Cuckoo Sandbox

Name	0c661898adbf0f9c_backup.exe Download Submit file
Filepath	C:\Users\Administrator\AppData\Local\Temp\0C7910BA-F902-421E-9E69-CF9AEE0DD4D7\backup.exe
Size	286.4KB
Processes	2728 (662bf37cc6d638c6bdf7e7845b4dd97f95a0257f252d5dbed215c22bb1653d3c.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`246bc1448ad08e8e2accdf80d1fc01ca`
SHA1	`2e6944fe2f397939c78ecbfdbd78f0f37f5438ea`
SHA256	`0c661898adbf0f9c75b04a77a83432626084916dbc7d98ea2eeed05c07405e54`
CRC32	`B7AF9907`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Name	f215b961c3e6cc08_backup.exe Download Submit file
Filepath	C:\backup.exe
Size	286.4KB
Processes	2340 (backup.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`e86ddd70b20025e6f7176bae8cf041b8`
SHA1	`2988f029a8ce9c75ca953ad7e7ae58f612d90287`
SHA256	`f215b961c3e6cc0823b3155ac5f6fb667b6b53d1f051d3a7977b327dd1f66229`
CRC32	`17F405E6`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Dropped Files