b69ae4a13dff3e76060d9bfa66bb838d0881e5a79b82ec5bf647d6256415b92a

Analysis

max time kernel
189s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b69ae4a13dff3e76060d9bfa66bb838d0881e5a79b82ec5bf647d6256415b92a.exe
Size

96KB
MD5

347fafe56ef50d6edb9f81d47dc40731
SHA1

3c66549b28ae60c4028e0833efdde00303f54511
SHA256

b69ae4a13dff3e76060d9bfa66bb838d0881e5a79b82ec5bf647d6256415b92a
SHA512

5e8ae51ee81d911d1f2902552fab9f34f13d0d8f699312be3bea84a12e621c41c8ed477929596de1112c30f7d7ace2d97241bcf8db509122e60030f3c049c0b9
SSDEEP

1536:O9wvQUreUbyzsB+2zeNOpQxgbZdCNlv4wsaec7ht0LGa8:SA/yzn2ze8pnbZd0v33/h6

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 10 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

regedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	regedit.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 10 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

regedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	regedit.exe

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 7 IoCs

Processes:

cmd.execmd.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Drivers\Driver.sys	cmd.exe
File created	C:\Windows\SysWOW64\Drivers\USBInfo.vbe	cmd.exe
File created	C:\Windows\SysWOW64\Drivers\USBInfo.sy_	cmd.exe
File created	C:\Windows\SysWOW64\Drivers\USBSys.vbe	cmd.exe
File created	C:\Windows\SysWOW64\Drivers\USBInfo.com	cmd.exe
File opened for modification	C:\Windows\SysWOW64\Drivers\USBInfo.com	cmd.exe
File created	C:\Windows\SysWOW64\Drivers\USBStor.vbe	cmd.exe

Executes dropped EXE 1 IoCs

Processes:

USBInfo.com

pid process

4576 USBInfo.com

pid	process
4576	USBInfo.com

Sets file to hidden 1 TTPs 64 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid	process
1932	attrib.exe
3756	attrib.exe
2552	attrib.exe
4028	attrib.exe
4040	attrib.exe
4588	attrib.exe
3440	attrib.exe
3108	attrib.exe
868	attrib.exe
1652	attrib.exe
1032	attrib.exe
3600	attrib.exe
4680	attrib.exe
1920	attrib.exe
1168	attrib.exe
1460	attrib.exe
5048	attrib.exe
4920	attrib.exe
984	attrib.exe
364	attrib.exe
3440	attrib.exe
3596	attrib.exe
4560	attrib.exe
3708	attrib.exe
3856	attrib.exe
4612	attrib.exe
1264	attrib.exe
1060	attrib.exe
3236	attrib.exe
792	attrib.exe
4900	attrib.exe
4296	attrib.exe
3484	attrib.exe
4328	attrib.exe
1540	attrib.exe
3328	attrib.exe
3340	attrib.exe
4284	attrib.exe
4300	attrib.exe
1496	attrib.exe
3076	attrib.exe
5032	attrib.exe
4848	attrib.exe
2924	attrib.exe
760	attrib.exe
1656	attrib.exe
1916	attrib.exe
2112	attrib.exe
3232	attrib.exe
880	attrib.exe
3376	attrib.exe
904	attrib.exe
728	attrib.exe
4980	attrib.exe
3472	attrib.exe
3136	attrib.exe
5064	attrib.exe
3760	attrib.exe
4088	attrib.exe
4928	attrib.exe
8	attrib.exe
1332	attrib.exe
3484	attrib.exe
1912	attrib.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cmd.exeWScript.execmd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

regedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\@ = "c:\\windows\\system32\\Drivers\\USBInfo.com"	regedit.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\@ = "c:\\windows\\system32\\Drivers\\USBInfo.com"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\@ = "c:\\windows\\system32\\Drivers\\USBInfo.com"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\@ = "c:\\windows\\system32\\Drivers\\USBInfo.com"	regedit.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\@ = "c:\\windows\\system32\\Drivers\\USBInfo.com"	regedit.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	regedit.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\@ = "c:\\windows\\system32\\Drivers\\USBInfo.com"	regedit.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\@ = "c:\\windows\\system32\\Drivers\\USBInfo.com"	regedit.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\@ = "c:\\windows\\system32\\Drivers\\USBInfo.com"	regedit.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\@ = "c:\\windows\\system32\\Drivers\\USBInfo.com"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\@ = "c:\\windows\\system32\\Drivers\\USBInfo.com"	regedit.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	regedit.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	regedit.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\\desktop.ini cmd.exe
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Processes:

cmd.exeattrib.exe

description ioc process

File created C:\\autorun.inf cmd.exe
File opened for modification C:\autorun.inf attrib.exe
Drops file in System32 directory 2 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Windows\SysWOW64\ScreenSave.scr cmd.exe
File opened for modification C:\Windows\SysWOW64\ScreenSave.scr cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\\desktop.ini	cmd.exe

description	ioc	process
File created	C:\\autorun.inf	cmd.exe
File opened for modification	C:\autorun.inf	attrib.exe

description	ioc	process
File created	C:\Windows\SysWOW64\ScreenSave.scr	cmd.exe
File opened for modification	C:\Windows\SysWOW64\ScreenSave.scr	cmd.exe

Kills process with taskkill 10 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
3580	taskkill.exe
3020	taskkill.exe
1384	taskkill.exe
2072	taskkill.exe
3336	taskkill.exe
3896	taskkill.exe
4852	taskkill.exe
3904	taskkill.exe
3756	taskkill.exe
2652	taskkill.exe

Modifies registry class 2 IoCs

Processes:

cmd.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	cmd.exe

Runs regedit.exe 10 IoCs

Processes:

regedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exe

pid	process
4888	regedit.exe
4588	regedit.exe
3936	regedit.exe
4040	regedit.exe
1660	regedit.exe
3316	regedit.exe
2712	regedit.exe
4496	regedit.exe
1620	regedit.exe
4816	regedit.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	4852	taskkill.exe
Token: SeDebugPrivilege	3904	taskkill.exe
Token: SeDebugPrivilege	3580	taskkill.exe
Token: SeDebugPrivilege	3020	taskkill.exe
Token: SeDebugPrivilege	1384	taskkill.exe
Token: SeDebugPrivilege	2072	taskkill.exe
Token: SeDebugPrivilege	3336	taskkill.exe
Token: SeDebugPrivilege	3756	taskkill.exe
Token: SeDebugPrivilege	3896	taskkill.exe
Token: SeDebugPrivilege	2652	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b69ae4a13dff3e76060d9bfa66bb838d0881e5a79b82ec5bf647d6256415b92a.execmd.exeWScript.exeUSBInfo.comcmd.exe

description	pid	process	target process
PID 4088 wrote to memory of 3412	4088	b69ae4a13dff3e76060d9bfa66bb838d0881e5a79b82ec5bf647d6256415b92a.exe	cmd.exe
PID 4088 wrote to memory of 3412	4088	b69ae4a13dff3e76060d9bfa66bb838d0881e5a79b82ec5bf647d6256415b92a.exe	cmd.exe
PID 4088 wrote to memory of 3412	4088	b69ae4a13dff3e76060d9bfa66bb838d0881e5a79b82ec5bf647d6256415b92a.exe	cmd.exe
PID 3412 wrote to memory of 4828	3412	cmd.exe	attrib.exe
PID 3412 wrote to memory of 4828	3412	cmd.exe	attrib.exe
PID 3412 wrote to memory of 4828	3412	cmd.exe	attrib.exe
PID 3412 wrote to memory of 4480	3412	cmd.exe	WScript.exe
PID 3412 wrote to memory of 4480	3412	cmd.exe	WScript.exe
PID 3412 wrote to memory of 4480	3412	cmd.exe	WScript.exe
PID 3412 wrote to memory of 3972	3412	cmd.exe	WScript.exe
PID 3412 wrote to memory of 3972	3412	cmd.exe	WScript.exe
PID 3412 wrote to memory of 3972	3412	cmd.exe	WScript.exe
PID 3972 wrote to memory of 4576	3972	WScript.exe	USBInfo.com
PID 3972 wrote to memory of 4576	3972	WScript.exe	USBInfo.com
PID 3972 wrote to memory of 4576	3972	WScript.exe	USBInfo.com
PID 4576 wrote to memory of 2276	4576	USBInfo.com	cmd.exe
PID 4576 wrote to memory of 2276	4576	USBInfo.com	cmd.exe
PID 4576 wrote to memory of 2276	4576	USBInfo.com	cmd.exe
PID 2276 wrote to memory of 4852	2276	cmd.exe	taskkill.exe
PID 2276 wrote to memory of 4852	2276	cmd.exe	taskkill.exe
PID 2276 wrote to memory of 4852	2276	cmd.exe	taskkill.exe
PID 2276 wrote to memory of 3936	2276	cmd.exe	regedit.exe
PID 2276 wrote to memory of 3936	2276	cmd.exe	regedit.exe
PID 2276 wrote to memory of 3936	2276	cmd.exe	regedit.exe
PID 2276 wrote to memory of 3348	2276	cmd.exe	WScript.exe
PID 2276 wrote to memory of 3348	2276	cmd.exe	WScript.exe
PID 2276 wrote to memory of 3348	2276	cmd.exe	WScript.exe
PID 2276 wrote to memory of 4568	2276	cmd.exe	WScript.exe
PID 2276 wrote to memory of 4568	2276	cmd.exe	WScript.exe
PID 2276 wrote to memory of 4568	2276	cmd.exe	WScript.exe
PID 2276 wrote to memory of 3136	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 3136	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 3136	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 2112	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 2112	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 2112	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 1060	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 1060	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 1060	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 5064	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 5064	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 5064	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 1932	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 1932	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 1932	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 3760	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 3760	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 3760	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 3340	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 3340	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 3340	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 792	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 792	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 792	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 3076	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 3076	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 3076	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 868	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 868	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 868	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 4588	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 4588	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 4588	2276	cmd.exe	attrib.exe
PID 2276 wrote to memory of 1332	2276	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 64 IoCs

evasion

Hidden Files and Directories

T1158

Processes:

pid	process
4028	attrib.exe
1652	attrib.exe
3328	attrib.exe
1916	attrib.exe
792	attrib.exe
4284	attrib.exe
3600	attrib.exe
4040	attrib.exe
1932	attrib.exe
4848	attrib.exe
3108	attrib.exe
8	attrib.exe
3136	attrib.exe
2552	attrib.exe
3236	attrib.exe
4900	attrib.exe
3232	attrib.exe
1460	attrib.exe
5032	attrib.exe
4560	attrib.exe
1540	attrib.exe
3440	attrib.exe
2112	attrib.exe
3596	attrib.exe
1912	attrib.exe
4588	attrib.exe
4680	attrib.exe
2932	attrib.exe
364	attrib.exe
760	attrib.exe
3484	attrib.exe
4328	attrib.exe
4300	attrib.exe
4928	attrib.exe
868	attrib.exe
1332	attrib.exe
3484	attrib.exe
4296	attrib.exe
1496	attrib.exe
3076	attrib.exe
2924	attrib.exe
440	attrib.exe
4920	attrib.exe
4980	attrib.exe
5064	attrib.exe
880	attrib.exe
1656	attrib.exe
728	attrib.exe
3760	attrib.exe
3756	attrib.exe
4088	attrib.exe
1032	attrib.exe
1920	attrib.exe
3472	attrib.exe
904	attrib.exe
984	attrib.exe
1060	attrib.exe
1168	attrib.exe
3440	attrib.exe
5048	attrib.exe
4612	attrib.exe
3376	attrib.exe
1264	attrib.exe
4828	attrib.exe

C:\Users\Admin\AppData\Local\Temp\b69ae4a13dff3e76060d9bfa66bb838d0881e5a79b82ec5bf647d6256415b92a.exe
"C:\Users\Admin\AppData\Local\Temp\b69ae4a13dff3e76060d9bfa66bb838d0881e5a79b82ec5bf647d6256415b92a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4088

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~2839.bat "C:\Users\Admin\AppData\Local\Temp\b69ae4a13dff3e76060d9bfa66bb838d0881e5a79b82ec5bf647d6256415b92a.exe"
2⤵
- Drops file in Drivers directory
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3412

C:\Windows\SysWOW64\attrib.exe
attrib -s -h "C:\Users\Admin\AppData\Local\Temp\b69ae4a13dff3e76060d9bfa66bb838d0881e5a79b82ec5bf647d6256415b92a.exe"
3⤵
- Views/modifies file attributes
PID:4828

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
3⤵
PID:4480

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBInfo.vbe"
3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3972

C:\Windows\SysWOW64\Drivers\USBInfo.com
"C:\Windows\system32\Drivers\USBInfo.com"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~83C6.bat "C:\Windows\system32\Drivers\USBInfo.com"
5⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2276

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Windows\SysWOW64\regedit.exe
regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
6⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Runs regedit.exe
PID:3936

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
6⤵
PID:3348

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
6⤵
PID:4568

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h ╬─╝■╝╨.exe
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3136

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h autorun.inf
6⤵
- Sets file to hidden
- Drops autorun.inf file
- Views/modifies file attributes
PID:2112

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "$Recycle.Bin"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1060

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "Documents and Settings"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:5064

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "odt"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1932

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "PerfLogs"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3760

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "Program Files"
6⤵
- Sets file to hidden
PID:3340

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "Program Files (x86)"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:792

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "ProgramData"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3076

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "Recovery"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:868

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "System Volume Information"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4588

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "Users"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1332

C:\Windows\SysWOW64\attrib.exe
attrib +s +h "Windows"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3756

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "recycler.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:364

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "system volume information.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1168

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
6⤵
PID:2672

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h ╬─╝■╝╨.exe
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3440

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "recycler.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2552

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "system volume information.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3232

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3904

C:\Windows\SysWOW64\regedit.exe
regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
6⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Runs regedit.exe
PID:4040

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
6⤵
PID:2636

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
6⤵
PID:116

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h ╬─╝■╝╨.exe
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1460

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "recycler.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:5032

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "system volume information.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3596

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
6⤵
PID:944

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h ╬─╝■╝╨.exe
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4284

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "recycler.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3484

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "system volume information.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:5048

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Windows\SysWOW64\regedit.exe
regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
6⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Runs regedit.exe
PID:4888

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
6⤵
PID:1660

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
6⤵
PID:3348

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h ╬─╝■╝╨.exe
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3236

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "recycler.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1912

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "system volume information.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4900

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
6⤵
PID:808

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h ╬─╝■╝╨.exe
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:880

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "recycler.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4296

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "system volume information.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4612

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3020

C:\Windows\SysWOW64\regedit.exe
regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
6⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Runs regedit.exe
PID:1620

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
6⤵
PID:4784

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
6⤵
PID:4292

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h ╬─╝■╝╨.exe
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4028

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "recycler.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4848

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "system volume information.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2924

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
6⤵
PID:4720

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h ╬─╝■╝╨.exe
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:760

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "recycler.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3600

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "system volume information.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4088

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1384

C:\Windows\SysWOW64\regedit.exe
regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
6⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Runs regedit.exe
PID:4816

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
6⤵
PID:5056

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
6⤵
PID:3596

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h ╬─╝■╝╨.exe
6⤵
- Views/modifies file attributes
PID:440

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "recycler.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4560

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "system volume information.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3484

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
6⤵
PID:5048

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h ╬─╝■╝╨.exe
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3376

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "recycler.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4328

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "system volume information.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2072

C:\Windows\SysWOW64\regedit.exe
regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
6⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Runs regedit.exe
PID:1660

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
6⤵
PID:3420

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
6⤵
PID:1720

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h ╬─╝■╝╨.exe
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4980

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "recycler.exe"
6⤵
- Sets file to hidden
PID:3708

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "system volume information.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:904

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
6⤵
PID:2216

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h ╬─╝■╝╨.exe
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1652

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "recycler.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1540

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "system volume information.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:984

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3336

C:\Windows\SysWOW64\regedit.exe
regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
6⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Runs regedit.exe
PID:3316

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
6⤵
PID:1360

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
6⤵
PID:3620

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h ╬─╝■╝╨.exe
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1032

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "recycler.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1656

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "system volume information.exe"
6⤵
- Sets file to hidden
PID:3856

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
6⤵
PID:2232

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h ╬─╝■╝╨.exe
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4680

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "recycler.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:728

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "system volume information.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3756

C:\Windows\SysWOW64\regedit.exe
regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
6⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Runs regedit.exe
PID:2712

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
6⤵
PID:3084

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
6⤵
PID:2836

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h ╬─╝■╝╨.exe
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4300

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "recycler.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1496

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "system volume information.exe"
6⤵
- Views/modifies file attributes
PID:2932

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
6⤵
PID:2908

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h ╬─╝■╝╨.exe
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4928

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "recycler.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3440

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "system volume information.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1264

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3896

C:\Windows\SysWOW64\regedit.exe
regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
6⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Runs regedit.exe
PID:4496

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
6⤵
PID:3904

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
6⤵
PID:4924

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h ╬─╝■╝╨.exe
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3472

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "recycler.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4040

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "system volume information.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3108

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
6⤵
PID:5064

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h ╬─╝■╝╨.exe
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3328

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "recycler.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:8

C:\Windows\SysWOW64\attrib.exe
attrib +a +r +s +h "system volume information.exe"
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1916

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2652

C:\Windows\SysWOW64\regedit.exe
regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
6⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Runs regedit.exe
PID:4588

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
6⤵
PID:2636

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\System Volume Information.exe
Filesize
96KB

MD5
347fafe56ef50d6edb9f81d47dc40731

SHA1
3c66549b28ae60c4028e0833efdde00303f54511

SHA256
b69ae4a13dff3e76060d9bfa66bb838d0881e5a79b82ec5bf647d6256415b92a

SHA512
5e8ae51ee81d911d1f2902552fab9f34f13d0d8f699312be3bea84a12e621c41c8ed477929596de1112c30f7d7ace2d97241bcf8db509122e60030f3c049c0b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\~2839.bat
Filesize
4KB

MD5
bc278224d87330dbedf84ddefdced3f1

SHA1
0a21b60897db6bd7559fef583bb095266110b653

SHA256
1d75230f2ab4daeb62d42bb1bea8a5c4c9f6831f3830407f9615677dc29dac7a

SHA512
6ff654c73c68420d97657657f77d3934aaa60fddceca095d0f9d3f169e6fab7435d3a758f0d3eae086b2ee32ea7e5c0fa3ba602bc9416e0e1e2ca8743f0d846a

Download Submit
C:\Users\Admin\AppData\Local\Temp\~83C6.bat
Filesize
4KB

MD5
bc278224d87330dbedf84ddefdced3f1

SHA1
0a21b60897db6bd7559fef583bb095266110b653

SHA256
1d75230f2ab4daeb62d42bb1bea8a5c4c9f6831f3830407f9615677dc29dac7a

SHA512
6ff654c73c68420d97657657f77d3934aaa60fddceca095d0f9d3f169e6fab7435d3a758f0d3eae086b2ee32ea7e5c0fa3ba602bc9416e0e1e2ca8743f0d846a

Download Submit
C:\Windows\SysWOW64\Drivers\USBInfo.com
Filesize
96KB

MD5
347fafe56ef50d6edb9f81d47dc40731

SHA1
3c66549b28ae60c4028e0833efdde00303f54511

SHA256
b69ae4a13dff3e76060d9bfa66bb838d0881e5a79b82ec5bf647d6256415b92a

SHA512
5e8ae51ee81d911d1f2902552fab9f34f13d0d8f699312be3bea84a12e621c41c8ed477929596de1112c30f7d7ace2d97241bcf8db509122e60030f3c049c0b9

Download Submit
C:\Windows\SysWOW64\Drivers\USBInfo.vbe
Filesize
77B

MD5
54ceb8eabaff522c097e4949d39fbd09

SHA1
304fd3c274aac25477ba1f3f500ae34e6c94612d

SHA256
d2d64a938a71d1b747112176eeb345991433fc81475a397b85b6b4c3d97f8550

SHA512
3c6ce4fe30121305b176a3ccc7358343bfdd28537358e7289e4354b52f152c018acfe843659df5bd35228fca804b0285baa8350e2b6ca39719bdefdb77b2e0be

Download Submit
C:\Windows\SysWOW64\Drivers\USBStor.vbe
Filesize
20B

MD5
905d7a48a13a75ced1342bbdf0a3ace2

SHA1
3bcc021a82ed38810bcf61286eb1f4e578e3721f

SHA256
10338a72fbacb4fdf731d8937cdf23519896c5122b6a80079527cebf8406b3cd

SHA512
fe77b8b928ba1ffb1a8bf941b2a0279b3ca6512d30dd1a2e2f363f9b2be245e361fab40232bc868f0f7e79bacc476653a49b66d2cf6945ed87b0c776783db8c1

Download Submit
C:\Windows\SysWOW64\Drivers\USBSys.vbe
Filesize
19B

MD5
322866ac1312f3bc0dd8685949f35b6a

SHA1
dc3f64764aa99595ee48721142d2301ebbe07aec

SHA256
5417fd3704beb2760ed54c38048ae44d2cd49312be2a8f104e542bbd5bbc88d6

SHA512
1b5c2320beaeb34895a1d11882566463d365a128db4d260189850990e1215ce737334ee96b43ecd2c018f040548209cc6f11328a5a9b9eb5f57fc6ac61afe03d

Download Submit
C:\Windows\SysWOW64\drivers\USBInfo.com
Filesize
96KB

MD5
347fafe56ef50d6edb9f81d47dc40731

SHA1
3c66549b28ae60c4028e0833efdde00303f54511

SHA256
b69ae4a13dff3e76060d9bfa66bb838d0881e5a79b82ec5bf647d6256415b92a

SHA512
5e8ae51ee81d911d1f2902552fab9f34f13d0d8f699312be3bea84a12e621c41c8ed477929596de1112c30f7d7ace2d97241bcf8db509122e60030f3c049c0b9

Download Submit
C:\Windows\SysWOW64\drivers\USBInfo.sy_
Filesize
1KB

MD5
e3f32bf45469d18567e23485109ffdd4

SHA1
2e207b073a4237e05b5da89f9ca2e9771757620c

SHA256
e41ad345599c751ed8b124229df31681f2c44d322d092f85c2205b97f09c8a81

SHA512
e8ab034c883c747d6a093d1221e080adf84a1c3662e4469c59cf49f693561262d435c28eede60e18151222fd9562abc6c81b6a57fa5587032cbc2d0b74a0c0e5

Download Submit
C:\autorun.inf
Filesize
149B

MD5
babb9292822f6963475088494e446a00

SHA1
d0f96ea279562a899f24b5a6905065de029877b0

SHA256
bff5694d6d4c8a41217fa9d98d95c355a6f63ef939a4ef89bc45d1cf443a1f9d

SHA512
b96daa0a52867f7f0454c8b35d85682aa22c3ac59495760c95204cc1cfc419bd88b5cc59d92dfab5a6343f8f86659e35e2f38cda0c1ea014d2377ab5e525fd5b

Download Submit
C:\╬─╝■╝╨.exe
Filesize
96KB

MD5
347fafe56ef50d6edb9f81d47dc40731

SHA1
3c66549b28ae60c4028e0833efdde00303f54511

SHA256
b69ae4a13dff3e76060d9bfa66bb838d0881e5a79b82ec5bf647d6256415b92a

SHA512
5e8ae51ee81d911d1f2902552fab9f34f13d0d8f699312be3bea84a12e621c41c8ed477929596de1112c30f7d7ace2d97241bcf8db509122e60030f3c049c0b9

Download Submit
memory/116-175-0x0000000000000000-mapping.dmp

Download
memory/364-165-0x0000000000000000-mapping.dmp

Download
memory/760-202-0x0000000000000000-mapping.dmp

Download
memory/792-159-0x0000000000000000-mapping.dmp

Download
memory/808-190-0x0000000000000000-mapping.dmp

Download
memory/868-161-0x0000000000000000-mapping.dmp

Download
memory/880-191-0x0000000000000000-mapping.dmp

Download
memory/944-179-0x0000000000000000-mapping.dmp

Download
memory/1060-154-0x0000000000000000-mapping.dmp

Download
memory/1168-166-0x0000000000000000-mapping.dmp

Download
memory/1332-163-0x0000000000000000-mapping.dmp

Download
memory/1384-205-0x0000000000000000-mapping.dmp

Download
memory/1460-176-0x0000000000000000-mapping.dmp

Download
memory/1620-195-0x0000000000000000-mapping.dmp

Download
memory/1660-185-0x0000000000000000-mapping.dmp

Download
memory/1912-188-0x0000000000000000-mapping.dmp

Download
memory/1932-156-0x0000000000000000-mapping.dmp

Download
memory/2112-152-0x0000000000000000-mapping.dmp

Download
memory/2276-142-0x0000000000000000-mapping.dmp

Download
memory/2552-170-0x0000000000000000-mapping.dmp

Download
memory/2636-174-0x0000000000000000-mapping.dmp

Download
memory/2672-168-0x0000000000000000-mapping.dmp

Download
memory/2924-200-0x0000000000000000-mapping.dmp

Download
memory/3020-194-0x0000000000000000-mapping.dmp

Download
memory/3076-160-0x0000000000000000-mapping.dmp

Download
memory/3136-150-0x0000000000000000-mapping.dmp

Download
memory/3232-171-0x0000000000000000-mapping.dmp

Download
memory/3236-187-0x0000000000000000-mapping.dmp

Download
memory/3340-158-0x0000000000000000-mapping.dmp

Download
memory/3348-186-0x0000000000000000-mapping.dmp

Download
memory/3348-147-0x0000000000000000-mapping.dmp

Download
memory/3412-132-0x0000000000000000-mapping.dmp

Download
memory/3440-169-0x0000000000000000-mapping.dmp

Download
memory/3484-181-0x0000000000000000-mapping.dmp

Download
memory/3580-183-0x0000000000000000-mapping.dmp

Download
memory/3596-178-0x0000000000000000-mapping.dmp

Download
memory/3600-203-0x0000000000000000-mapping.dmp

Download
memory/3756-164-0x0000000000000000-mapping.dmp

Download
memory/3760-157-0x0000000000000000-mapping.dmp

Download
memory/3904-172-0x0000000000000000-mapping.dmp

Download
memory/3936-145-0x0000000000000000-mapping.dmp

Download
memory/3972-137-0x0000000000000000-mapping.dmp

Download
memory/4028-198-0x0000000000000000-mapping.dmp

Download
memory/4040-173-0x0000000000000000-mapping.dmp

Download
memory/4088-204-0x0000000000000000-mapping.dmp

Download
memory/4284-180-0x0000000000000000-mapping.dmp

Download
memory/4292-197-0x0000000000000000-mapping.dmp

Download
memory/4296-192-0x0000000000000000-mapping.dmp

Download
memory/4480-135-0x0000000000000000-mapping.dmp

Download
memory/4568-148-0x0000000000000000-mapping.dmp

Download
memory/4576-140-0x0000000000000000-mapping.dmp

Download
memory/4588-162-0x0000000000000000-mapping.dmp

Download
memory/4612-193-0x0000000000000000-mapping.dmp

Download
memory/4720-201-0x0000000000000000-mapping.dmp

Download
memory/4784-196-0x0000000000000000-mapping.dmp

Download
memory/4816-206-0x0000000000000000-mapping.dmp

Download
memory/4828-134-0x0000000000000000-mapping.dmp

Download
memory/4848-199-0x0000000000000000-mapping.dmp

Download
memory/4852-144-0x0000000000000000-mapping.dmp

Download
memory/4888-184-0x0000000000000000-mapping.dmp

Download
memory/4900-189-0x0000000000000000-mapping.dmp

Download
memory/5032-177-0x0000000000000000-mapping.dmp

Download
memory/5048-182-0x0000000000000000-mapping.dmp

Download
memory/5064-155-0x0000000000000000-mapping.dmp

Download