Cuckoo Sandbox

Name	a0bbe7a1d2e3c9bf_backup.exe Download Submit file
Filepath	C:\Users\Administrator\AppData\Local\Temp\0C7910BA-F902-421E-9E69-CF9AEE0DD4D7\backup.exe
Size	172.5KB
Processes	708 (b4b14fe5439acf6c66bc7970850945a086bef6ba83ac7c6bb12a8caf3d9c9571.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`75958628673542b94ebaa5d95f846c80`
SHA1	`572478e7a7973ed3493df6417c3e8ccc0dfead8b`
SHA256	`a0bbe7a1d2e3c9bf9b9a60d7deda9c82be49f431220cd91d5d836689d0170f7c`
CRC32	`EF019D13`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Name	e0422dc09f2d8d03_backup.exe Download Submit file
Filepath	C:\backup.exe
Size	172.5KB
Processes	1344 (backup.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`c01d4fb8599355d41a40c0a841785f11`
SHA1	`3ecde090e2b1be337f6cc857d0e51d83fc2774c6`
SHA256	`e0422dc09f2d8d03b75f1801f05fa006aec0f64348d2215403ff26b7a7d0b778`
CRC32	`E58C87D2`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Dropped Files