Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
51s -
max time network
20s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
11/01/2024, 14:44
Static task
static1
Behavioral task
behavioral1
Sample
USBFactoryResetToolSetup.exe
Resource
win10-20231215-en
windows10-1703-x64
General
-
Target
USBFactoryResetToolSetup.exe
-
Size
945KB
-
MD5
e33b58158208b3bb0bb713afc148968f
-
SHA1
5b4403b076d6bf6fa0d2a1571fd8f9c1bddbc2ac
-
SHA256
7350594f8f7e392e6c4f0acadb2820bc75d75acd263afbdcd4ddaa01577d5314
-
SHA512
d13c204eb3b8af785f0f1b80e2f56a5df85e4737153fb506cfbe1e1d47bcb3f83d83a3f995ae75558b30bd068b133de5b2dd85aa73bb6710b9a1f6101c5b1583
-
SSDEEP
24576:5na1awWBK9c7VTuU7hypJmxfUz3d0kIVGQJxkTC:5a+BK9qTH2i8z3dM1
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2636 USBFactoryResetToolSetup.tmp 4468 USBResetTool.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\v: USBResetTool.exe File opened (read-only) \??\x: USBResetTool.exe File opened (read-only) \??\a: USBResetTool.exe File opened (read-only) \??\D: USBResetTool.exe File opened (read-only) \??\H: USBResetTool.exe File opened (read-only) \??\k: USBResetTool.exe File opened (read-only) \??\T: USBResetTool.exe File opened (read-only) \??\G: USBResetTool.exe File opened (read-only) \??\N: USBResetTool.exe File opened (read-only) \??\Y: USBResetTool.exe File opened (read-only) \??\j: USBResetTool.exe File opened (read-only) \??\M: USBResetTool.exe File opened (read-only) \??\V: USBResetTool.exe File opened (read-only) \??\W: USBResetTool.exe File opened (read-only) \??\b: USBResetTool.exe File opened (read-only) \??\J: USBResetTool.exe File opened (read-only) \??\u: USBResetTool.exe File opened (read-only) \??\w: USBResetTool.exe File opened (read-only) \??\P: USBResetTool.exe File opened (read-only) \??\R: USBResetTool.exe File opened (read-only) \??\y: USBResetTool.exe File opened (read-only) \??\A: USBResetTool.exe File opened (read-only) \??\e: USBResetTool.exe File opened (read-only) \??\F: USBResetTool.exe File opened (read-only) \??\I: USBResetTool.exe File opened (read-only) \??\n: USBResetTool.exe File opened (read-only) \??\Z: USBResetTool.exe File opened (read-only) \??\m: USBResetTool.exe File opened (read-only) \??\o: USBResetTool.exe File opened (read-only) \??\q: USBResetTool.exe File opened (read-only) \??\g: USBResetTool.exe File opened (read-only) \??\h: USBResetTool.exe File opened (read-only) \??\i: USBResetTool.exe File opened (read-only) \??\l: USBResetTool.exe File opened (read-only) \??\L: USBResetTool.exe File opened (read-only) \??\r: USBResetTool.exe File opened (read-only) \??\X: USBResetTool.exe File opened (read-only) \??\z: USBResetTool.exe File opened (read-only) \??\E: USBResetTool.exe File opened (read-only) \??\Q: USBResetTool.exe File opened (read-only) \??\s: USBResetTool.exe File opened (read-only) \??\U: USBResetTool.exe File opened (read-only) \??\t: USBResetTool.exe File opened (read-only) \??\B: USBResetTool.exe File opened (read-only) \??\K: USBResetTool.exe File opened (read-only) \??\O: USBResetTool.exe File opened (read-only) \??\p: USBResetTool.exe File opened (read-only) \??\S: USBResetTool.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 USBResetTool.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files\USB Drive Factory Reset Tool\is-CRJMP.tmp USBFactoryResetToolSetup.tmp File created C:\Program Files\USB Drive Factory Reset Tool\is-376CT.tmp USBFactoryResetToolSetup.tmp File created C:\Program Files\USB Drive Factory Reset Tool\is-EGNFM.tmp USBFactoryResetToolSetup.tmp File opened for modification C:\Program Files\USB Drive Factory Reset Tool\unins000.dat USBFactoryResetToolSetup.tmp File created C:\Program Files\USB Drive Factory Reset Tool\unins000.dat USBFactoryResetToolSetup.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe Token: SeBackupPrivilege 4468 USBResetTool.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2636 USBFactoryResetToolSetup.tmp -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5108 wrote to memory of 2636 5108 USBFactoryResetToolSetup.exe 71 PID 5108 wrote to memory of 2636 5108 USBFactoryResetToolSetup.exe 71 PID 5108 wrote to memory of 2636 5108 USBFactoryResetToolSetup.exe 71 PID 2636 wrote to memory of 4468 2636 USBFactoryResetToolSetup.tmp 74 PID 2636 wrote to memory of 4468 2636 USBFactoryResetToolSetup.tmp 74 PID 2636 wrote to memory of 4468 2636 USBFactoryResetToolSetup.tmp 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\USBFactoryResetToolSetup.exe"C:\Users\Admin\AppData\Local\Temp\USBFactoryResetToolSetup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\is-I129L.tmp\USBFactoryResetToolSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-I129L.tmp\USBFactoryResetToolSetup.tmp" /SL5="$700CE,726046,54272,C:\Users\Admin\AppData\Local\Temp\USBFactoryResetToolSetup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Program Files\USB Drive Factory Reset Tool\USBResetTool.exe"C:\Program Files\USB Drive Factory Reset Tool\USBResetTool.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
MD56c0e5e0a9a3863c1f1f418d464d58c41
SHA11ab182e17c14ded245a000b2012682d3239b7546
SHA2561e38a87ce030891dc2af62cd787482e2848a693e7ff24134c69c9c45df2ef369
SHA512602057867ebae1e1f9e3447077b93aa5f47d0ae9e6d163d8c542b350b0a791cb7f77b9c6d913563493b11ca2d4a5ca2bc732864585f9567ecac44da6121380dd
-
Filesize
516KB
MD5295569daae2741c050a50f73ec59c3da
SHA13b0eed89f1551c3ae38f9eab12215e3476967e01
SHA2562e740cd3dccf76b63a014de78f2e9c4add1dcc457f76ae0ee86f413aa5099ff7
SHA512585224afd9e7046b0f118b7f644848186cefdaef7451aae15154d013488277d509bc108eb08bc27d4f161121b9a8f0a9c3e30cde7cf05eb1c7a7ff03845592b5
-
Filesize
430KB
MD5d250cb110cdff62e6c43bcebabe71eb4
SHA100110a6cdc65a070112e64557d740ff1db96f536
SHA256e0d965bc9b6fda958c3afb4f33cd72760b85c189d3f9b87e98796dadd165409f
SHA512788c7abe7596c2d5694ee3089f279d629fad51d30fa087d5b7de9d9af183d0976fdb7e99178d7450136a941f1955df460a53b05c523dd1f1755073883e0513a7
-
Filesize
688KB
MD567c5a4f36e1c91a3b85e440edd7ad026
SHA1e49ea0e558ed682498cc61b3070e4c402fbf0912
SHA25699c299d6565ab53d9af66e0146737dc0ecfbc52ecf4740825b552db0cc4210c6
SHA51240522d4645ece0db9888ea40d1a11356aa5efc191184a0b97cb54a6c243532b1fc306e9095bbfa1f5dc02c8e52b709650230d1383532136e56caea3dc19a973e