Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    03/05/2024, 05:34

General

  • Target

    f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe

  • Size

    188KB

  • MD5

    7523679f6e5f103125526940dfbdd9ca

  • SHA1

    cdddb2b45547f288c78bb3cee519912035258a9f

  • SHA256

    f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd

  • SHA512

    43c16bf3cd54a6b7ea17fd8f17908b8e156f9102a2f61f5bba50d42243c734e3890d359b1cc0e5ddbb6f13d4078a4c58740c916141f6ad52b9d9fabd343ee20f

  • SSDEEP

    3072:Iy3pOBC3bEpqavBSPcC2ScrgCjlyKOanF9t6xtZYwlslGp:Iy3pOBC3wpqavBSPcC2ScrgCCs3o7lsk

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Modifies system executable filetype association 2 TTPs 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 7 IoCs
  • Modifies registry class 12 IoCs
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
    "C:\Users\Admin\AppData\Local\Temp\f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Adds policy Run key to start application
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Windows\SysWOW64\REG.exe
      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
      2⤵
      • Modifies registry key
      PID:2584
    • C:\Users\Admin\AppData\Local\Temp\Usbconeted.exe
      C:\Users\Admin\AppData\Local\Temp\Usbconeted.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Adds policy Run key to start application
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2508
      • C:\Users\Admin\AppData\Local\Temp\Usbconeted.exe
        C:\Users\Admin\AppData\Local\Temp\Usbconeted.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2412
      • C:\Windows\SysWOW64\REG.exe
        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
        3⤵
          PID:2548
        • C:\Windows\SysWOW64\REG.exe
          REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
          3⤵
            PID:2404
          • C:\Windows\SysWOW64\REG.exe
            REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
            3⤵
            • Modifies registry key
            PID:2504
          • C:\Windows\SysWOW64\REG.exe
            REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
            3⤵
              PID:2792
            • C:\Windows\SysWOW64\REG.exe
              REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
              3⤵
              • Modifies registry key
              PID:876
            • C:\Windows\SysWOW64\REG.exe
              REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
              3⤵
                PID:1740
              • C:\Windows\SysWOW64\REG.exe
                REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                3⤵
                  PID:2140
                • C:\Windows\SysWOW64\REG.exe
                  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                  3⤵
                  • Modifies registry key
                  PID:2356
                • C:\Windows\SysWOW64\REG.exe
                  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                  3⤵
                    PID:2568
                  • C:\Windows\SysWOW64\REG.exe
                    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                    3⤵
                      PID:1220
                    • C:\Windows\SysWOW64\REG.exe
                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                      3⤵
                      • Modifies registry key
                      PID:2188
                    • C:\Windows\SysWOW64\REG.exe
                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                      3⤵
                        PID:1632
                      • C:\Windows\SysWOW64\REG.exe
                        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                        3⤵
                          PID:2344
                        • C:\Windows\SysWOW64\REG.exe
                          REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                          3⤵
                          • Modifies registry key
                          PID:1212
                        • C:\Windows\SysWOW64\REG.exe
                          REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                          3⤵
                            PID:1832
                          • C:\Windows\SysWOW64\REG.exe
                            REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                            3⤵
                              PID:1820
                            • C:\Windows\SysWOW64\REG.exe
                              REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                              3⤵
                                PID:2316
                              • C:\Windows\SysWOW64\REG.exe
                                REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                3⤵
                                • Modifies registry key
                                PID:1572
                              • C:\Windows\SysWOW64\REG.exe
                                REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                3⤵
                                  PID:1508
                                • C:\Windows\SysWOW64\REG.exe
                                  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                  3⤵
                                    PID:1952
                                  • C:\Windows\SysWOW64\REG.exe
                                    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                    3⤵
                                    • Modifies registry key
                                    PID:1948
                                  • C:\Windows\SysWOW64\REG.exe
                                    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                    3⤵
                                    • Modifies registry key
                                    PID:2236
                                  • C:\Windows\SysWOW64\REG.exe
                                    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                    3⤵
                                    • Modifies registry key
                                    PID:2364
                                  • C:\Windows\SysWOW64\REG.exe
                                    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                    3⤵
                                      PID:1784
                                    • C:\Windows\SysWOW64\REG.exe
                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                      3⤵
                                        PID:336
                                      • C:\Windows\SysWOW64\REG.exe
                                        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                        3⤵
                                        • Modifies registry key
                                        PID:480
                                      • C:\Windows\SysWOW64\REG.exe
                                        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                        3⤵
                                          PID:576
                                        • C:\Windows\SysWOW64\REG.exe
                                          REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                          3⤵
                                          • Modifies registry key
                                          PID:352
                                        • C:\Windows\SysWOW64\REG.exe
                                          REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                          3⤵
                                            PID:1872
                                          • C:\Windows\SysWOW64\REG.exe
                                            REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                            3⤵
                                              PID:1824
                                            • C:\Windows\SysWOW64\REG.exe
                                              REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                              3⤵
                                                PID:696
                                              • C:\Windows\SysWOW64\REG.exe
                                                REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                3⤵
                                                  PID:2828
                                                • C:\Windows\SysWOW64\REG.exe
                                                  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                  3⤵
                                                  • Modifies registry key
                                                  PID:1072
                                                • C:\Windows\SysWOW64\REG.exe
                                                  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                  3⤵
                                                    PID:2852
                                                  • C:\Windows\SysWOW64\REG.exe
                                                    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                    3⤵
                                                    • Modifies registry key
                                                    PID:3036
                                                  • C:\Windows\SysWOW64\REG.exe
                                                    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                    3⤵
                                                      PID:1480
                                                    • C:\Windows\SysWOW64\REG.exe
                                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                      3⤵
                                                        PID:1288
                                                      • C:\Windows\SysWOW64\REG.exe
                                                        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                        3⤵
                                                        • Modifies registry key
                                                        PID:1676
                                                      • C:\Windows\SysWOW64\REG.exe
                                                        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                        3⤵
                                                        • Modifies registry key
                                                        PID:2360
                                                      • C:\Windows\SysWOW64\REG.exe
                                                        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                        3⤵
                                                          PID:924
                                                        • C:\Windows\SysWOW64\REG.exe
                                                          REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                          3⤵
                                                            PID:2340
                                                          • C:\Windows\SysWOW64\REG.exe
                                                            REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                            3⤵
                                                              PID:2936
                                                            • C:\Windows\SysWOW64\REG.exe
                                                              REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                              3⤵
                                                              • Modifies registry key
                                                              PID:1412
                                                            • C:\Windows\SysWOW64\REG.exe
                                                              REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                              3⤵
                                                                PID:2928
                                                              • C:\Windows\SysWOW64\REG.exe
                                                                REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                3⤵
                                                                • Modifies registry key
                                                                PID:3048
                                                              • C:\Windows\SysWOW64\REG.exe
                                                                REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                3⤵
                                                                • Modifies registry key
                                                                PID:2004
                                                              • C:\Windows\SysWOW64\REG.exe
                                                                REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                3⤵
                                                                  PID:3020
                                                                • C:\Windows\SysWOW64\REG.exe
                                                                  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                  3⤵
                                                                  • Modifies registry key
                                                                  PID:2028
                                                                • C:\Windows\SysWOW64\REG.exe
                                                                  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                  3⤵
                                                                    PID:2492
                                                                  • C:\Windows\SysWOW64\REG.exe
                                                                    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                    3⤵
                                                                      PID:2588
                                                                    • C:\Windows\SysWOW64\REG.exe
                                                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                      3⤵
                                                                        PID:2652
                                                                      • C:\Windows\SysWOW64\REG.exe
                                                                        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                        3⤵
                                                                          PID:2672
                                                                        • C:\Windows\SysWOW64\REG.exe
                                                                          REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                          3⤵
                                                                            PID:2408
                                                                          • C:\Windows\SysWOW64\REG.exe
                                                                            REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                            3⤵
                                                                              PID:2712
                                                                            • C:\Windows\SysWOW64\REG.exe
                                                                              REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                              3⤵
                                                                                PID:2808
                                                                              • C:\Windows\SysWOW64\REG.exe
                                                                                REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                3⤵
                                                                                  PID:2664
                                                                                • C:\Windows\SysWOW64\REG.exe
                                                                                  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                  3⤵
                                                                                    PID:2460
                                                                                  • C:\Windows\SysWOW64\REG.exe
                                                                                    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                    3⤵
                                                                                      PID:2320
                                                                                    • C:\Windows\SysWOW64\REG.exe
                                                                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                      3⤵
                                                                                      • Modifies registry key
                                                                                      PID:2792
                                                                                    • C:\Windows\SysWOW64\REG.exe
                                                                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                      3⤵
                                                                                      • Modifies registry key
                                                                                      PID:2620
                                                                                    • C:\Windows\SysWOW64\REG.exe
                                                                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                      3⤵
                                                                                        PID:2804
                                                                                      • C:\Windows\SysWOW64\REG.exe
                                                                                        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                        3⤵
                                                                                        • Modifies registry key
                                                                                        PID:1712
                                                                                      • C:\Windows\SysWOW64\REG.exe
                                                                                        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                        3⤵
                                                                                          PID:1016
                                                                                        • C:\Windows\SysWOW64\REG.exe
                                                                                          REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                          3⤵
                                                                                            PID:1616
                                                                                          • C:\Windows\SysWOW64\REG.exe
                                                                                            REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                            3⤵
                                                                                              PID:2568
                                                                                            • C:\Windows\SysWOW64\REG.exe
                                                                                              REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                              3⤵
                                                                                                PID:1564
                                                                                              • C:\Windows\SysWOW64\REG.exe
                                                                                                REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                3⤵
                                                                                                  PID:2692
                                                                                                • C:\Windows\SysWOW64\REG.exe
                                                                                                  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                  3⤵
                                                                                                    PID:240
                                                                                                  • C:\Windows\SysWOW64\REG.exe
                                                                                                    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                    3⤵
                                                                                                      PID:1632
                                                                                                    • C:\Windows\SysWOW64\REG.exe
                                                                                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                      3⤵
                                                                                                      • Modifies registry key
                                                                                                      PID:2344
                                                                                                    • C:\Windows\SysWOW64\REG.exe
                                                                                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                      3⤵
                                                                                                      • Modifies registry key
                                                                                                      PID:1212
                                                                                                    • C:\Windows\SysWOW64\REG.exe
                                                                                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                      3⤵
                                                                                                      • Modifies registry key
                                                                                                      PID:1800
                                                                                                    • C:\Windows\SysWOW64\REG.exe
                                                                                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                      3⤵
                                                                                                      • Modifies registry key
                                                                                                      PID:1888
                                                                                                    • C:\Windows\SysWOW64\REG.exe
                                                                                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                      3⤵
                                                                                                      • Modifies registry key
                                                                                                      PID:1548
                                                                                                    • C:\Windows\SysWOW64\REG.exe
                                                                                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                      3⤵
                                                                                                      • Modifies registry key
                                                                                                      PID:1604
                                                                                                    • C:\Windows\SysWOW64\REG.exe
                                                                                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                      3⤵
                                                                                                        PID:1444
                                                                                                      • C:\Windows\SysWOW64\REG.exe
                                                                                                        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                        3⤵
                                                                                                        • Modifies registry key
                                                                                                        PID:2112
                                                                                                      • C:\Windows\SysWOW64\REG.exe
                                                                                                        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                        3⤵
                                                                                                        • Modifies registry key
                                                                                                        PID:2120
                                                                                                      • C:\Windows\SysWOW64\REG.exe
                                                                                                        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                        3⤵
                                                                                                        • Modifies registry key
                                                                                                        PID:2224
                                                                                                      • C:\Windows\SysWOW64\REG.exe
                                                                                                        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                        3⤵
                                                                                                        • Modifies registry key
                                                                                                        PID:2152
                                                                                                      • C:\Windows\SysWOW64\REG.exe
                                                                                                        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                        3⤵
                                                                                                          PID:2104
                                                                                                        • C:\Windows\SysWOW64\REG.exe
                                                                                                          REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                          3⤵
                                                                                                            PID:2076
                                                                                                          • C:\Windows\SysWOW64\REG.exe
                                                                                                            REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                            3⤵
                                                                                                            • Modifies registry key
                                                                                                            PID:1148
                                                                                                          • C:\Windows\SysWOW64\REG.exe
                                                                                                            REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                            3⤵
                                                                                                              PID:588
                                                                                                            • C:\Windows\SysWOW64\REG.exe
                                                                                                              REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                              3⤵
                                                                                                                PID:1708
                                                                                                              • C:\Windows\SysWOW64\REG.exe
                                                                                                                REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                3⤵
                                                                                                                  PID:840
                                                                                                                • C:\Windows\SysWOW64\REG.exe
                                                                                                                  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                  3⤵
                                                                                                                    PID:2452
                                                                                                                  • C:\Windows\SysWOW64\REG.exe
                                                                                                                    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                    3⤵
                                                                                                                    • Modifies registry key
                                                                                                                    PID:2780
                                                                                                                  • C:\Windows\SysWOW64\REG.exe
                                                                                                                    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                    3⤵
                                                                                                                      PID:784
                                                                                                                    • C:\Windows\SysWOW64\REG.exe
                                                                                                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                      3⤵
                                                                                                                      • Modifies registry key
                                                                                                                      PID:2348
                                                                                                                    • C:\Windows\SysWOW64\REG.exe
                                                                                                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                      3⤵
                                                                                                                      • Modifies registry key
                                                                                                                      PID:2960
                                                                                                                    • C:\Windows\SysWOW64\REG.exe
                                                                                                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                      3⤵
                                                                                                                        PID:1792
                                                                                                                      • C:\Windows\SysWOW64\REG.exe
                                                                                                                        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                        3⤵
                                                                                                                          PID:1988
                                                                                                                        • C:\Windows\SysWOW64\REG.exe
                                                                                                                          REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                          3⤵
                                                                                                                            PID:332
                                                                                                                          • C:\Windows\SysWOW64\REG.exe
                                                                                                                            REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                            3⤵
                                                                                                                              PID:1672
                                                                                                                            • C:\Windows\SysWOW64\REG.exe
                                                                                                                              REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                              3⤵
                                                                                                                              • Modifies registry key
                                                                                                                              PID:888
                                                                                                                            • C:\Windows\SysWOW64\REG.exe
                                                                                                                              REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                              3⤵
                                                                                                                              • Modifies registry key
                                                                                                                              PID:2848
                                                                                                                            • C:\Windows\SysWOW64\REG.exe
                                                                                                                              REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                              3⤵
                                                                                                                              • Modifies registry key
                                                                                                                              PID:2940
                                                                                                                            • C:\Windows\SysWOW64\REG.exe
                                                                                                                              REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                              3⤵
                                                                                                                              • Modifies registry key
                                                                                                                              PID:2948
                                                                                                                            • C:\Windows\SysWOW64\REG.exe
                                                                                                                              REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                              3⤵
                                                                                                                                PID:2044
                                                                                                                              • C:\Windows\SysWOW64\REG.exe
                                                                                                                                REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                3⤵
                                                                                                                                  PID:2892
                                                                                                                                • C:\Windows\SysWOW64\REG.exe
                                                                                                                                  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                  3⤵
                                                                                                                                    PID:1780
                                                                                                                                  • C:\Windows\SysWOW64\REG.exe
                                                                                                                                    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                    3⤵
                                                                                                                                      PID:2860
                                                                                                                                    • C:\Windows\SysWOW64\REG.exe
                                                                                                                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                      3⤵
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:1520
                                                                                                                                    • C:\Windows\SysWOW64\REG.exe
                                                                                                                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                      3⤵
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:1640
                                                                                                                                    • C:\Windows\SysWOW64\REG.exe
                                                                                                                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                      3⤵
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:2524
                                                                                                                                    • C:\Windows\SysWOW64\REG.exe
                                                                                                                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                      3⤵
                                                                                                                                        PID:2636
                                                                                                                                      • C:\Windows\SysWOW64\REG.exe
                                                                                                                                        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                        3⤵
                                                                                                                                        • Modifies registry key
                                                                                                                                        PID:2900
                                                                                                                                      • C:\Windows\SysWOW64\REG.exe
                                                                                                                                        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                        3⤵
                                                                                                                                          PID:2640
                                                                                                                                        • C:\Windows\SysWOW64\REG.exe
                                                                                                                                          REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                          3⤵
                                                                                                                                            PID:2412
                                                                                                                                          • C:\Windows\SysWOW64\REG.exe
                                                                                                                                            REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                            3⤵
                                                                                                                                              PID:2716
                                                                                                                                            • C:\Windows\SysWOW64\REG.exe
                                                                                                                                              REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                              3⤵
                                                                                                                                                PID:2540
                                                                                                                                              • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                3⤵
                                                                                                                                                • Modifies registry key
                                                                                                                                                PID:2984
                                                                                                                                              • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                3⤵
                                                                                                                                                  PID:2164
                                                                                                                                                • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                  3⤵
                                                                                                                                                  • Modifies registry key
                                                                                                                                                  PID:2812
                                                                                                                                                • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2504
                                                                                                                                                  • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                    3⤵
                                                                                                                                                      PID:2972
                                                                                                                                                    • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                      3⤵
                                                                                                                                                      • Modifies registry key
                                                                                                                                                      PID:3012
                                                                                                                                                    • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                      3⤵
                                                                                                                                                        PID:876
                                                                                                                                                      • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                        3⤵
                                                                                                                                                          PID:2276
                                                                                                                                                        • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                          REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                          3⤵
                                                                                                                                                            PID:2140
                                                                                                                                                          • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                            REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                            3⤵
                                                                                                                                                            • Modifies registry key
                                                                                                                                                            PID:2356
                                                                                                                                                          • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                            REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                            3⤵
                                                                                                                                                            • Modifies registry key
                                                                                                                                                            PID:2308
                                                                                                                                                          • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                            REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                            3⤵
                                                                                                                                                              PID:1456
                                                                                                                                                            • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                              REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                              3⤵
                                                                                                                                                              • Modifies registry key
                                                                                                                                                              PID:2180
                                                                                                                                                            • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                              REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2304
                                                                                                                                                              • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                                REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:2952
                                                                                                                                                                • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                                  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:240
                                                                                                                                                                • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                                  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:1224
                                                                                                                                                                • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                                  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:2300
                                                                                                                                                                  • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                                    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                    PID:1212
                                                                                                                                                                  • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                                    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:1800
                                                                                                                                                                    • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                      PID:1888
                                                                                                                                                                    • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                                      REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:3016
                                                                                                                                                                      • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                                        REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:2424
                                                                                                                                                                        • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                                          REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                          PID:1448
                                                                                                                                                                        • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                                          REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                          PID:2112
                                                                                                                                                                        • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                                          REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                          PID:3028
                                                                                                                                                                        • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                                          REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                          PID:2248
                                                                                                                                                                        • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                                          REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                          PID:1088
                                                                                                                                                                        • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                                          REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:2104
                                                                                                                                                                          • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                                            REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:540
                                                                                                                                                                            • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                                              REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                              PID:624
                                                                                                                                                                            • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                                              REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                              PID:1516
                                                                                                                                                                            • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                                              REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                              PID:1708
                                                                                                                                                                            • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                                              REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                              PID:2220
                                                                                                                                                                            • C:\Windows\SysWOW64\REG.exe
                                                                                                                                                                              REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:1684

                                                                                                                                                                          Network

                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                          Replay Monitor

                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                          Downloads

                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Usbconeted.exe

                                                                                                                                                                            Filesize

                                                                                                                                                                            188KB

                                                                                                                                                                            MD5

                                                                                                                                                                            7ba0e6ffb92209afe74c5cd6b0db8529

                                                                                                                                                                            SHA1

                                                                                                                                                                            6c8967483fb708b451a0bf955938ddf5147bb21f

                                                                                                                                                                            SHA256

                                                                                                                                                                            216054dfbef3c8a1a645d0e5aec1c418fa1e965836b0cdf84fcd471fc1d85ce5

                                                                                                                                                                            SHA512

                                                                                                                                                                            ec6d4cc806b946312908a09de8aa28b3e2dc70b3e785c00abad075116078a8283c743535bb2b489673797ee490575241701fc5df010a977f1901f38da429a65e