Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
03/05/2024, 05:34
Static task
static1
Behavioral task
behavioral1
Sample
f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Resource
win10v2004-20240419-en
General
-
Target
f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
-
Size
188KB
-
MD5
7523679f6e5f103125526940dfbdd9ca
-
SHA1
cdddb2b45547f288c78bb3cee519912035258a9f
-
SHA256
f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd
-
SHA512
43c16bf3cd54a6b7ea17fd8f17908b8e156f9102a2f61f5bba50d42243c734e3890d359b1cc0e5ddbb6f13d4078a4c58740c916141f6ad52b9d9fabd343ee20f
-
SSDEEP
3072:Iy3pOBC3bEpqavBSPcC2ScrgCjlyKOanF9t6xtZYwlslGp:Iy3pOBC3wpqavBSPcC2ScrgCCs3o7lsk
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Usbconeted.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Usbconeted.exe -
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\BISMIZHX = "userinity.exe" f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Usbconeted.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\BISMIZHX = "userinity.exe" Usbconeted.exe -
Executes dropped EXE 2 IoCs
pid Process 2508 Usbconeted.exe 2412 Usbconeted.exe -
Loads dropped DLL 3 IoCs
pid Process 2036 f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe 2036 f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe 2508 Usbconeted.exe -
Modifies system executable filetype association 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\Open\Command Usbconeted.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\windows\\SysWow64\\temp32.exe \"%1\" %*" Usbconeted.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\Open\Command f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\windows\\SysWow64\\temp32.exe \"%1\" %*" f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Usbconeted.exe" f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Usbconeted.exe" Usbconeted.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\temp32.exe Usbconeted.exe File opened for modification C:\Windows\SysWOW64\Epen.exe Usbconeted.exe File opened for modification C:\Windows\SysWOW64\sym32.exe f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe File opened for modification C:\Windows\SysWOW64\3dPAD.exe f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe File opened for modification C:\Windows\SysWOW64\32rc.exe f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe File opened for modification C:\Windows\SysWOW64\userinity.exe f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe File opened for modification C:\windows\SysWOW64\temp32.exe f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\Open\Command Usbconeted.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\windows\\SysWow64\\temp32.exe \"%1\" %*" Usbconeted.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tzt f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tzt\ = "txtfile" f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\Open\Command f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tzt Usbconeted.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tzt\ = "txtfile" Usbconeted.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command Usbconeted.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\SysWow64\\sym32.exe %1" f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\windows\\SysWow64\\temp32.exe \"%1\" %*" f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\SysWow64\\sym32.exe %1" Usbconeted.exe -
Modifies registry key 1 TTPs 64 IoCs
pid Process 2028 REG.exe 2224 REG.exe 2780 REG.exe 2948 REG.exe 1520 REG.exe 2356 REG.exe 2360 REG.exe 1712 REG.exe 2152 REG.exe 2900 REG.exe 2308 REG.exe 2112 REG.exe 1212 REG.exe 1800 REG.exe 888 REG.exe 2812 REG.exe 240 REG.exe 1224 REG.exe 1448 REG.exe 2504 REG.exe 2356 REG.exe 1072 REG.exe 1888 REG.exe 1548 REG.exe 2960 REG.exe 1212 REG.exe 876 REG.exe 3048 REG.exe 2004 REG.exe 2792 REG.exe 2220 REG.exe 1148 REG.exe 2348 REG.exe 2180 REG.exe 624 REG.exe 1516 REG.exe 2188 REG.exe 480 REG.exe 2620 REG.exe 1212 REG.exe 2120 REG.exe 1708 REG.exe 2584 REG.exe 2112 REG.exe 1640 REG.exe 1888 REG.exe 2248 REG.exe 1572 REG.exe 1948 REG.exe 2236 REG.exe 1676 REG.exe 2984 REG.exe 3012 REG.exe 3028 REG.exe 3036 REG.exe 2848 REG.exe 2940 REG.exe 2344 REG.exe 1088 REG.exe 2364 REG.exe 1412 REG.exe 1604 REG.exe 2524 REG.exe 352 REG.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2036 f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe 2508 Usbconeted.exe 2412 Usbconeted.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2584 2036 f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe 28 PID 2036 wrote to memory of 2584 2036 f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe 28 PID 2036 wrote to memory of 2584 2036 f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe 28 PID 2036 wrote to memory of 2584 2036 f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe 28 PID 2036 wrote to memory of 2508 2036 f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe 29 PID 2036 wrote to memory of 2508 2036 f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe 29 PID 2036 wrote to memory of 2508 2036 f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe 29 PID 2036 wrote to memory of 2508 2036 f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe 29 PID 2508 wrote to memory of 2412 2508 Usbconeted.exe 31 PID 2508 wrote to memory of 2412 2508 Usbconeted.exe 31 PID 2508 wrote to memory of 2412 2508 Usbconeted.exe 31 PID 2508 wrote to memory of 2412 2508 Usbconeted.exe 31 PID 2508 wrote to memory of 2548 2508 Usbconeted.exe 32 PID 2508 wrote to memory of 2548 2508 Usbconeted.exe 32 PID 2508 wrote to memory of 2548 2508 Usbconeted.exe 32 PID 2508 wrote to memory of 2548 2508 Usbconeted.exe 32 PID 2508 wrote to memory of 2404 2508 Usbconeted.exe 34 PID 2508 wrote to memory of 2404 2508 Usbconeted.exe 34 PID 2508 wrote to memory of 2404 2508 Usbconeted.exe 34 PID 2508 wrote to memory of 2404 2508 Usbconeted.exe 34 PID 2508 wrote to memory of 2504 2508 Usbconeted.exe 36 PID 2508 wrote to memory of 2504 2508 Usbconeted.exe 36 PID 2508 wrote to memory of 2504 2508 Usbconeted.exe 36 PID 2508 wrote to memory of 2504 2508 Usbconeted.exe 36 PID 2508 wrote to memory of 2792 2508 Usbconeted.exe 38 PID 2508 wrote to memory of 2792 2508 Usbconeted.exe 38 PID 2508 wrote to memory of 2792 2508 Usbconeted.exe 38 PID 2508 wrote to memory of 2792 2508 Usbconeted.exe 38 PID 2508 wrote to memory of 876 2508 Usbconeted.exe 40 PID 2508 wrote to memory of 876 2508 Usbconeted.exe 40 PID 2508 wrote to memory of 876 2508 Usbconeted.exe 40 PID 2508 wrote to memory of 876 2508 Usbconeted.exe 40 PID 2508 wrote to memory of 1740 2508 Usbconeted.exe 42 PID 2508 wrote to memory of 1740 2508 Usbconeted.exe 42 PID 2508 wrote to memory of 1740 2508 Usbconeted.exe 42 PID 2508 wrote to memory of 1740 2508 Usbconeted.exe 42 PID 2508 wrote to memory of 2140 2508 Usbconeted.exe 44 PID 2508 wrote to memory of 2140 2508 Usbconeted.exe 44 PID 2508 wrote to memory of 2140 2508 Usbconeted.exe 44 PID 2508 wrote to memory of 2140 2508 Usbconeted.exe 44 PID 2508 wrote to memory of 2356 2508 Usbconeted.exe 46 PID 2508 wrote to memory of 2356 2508 Usbconeted.exe 46 PID 2508 wrote to memory of 2356 2508 Usbconeted.exe 46 PID 2508 wrote to memory of 2356 2508 Usbconeted.exe 46 PID 2508 wrote to memory of 2568 2508 Usbconeted.exe 48 PID 2508 wrote to memory of 2568 2508 Usbconeted.exe 48 PID 2508 wrote to memory of 2568 2508 Usbconeted.exe 48 PID 2508 wrote to memory of 2568 2508 Usbconeted.exe 48 PID 2508 wrote to memory of 1220 2508 Usbconeted.exe 50 PID 2508 wrote to memory of 1220 2508 Usbconeted.exe 50 PID 2508 wrote to memory of 1220 2508 Usbconeted.exe 50 PID 2508 wrote to memory of 1220 2508 Usbconeted.exe 50 PID 2508 wrote to memory of 2188 2508 Usbconeted.exe 52 PID 2508 wrote to memory of 2188 2508 Usbconeted.exe 52 PID 2508 wrote to memory of 2188 2508 Usbconeted.exe 52 PID 2508 wrote to memory of 2188 2508 Usbconeted.exe 52 PID 2508 wrote to memory of 1632 2508 Usbconeted.exe 54 PID 2508 wrote to memory of 1632 2508 Usbconeted.exe 54 PID 2508 wrote to memory of 1632 2508 Usbconeted.exe 54 PID 2508 wrote to memory of 1632 2508 Usbconeted.exe 54 PID 2508 wrote to memory of 2344 2508 Usbconeted.exe 56 PID 2508 wrote to memory of 2344 2508 Usbconeted.exe 56 PID 2508 wrote to memory of 2344 2508 Usbconeted.exe 56 PID 2508 wrote to memory of 2344 2508 Usbconeted.exe 56
Processes
-
C:\Users\Admin\AppData\Local\Temp\f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe"C:\Users\Admin\AppData\Local\Temp\f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds policy Run key to start application
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f2⤵
- Modifies registry key
PID:2584
-
-
C:\Users\Admin\AppData\Local\Temp\Usbconeted.exeC:\Users\Admin\AppData\Local\Temp\Usbconeted.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds policy Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\Usbconeted.exeC:\Users\Admin\AppData\Local\Temp\Usbconeted.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2412
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2548
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2404
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2504
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2792
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:876
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1740
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2140
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2356
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2568
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1220
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2188
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1632
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2344
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:1212
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1832
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1820
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2316
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:1572
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1508
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1952
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:1948
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2236
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2364
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1784
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:336
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:480
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:576
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:352
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1872
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1824
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:696
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2828
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:1072
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2852
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:3036
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1480
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1288
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:1676
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2360
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:924
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2340
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2936
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:1412
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2928
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:3048
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2004
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:3020
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2028
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2492
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2588
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2652
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2672
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2408
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2712
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2808
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2664
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2460
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2320
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2792
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2620
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2804
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:1712
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1016
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1616
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2568
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1564
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2692
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:240
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1632
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2344
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:1212
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:1800
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:1888
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:1548
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:1604
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1444
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2112
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2120
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2224
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2152
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2104
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2076
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:1148
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:588
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1708
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:840
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2452
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2780
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:784
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2348
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2960
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1792
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1988
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:332
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1672
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:888
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2848
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2940
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2948
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2044
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2892
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1780
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2860
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:1520
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:1640
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2524
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2636
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2900
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2640
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2412
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2716
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2540
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2984
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2164
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2812
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2504
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2972
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:3012
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:876
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2276
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2140
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2356
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2308
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1456
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2180
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2304
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2952
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:240
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:1224
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2300
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:1212
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1800
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:1888
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:3016
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2424
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:1448
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2112
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:3028
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2248
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:1088
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:2104
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:540
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:624
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:1516
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:1708
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:2220
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵PID:1684
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
MD57ba0e6ffb92209afe74c5cd6b0db8529
SHA16c8967483fb708b451a0bf955938ddf5147bb21f
SHA256216054dfbef3c8a1a645d0e5aec1c418fa1e965836b0cdf84fcd471fc1d85ce5
SHA512ec6d4cc806b946312908a09de8aa28b3e2dc70b3e785c00abad075116078a8283c743535bb2b489673797ee490575241701fc5df010a977f1901f38da429a65e