 a78010f954e712cd40ef907a6fe2db66
SHA1 f6ace9ea6b679336ba8d859011430c414a9e6617
SHA512 412b1241fa72f1467941e30933213d131441102e950b7510f3a4950fb40147f74601f504fa966791d0db743e9946a89aef2fc908ae062ae266afa6ac88ba77e7
SSDEEP 3072:y36SOIQN8Jut1d3dynZUlSG6hD3X4freN:y3s8J2joQbQ
TLSH
T134B33C1E594C9CE605A1B627B339C63CFB93397328BE10886749552BDF0FDAD3E25620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HBLib.dll

Path C:\Program Files (x86)\Novosoft\Handy Backup 7\HBLib.dll
Size 317KB
SHA256 cfdb0891f74dc3c2a7606496cf65e68b3f0eb6491afb46e745968bce82f94483
MD5 5b52fafb2f37f4388a860a8bcddaadc6
SHA1 e676ac57bfcad8357e0dc4e661bf8f279cd11f4b
SHA512 b3f84abbe7e92e3c2686e427e46c02101ebdd110d7dce1980e234708b243517f0b4d52412f02bfbc9af0dea302141deb67e4c7c2c4d94c6706b99e2f82984368
SSDEEP 6144:Qc7hFJkEZ6rFrY07O0SNmIXbna7sgrkeOXvkJtLyVOB9omfDJhwOXl5:rh/kBr9jSUIja7sRJXvkzx1
TLSH
T1C2647D11FB46C277DCCE22F1AD7D676E14BCA9904B6483D3E3CC960D5D622D22A32396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HTMLayout.dll

Path C:\Program Files (x86)\Novosoft\Handy Backup 7\HTMLayout.dll
Size 923KB
SHA256 d5bfe462e7a8dad17c2c75cc792560542b30669027bad14c5445cf5b3162e7ff
MD5 4de473ddae8d71ab9e3ffdb0b50c9c69
SHA1 872ee2acdbdb2292c8fa90126b69cf8d10fdcaa7
SHA512 f2c07da7c7767220ea51842478cb351c187800a3d1fba68ca066df77c872a11cc2570c058416d950dc38c928542653b967636d28cbf015241e28d6a43ff79cc8
SSDEEP 24576:r7uEnBTjt8yeGY0WDEHeYioYQDFWKzvXUZ0/JCC:jt8ye4O6eaJEa/J
TLSH
T11D15337CFC02365AE8AB213175B86C863C73DC317B991B942D57521F1870B6DBB40ABA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LIBEAY32.dll

Path C:\Program Files (x86)\Novosoft\Handy Backup 7\LIBEAY32.dll
Size 1.1MB
SHA256 9a1538113104d248320de310f807f5050ac86f325e6ab68dd318e60bd81bff38
MD5 2e9851507d21db9b4c71257afff54f55
SHA1 a92c782dc515dd825d52856917ceea441cb52154
SHA512 96c6c077e428a281a28ab5c968b684891e09afdbf3aeae899f8f8bf7e0d22bc68f7affa7e0f83837395802acd1ba7cab3a32385a9eae8f891fa604eaea8d158a
SSDEEP 24576:W8KWhc4xjncpcNDL9ICKdOERAqXmoxlpVwnzEJs8NEbwrZ:WcYrC7UAqXmylpVfJSwrZ
TLSH
T19C359D02E79589B1E88E857D15B7537F4B37AB02432AC6C34BA13952AC311E277BE3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SSLEAY32.dll

Path C:\Program Files (x86)\Novosoft\Handy Backup 7\SSLEAY32.dll
Size 231KB
SHA256 148d4fef627124448c1cca68fc2c5b987d2efc04293733e98a930958d9c3ace3
MD5 24ea8b42411e72a8acafdeded5cc12d0
SHA1 9fe57377c7e33d1b3ad975696fec22499be29935
SHA512 7aff2366210b07ea8b93088008d69a4c0f9da7db7ef35d103e91248bd70c8750b611617d1dc5cb310452a4f6cbfeeb3a29f3777aa2235f1cb87bb34730757afd
SSDEEP 6144:QJoZZ5qO1CDm+L/kSxD+LyDUufY6DYhuDJh0GuYXvtEDqOdAEJvvykv9Q2q0Wiqu:QJs5qOEDm+L/kSd+LPAY6DYUDJhfvXvU
TLSH
T155346C43B3A10EF7E49A5771217727BA2E3B6B10533985C7EB704DAC4E212D05A3D2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAO.dll

Path C:\Program Files (x86)\Novosoft\Handy Backup 7\TAO.dll
Size 1.0MB
SHA256 314fc25a64bbdb035da4cb015a39bb49c543b9c65ff738823dbecef51fa5523a
MD5 1b879b51075c752447b9418730ce02da
SHA1 88d415878d2de86613c311f672cb15ac0474c9b2
SHA512 718727a0f415e9b13944e35e19468607c3ee73eac8785b79efdff8c147e9e5baeeb98ace5a9d64923837bb2fea81c20578ee21ad84ec73a55618ead528a2f628
SSDEEP 12288:TppB7u4aM6/WlTPNx8Q+rNmgwz8i/LYaMcGJpFxZ/M6efk:THB7u21LrAMLYjFxZ/M6es
TLSH
T1BB354D62F7BA4329F5CAE2705C7D1766507EAC461738EAC7A11CCA5919B02CA0F3B317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAO_AnyTypeCode.dll

Path C:\Program Files (x86)\Novosoft\Handy Backup 7\TAO_AnyTypeCode.dll
Size 418KB
SHA256 698e875d4db20b7ba04a47be3b8461b25db8cf84591bbb21af4ea9aec2b2ce47
MD5 135ec02c0205f03b0ec04ea257e9ae8d
SHA1 2b11e58b8243c42d3ad71ff92eda8d19e6774911
SHA512 ab4d436f04f535c24e664d1388f91a29eff9f9dd4de9a88b83d8fdf697bfdce188a64694571ed3c5ab8ed23f28d71248c7395aef87efd9cfab36d5e99b3dbd2b
SSDEEP 6144:hJjKcVRfwlzIXpWpnERWs9z1uLzx2XP8QOZbk7qWWK30tdAZtfhc3r5KPE8:zjfyzAWpnERDp1uLF2XULdCd
TLSH
T1AC940973BABD87AADFCC50386DB84B2A109EAC9517D5E6C7E64C516B08D34C31D3432A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAO_CosEvent.dll

Path C:\Program Files (x86)\Novosoft\Handy Backup 7\TAO_CosEvent.dll
Size 203KB
SHA256 602460047d6e7003d98ca6fcba5e4e5eca7857d8fe23be5cd2a2936170e6d006
MD5 aa39b1e2e55e15b6e1bc17cd0df4e728
SHA1 7b5ee9e45ff7d13a42aeda73eda18f7d95ea21c9
SHA512 48190668af3875e5dcda2c053dd019657e239a5c3896b311e6e9dc8260ed4cae82645bab21b87937c3d2caf3a7c07eb13a866d15df940f29e1ecb48f9bda5c1d
SSDEEP 6144:KmqNWqGPqUfqUqEq4qcgXxgdkgmnalqQqjqgqReHKFgvUGTzmqj6q/qenqssqZqv:KmqNWqGPqUfqUqEq4qBgdkgmnalqQqjo
TLSH
T1911497A2F6258378D0CE303C1AFA879A411B69F2DB9E99CFED089D5460A15C30D7E747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAO_CosEvent_Skel.dll

Path C:\Program Files (x86)\Novosoft\Handy Backup 7\TAO_CosEvent_Skel.dll
Size 204KB
SHA256 a91609f3ef4a69f55ce3e849641709b77da478c22539e47bdde5d1fe3cd5811f
MD5 f7c3f25f6c6246c69147de549392c684
SHA1 a831574af8ef17495e048cba81ee73af9c03727e
SHA512 89747fcca8774b80c8f48fa577baeef4ffcd8a18e22bfa22aa94a610ba356cf9f3b1ed532739dde87c3e4581d6b5e0ccb2fe19b5e1bb12262576485b4e581acc
SSDEEP 1536:W9Ew/R9bEGn9PoSu9qFjvCe9itrdrT9aVzQNMW9FU+QIG9q9jf9GWAB9ty0sZ9h5:+NAtLwZhUr83TZQ9LsPROZRGLQA5VDO
TLSH
T192246322AE5A42B4C0CE303C06FED7DA832F16E1E7DA65DBFD049D66A0615C34C7A647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAO_CosNaming.dll

Path C:\Program Files (x86)\Novosoft\Handy Backup 7\TAO_CosNaming.dll
Size 119KB
SHA256 08a471870efa27e0f70e4393c84d602bbdc9f46902d532253c79f70c133fc00f
MD5 4639d5f9d5225ddc14acc60430b2ab5f
SHA1 9c52061289c4f0a81c54f14713482830dbe79d6b
SHA512 81aa895c0a70e4f9fd443a215c7b422333031dcc00c3181ac0bc803974023ac6d8214fe48ccb45304210bfef79bca91b3aa66933cdee307311bf23044c560778
SSDEEP 3072:Y61vWmWldAWPpWB6kZSIvcWZavLyHOZpB0Sozr:7WmWrAWBCtZOZf/W
TLSH
T149C3C323763983FDF68A40706864871A124E54308FE9C6EF9F0E1E6E19E12E35D79357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAO_CosNotification.dll

Path C:\Program Files (x86)\Novosoft\Handy Backup 7\TAO_CosNotification.dll
Size 684KB
SHA256 f7c7860a3c564c6b64457acbccb0b7e3fec738e17361845f192eaa0b598e265f
MD5 274519044ed0ff8738c5659a43ad3294
SHA1 174b40c0d7ed447e04aa87259e759163a2fb6341
SHA512 bcde68eb2871fe24cd88097053ad9060b6dbccc80f33f380d3508417727062134c186374bff5d65026ccd22209f3c58b7265b12cb2d1ae2e48c5147a7815ffca
SSDEEP 12288:Vm9mCXXD5GLmRGkm0vaXmFm1Vm4mkpFmo2zmo9mDompymcFm2mdm1m+m+/mAmOZN:iXTTglyn
TLSH
T109E41666FA2AC37AF5CDB034A970D74E415EA4F0572A90C3F74D866588622C38B3D71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAO_CosNotification_Serv.dll

Path C:\Program Files (x86)\Novosoft\Handy Backup 7\TAO_CosNotification_Serv.dll
Size 836KB
SHA256 edc058e88c3b49994a1ef51242d774ce19ea52671b808e674819570305b8544c
MD5 81041e389add643ee16782195aef861a
SHA1 c99e49d4c335c9583a8f18f4d5a5cf4c44ddd142
SHA512 b6a745fd3197b0531a9f97ff73a27ad094a9d157cd77caf24dbe357eb89035b00c5b8f9bb3da50944e87ba9d1da207268c7f8ac542ba7da2daf35f556c87a52d
SSDEEP 24576:Zjbvi4TGEF79I92zpVAFZAn9hK0KMX16uo7+220:hGUhiMX16uo7+E
TLSH
T11F050AA5BA5EC53AD08CA13405F9D29BCF2F93E50729E4C7E3169E6590B01D70B3B21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAO_CosNotification_Skel.dll

Path C:\Program Files (x86)\Novosoft\Handy Backup 7\TAO_CosNotification_Skel.dll
Size 486KB
SHA256 50ae68f49086f4c119b3f4225f6cd516690f0d0faa936bef6ab6de0ce99295cc
MD5 722bf1b0ee7ab769abeb827827dce246
SHA1 3711592de501c44ae805f0741ab3703a34dec52a
SHA512 1f5e712489540d98b37ceb6fd50bbd5170e1bfbdfdd29f6cbab80fee03f1547c326950d61b7db0fce2fb7df92a0ffd5cdb3da445ebe6eddde2ff2986a34ff697
SSDEEP 6144:wZj8n8dc2B8wkk6Fc/VLXOo/zPOZY5WX:wZj8n8dc2B8wkuVio/
TLSH
T13CB49565EA5AC7A9C6CE7038D5B9C78A832E66D563D5C1C3A705CC36E0A31C3DD3A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAO_PortableServer.dll

Path C:\Program Files (x86)\Novosoft\Handy Backup 7\TAO_PortableServer.dll
Size 497KB
SHA256 1e442bc21c500a3360afd51ffc635326708cad44b92d7c3f7e7185657eeff795
MD5 0a9b9dc38eb8c5b67981fdea4504c05b
SHA1 40b2db49e85efb2a4846cf1a0372d102361ca970
SHA512 c2c06e2ccee8e8c8952c0946dbff81a89ca270fe54231572fba7abb856f75e47293412abd7e5e00c400ddf114b401af1c3570a89671b3949a138ed6528450399
SSDEEP 6144:mX97P60ICKP4TOqXYOZGf4xTi8PzKOZ40j5M4RhHkPpFFUTPB:mX97C0ICO5nbIUFyTp
TLSH
T128B41B31EF2FD669C6CE82346C38C79D814D6A811798E5D3CB4DCA2E24971C74B3A663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbcc.exe

Path C:\Program Files (x86)\Novosoft\Handy Backup 7\hbcc.exe
Size 413KB
SHA256 8f2f29967126bfec2ea24f8c4605e6ca57522d3e90b66267eb57c2f193001df7
MD5 b3ffc479a789604dbd532b8b717e99f0
SHA1 9a3cbd3b778b14428dfa81564bae096d93c2eb6b
SHA512 bae4b3c3e6ad364134d2ff30810b0a0ef244f79f15df5b75db5fe208bc48ae307e133f3d26f04863ae11e428750185fba8032b4e71665b9bd2bb86743b020ccd
SSDEEP 12288:Io4lotopeoloYojoto8oaoeoYoyosoPogoCoWfouo3Tx8w7CCSln7TqFd:wTWw7CCSl7TUd
TLSH
T11A941811BB15C175EAA232B54E79AB4F502CFD404F78A5C7E38C1AAE6C712D25E3930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

res.dll

Path C:\Program Files (x86)\Novosoft\Handy Backup 7\res.dll
Size 875KB
SHA256 a02b6a57e9cd7f0dd4ff6a0517198da04252c53ee3bdefe23488573cad23cde5
MD5 d195ea77bf0b0a892778761a7e87e102
SHA1 5ecdc4a37ae1237f4dad6906a1853144534f99a9
SHA512 92748a2790fabe5c56ac03341940e48049cc5cf2ad715a62bbca299e6a810fecfa7ce8062c190cd1afbd9721dda1a109d36bb52ecab436451cf9c37754ff1b6e
SSDEEP 12288:5eu+4OtYezm8/8YNVAwtmdkd19RXa7TWzc:5D+p7J8wKwtmdkd1S7
TLSH
T155154A55CC0C4F6DD2A8F2F0961EDD2951257C20B394E23E5A74B948E6B23982EF0BDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

workstation.hbl

Path C:\ProgramData\Novosoft\Handy Backup 7\Settings\Services\workstation.hbl
Size 554B
SHA256 d2f7a54766683dc03e58b018b175ef2b3eec01ec8330196e45245c43dbc6fc37
MD5 2ab67490826a24395d45e5a3ea8ebd7c
SHA1 5cd6b833863a961c000851d76e1a3e95d5d6780e
SHA512 572a75a68a7210a4c912db758e89f0d904fff02b82a7d90697022bcbbd5f2f829755be8bb8e004ac92b412a871629c7c773b08d8535605d70d51d4f3290fc672
TLSH
T19EF062207962DF11D703573BCEB3B484B11648693119781444DF6C7BA26D2F95F48E28
MD5 SHA1 SHA512 TLSH

Submit Download

server.hbl

Path C:\Users\Admin\AppData\Roaming\Novosoft\Handy Backup 7\Settings\Services\server.hbl
Size 2KB
SHA256 7d2767eb3a87fbad39b0e2cd6544809a9e1dc3976c519fe50f0025aaad207b6c
MD5 22d76b58b2a8338b01c29a1f4c257b22
SHA1 2649b31abab7ab71180427b468dcce5a018e8d08
SHA512 6eeb6c286c7a0d7c1543a46d508adea101ac512600df6345bc092e21d8922e47ea8dc2e18a99e24df43019ac5e39aec0425ef21f2d6ac5ef26e72b801aeb7dd9
TLSH
T1FF51E9C4FD074A626B16AAC5DFD40D8BA319C57D1270643920FFBE4519AF0E8682A37C
MD5 SHA1 SHA512 TLSH

Submit Download

MSI5277.tmp

Path C:\Windows\Installer\MSI5277.tmp
Size 148KB
SHA256 fa9b83479f1b955790325dc557624185a8c72df3e31870dae075437146858185
MD5 14c01c848d8452005734858a64b6784b
SHA1 d3d81fcd1267095880218ef09b92220248905ea8
SHA512 8334c467c470c13b0245425d3bc1ba9676a04e1e015bec56122504d622e7e3858d5ad7950d09c155f3666a90b7d3c7b40f324d0786553d6e81711b7f38cf1d57
SSDEEP 1536:LJBXpE+chXzGFcvDKeQlWe+LTwhT06Ua/782ix4UjAr628r4TbmMOI5IJhb6+I1v:1FpEPXElP22c4GusR6ZKX1PJEQ7+kQ+
TLSH
T1CDE38F327085D175F2A218B7E96AC2719D3DF1280B2085CD5B828D9FAD28496BFF7703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI5557.tmp

Path C:\Windows\Installer\MSI5557.tmp
Size 75KB
SHA256 2adf199f6baf245f0b07d31a3a1401d4262c3e6c98b8f10df923ceb2c937291e
MD5 6f8e3e4f72620bddc633f0175f47161e
SHA1 53ed75a208cc84f1a065e9e4ece356371cac0341
SHA512 80187277e78f59b7ea71ed3caa55452e730d93b8c296d5820d470776a428cbb7e7fead87240e811436f85e4d89df2b9f31d6d16658d21abf59395cab7074a869
SSDEEP 1536:xsPAv1yiUHmByZXTN5GCOPRj15+3rT0q6Mnu:x0AvSXTNOtHKTZ6
TLSH
T182737C2172A1C176D1A66436F629C2721E3EB5302BA488CBBB5607BE4E302D1F677307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI5642.tmp

Path C:\Windows\Installer\MSI5642.tmp
Size 214KB
SHA256 ad05944fa5131b64195bc7559430e432043667b9543e8ee12d33149eb0a89ea2
MD5 ac4d31769f20a0b733364025dc59863d
SHA1 fe6eed010561c46d8bc7ac9d51a73262c1b5d2a7
SHA512 e11d221fb76fdf03b97141740dc0c75b0b2c27514164df800c0e92c5cf689663b51ff650aad959e762461c63f39d8e7cbc0842260d7266a2e0fd99ec6fca8574
SSDEEP 3072:XnEW8d3zdIgMYSBbL5a4jWt44dD7phQC1+avKQ6Z:j8d3ZYL/WtndD7PnY
TLSH
T1CB2439307660543DD5B149F2F719C5B0AE3DF1185BA088AE97B58E4E2C2C896BBF7306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a3f7d.msi

Path C:\Windows\Installer\e5a3f7d.msi
Size 23.0MB
SHA256 7bfde9564a093b42a2c8c6e0f7d10297822d95f228aaefe4ba2921ea60babdb3
MD5 f415145ecadd81dfe709dffc5bde85be
SHA1 81b7dfddb1ec2003fcb8340872164f45236b555e
SHA512 2d78d8c29a1bb98f288f1ac13b28d25ad4847c3ee1d841c471ee7a9a1fa7b317c3ea3b773a238423c496f21be0ef5b4eb283e2a9d43c6016460e61a5d0ceba55
SSDEEP 393216:0zJPgS4pqZG3wLL9HtU168+GTn6/OJF/MSoE7VnhwoyNqtn312CnXTM1W4:eJPwpqkALZH2T6mJJMNE75OKnFM1W
TLSH
T1C0373321B44095B9D1321736972BE6605F7DAC3C0BF1101AAB6AB74F0D3A790A7B7F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 0327798cc59b7dc7d3ba558e9df82ab56d34753ad272dcd87004947909995280
MD5 1e2c123b30f669acc5fc3a856d4ecd4f
SHA1 ab8d289eeb7d6b660fc382031b91da9f987e9f0b
SHA512 570ceaa8f6e6a75a6929b29ea8efc9e2c0cce77b9284e031461b632b212d15a1943da993ed13af97f403d8ad3530cae4f8b1db8eaa5ee1522eaf5fe5b1a482c8
SSDEEP 24576:JFo3DMPLdoO/vvTL/yAsMilQPrOWX7rf0R6e9BCE65iqpLNMMoR2s12NoeG:HH4
TLSH
T10A57B51436F92100E7F79E3CA8F06A234D397D5BAC19DE8D45511B8E0922F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{058e9ec4-9305-4e1e-9268-484674eb8714}_OnDiskSnapshotProp

Path \??\Volume{c61fbfff-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{058e9ec4-9305-4e1e-9268-484674eb8714}_OnDiskSnapshotProp
Size 6KB
SHA256 ca1dc5ce07ea2a1e3a079983958288fc0967a13877688a15ccf55f5f6cece4e7
MD5 f1a5f55d6684e43257f915d7f601427e
SHA1 99addaddef020885ce1b96ff7139e5b7c68aaf93
SHA512 31683e77aa5ba587e98d3ae3559a9ebe06525982b7f26024c4ec0c70ef96a47423f11b5515f844393955cb3b3ed07ef3c2d486835f0fa6017239ae513b728b98
SSDEEP 96:F1tzW5muJlDvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:fkXl/b++uVmN
TLSH
T194D1890C1AF54711E2B3AB3229F14557A877B911EF33CB8E0198638E6671910F835F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5744-382-0x0000000010000000-0x000000001025E000-memory.dmp

Download

memory/5744-444-0x0000000010000000-0x000000001025E000-memory.dmp

Download

memory/5744-460-0x0000000010000000-0x000000001025E000-memory.dmp

Download

memory/5744-463-0x0000000010000000-0x000000001025E000-memory.dmp

Download

memory/5744-466-0x0000000010000000-0x000000001025E000-memory.dmp

Download