f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Size

188KB
MD5

7523679f6e5f103125526940dfbdd9ca
SHA1

cdddb2b45547f288c78bb3cee519912035258a9f
SHA256

f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd
SHA512

43c16bf3cd54a6b7ea17fd8f17908b8e156f9102a2f61f5bba50d42243c734e3890d359b1cc0e5ddbb6f13d4078a4c58740c916141f6ad52b9d9fabd343ee20f
SSDEEP

3072:Iy3pOBC3bEpqavBSPcC2ScrgCjlyKOanF9t6xtZYwlslGp:Iy3pOBC3wpqavBSPcC2ScrgCCs3o7lsk

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Usbconeted.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Usbconeted.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\BISMIZHX = "userinity.exe"	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Usbconeted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\BISMIZHX = "userinity.exe"	Usbconeted.exe

Executes dropped EXE 2 IoCs

pid	Process
2508	Usbconeted.exe
2412	Usbconeted.exe

Loads dropped DLL 3 IoCs

pid	Process
2036	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
2036	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
2508	Usbconeted.exe

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\Open\Command	Usbconeted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\windows\\SysWow64\\temp32.exe \"%1\" %*"	Usbconeted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\Open\Command	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\windows\\SysWow64\\temp32.exe \"%1\" %*"	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Usbconeted.exe"	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Usbconeted.exe"	Usbconeted.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\windows\SysWOW64\temp32.exe	Usbconeted.exe
File opened for modification	C:\Windows\SysWOW64\Epen.exe	Usbconeted.exe
File opened for modification	C:\Windows\SysWOW64\sym32.exe	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
File opened for modification	C:\Windows\SysWOW64\3dPAD.exe	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
File opened for modification	C:\Windows\SysWOW64\32rc.exe	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
File opened for modification	C:\Windows\SysWOW64\userinity.exe	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
File opened for modification	C:\windows\SysWOW64\temp32.exe	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\Open\Command	Usbconeted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\windows\\SysWow64\\temp32.exe \"%1\" %*"	Usbconeted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzt	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzt\ = "txtfile"	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\Open\Command	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzt	Usbconeted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzt\ = "txtfile"	Usbconeted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	Usbconeted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\SysWow64\\sym32.exe %1"	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\windows\\SysWow64\\temp32.exe \"%1\" %*"	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\SysWow64\\sym32.exe %1"	Usbconeted.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
2028	REG.exe
2224	REG.exe
2780	REG.exe
2948	REG.exe
1520	REG.exe
2356	REG.exe
2360	REG.exe
1712	REG.exe
2152	REG.exe
2900	REG.exe
2308	REG.exe
2112	REG.exe
1212	REG.exe
1800	REG.exe
888	REG.exe
2812	REG.exe
240	REG.exe
1224	REG.exe
1448	REG.exe
2504	REG.exe
2356	REG.exe
1072	REG.exe
1888	REG.exe
1548	REG.exe
2960	REG.exe
1212	REG.exe
876	REG.exe
3048	REG.exe
2004	REG.exe
2792	REG.exe
2220	REG.exe
1148	REG.exe
2348	REG.exe
2180	REG.exe
624	REG.exe
1516	REG.exe
2188	REG.exe
480	REG.exe
2620	REG.exe
1212	REG.exe
2120	REG.exe
1708	REG.exe
2584	REG.exe
2112	REG.exe
1640	REG.exe
1888	REG.exe
2248	REG.exe
1572	REG.exe
1948	REG.exe
2236	REG.exe
1676	REG.exe
2984	REG.exe
3012	REG.exe
3028	REG.exe
3036	REG.exe
2848	REG.exe
2940	REG.exe
2344	REG.exe
1088	REG.exe
2364	REG.exe
1412	REG.exe
1604	REG.exe
2524	REG.exe
352	REG.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2036	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
2508	Usbconeted.exe
2412	Usbconeted.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2584	2036	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe	28
PID 2036 wrote to memory of 2584	2036	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe	28
PID 2036 wrote to memory of 2584	2036	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe	28
PID 2036 wrote to memory of 2584	2036	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe	28
PID 2036 wrote to memory of 2508	2036	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe	29
PID 2036 wrote to memory of 2508	2036	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe	29
PID 2036 wrote to memory of 2508	2036	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe	29
PID 2036 wrote to memory of 2508	2036	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe	29
PID 2508 wrote to memory of 2412	2508	Usbconeted.exe	31
PID 2508 wrote to memory of 2412	2508	Usbconeted.exe	31
PID 2508 wrote to memory of 2412	2508	Usbconeted.exe	31
PID 2508 wrote to memory of 2412	2508	Usbconeted.exe	31
PID 2508 wrote to memory of 2548	2508	Usbconeted.exe	32
PID 2508 wrote to memory of 2548	2508	Usbconeted.exe	32
PID 2508 wrote to memory of 2548	2508	Usbconeted.exe	32
PID 2508 wrote to memory of 2548	2508	Usbconeted.exe	32
PID 2508 wrote to memory of 2404	2508	Usbconeted.exe	34
PID 2508 wrote to memory of 2404	2508	Usbconeted.exe	34
PID 2508 wrote to memory of 2404	2508	Usbconeted.exe	34
PID 2508 wrote to memory of 2404	2508	Usbconeted.exe	34
PID 2508 wrote to memory of 2504	2508	Usbconeted.exe	36
PID 2508 wrote to memory of 2504	2508	Usbconeted.exe	36
PID 2508 wrote to memory of 2504	2508	Usbconeted.exe	36
PID 2508 wrote to memory of 2504	2508	Usbconeted.exe	36
PID 2508 wrote to memory of 2792	2508	Usbconeted.exe	38
PID 2508 wrote to memory of 2792	2508	Usbconeted.exe	38
PID 2508 wrote to memory of 2792	2508	Usbconeted.exe	38
PID 2508 wrote to memory of 2792	2508	Usbconeted.exe	38
PID 2508 wrote to memory of 876	2508	Usbconeted.exe	40
PID 2508 wrote to memory of 876	2508	Usbconeted.exe	40
PID 2508 wrote to memory of 876	2508	Usbconeted.exe	40
PID 2508 wrote to memory of 876	2508	Usbconeted.exe	40
PID 2508 wrote to memory of 1740	2508	Usbconeted.exe	42
PID 2508 wrote to memory of 1740	2508	Usbconeted.exe	42
PID 2508 wrote to memory of 1740	2508	Usbconeted.exe	42
PID 2508 wrote to memory of 1740	2508	Usbconeted.exe	42
PID 2508 wrote to memory of 2140	2508	Usbconeted.exe	44
PID 2508 wrote to memory of 2140	2508	Usbconeted.exe	44
PID 2508 wrote to memory of 2140	2508	Usbconeted.exe	44
PID 2508 wrote to memory of 2140	2508	Usbconeted.exe	44
PID 2508 wrote to memory of 2356	2508	Usbconeted.exe	46
PID 2508 wrote to memory of 2356	2508	Usbconeted.exe	46
PID 2508 wrote to memory of 2356	2508	Usbconeted.exe	46
PID 2508 wrote to memory of 2356	2508	Usbconeted.exe	46
PID 2508 wrote to memory of 2568	2508	Usbconeted.exe	48
PID 2508 wrote to memory of 2568	2508	Usbconeted.exe	48
PID 2508 wrote to memory of 2568	2508	Usbconeted.exe	48
PID 2508 wrote to memory of 2568	2508	Usbconeted.exe	48
PID 2508 wrote to memory of 1220	2508	Usbconeted.exe	50
PID 2508 wrote to memory of 1220	2508	Usbconeted.exe	50
PID 2508 wrote to memory of 1220	2508	Usbconeted.exe	50
PID 2508 wrote to memory of 1220	2508	Usbconeted.exe	50
PID 2508 wrote to memory of 2188	2508	Usbconeted.exe	52
PID 2508 wrote to memory of 2188	2508	Usbconeted.exe	52
PID 2508 wrote to memory of 2188	2508	Usbconeted.exe	52
PID 2508 wrote to memory of 2188	2508	Usbconeted.exe	52
PID 2508 wrote to memory of 1632	2508	Usbconeted.exe	54
PID 2508 wrote to memory of 1632	2508	Usbconeted.exe	54
PID 2508 wrote to memory of 1632	2508	Usbconeted.exe	54
PID 2508 wrote to memory of 1632	2508	Usbconeted.exe	54
PID 2508 wrote to memory of 2344	2508	Usbconeted.exe	56
PID 2508 wrote to memory of 2344	2508	Usbconeted.exe	56
PID 2508 wrote to memory of 2344	2508	Usbconeted.exe	56
PID 2508 wrote to memory of 2344	2508	Usbconeted.exe	56

C:\Users\Admin\AppData\Local\Temp\f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
"C:\Users\Admin\AppData\Local\Temp\f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds policy Run key to start application
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:2584
- C:\Users\Admin\AppData\Local\Temp\Usbconeted.exe
  C:\Users\Admin\AppData\Local\Temp\Usbconeted.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Users\Admin\AppData\Local\Temp\Usbconeted.exe
    C:\Users\Admin\AppData\Local\Temp\Usbconeted.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2412
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2548
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2404
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2504
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2792
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:876
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1740
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2140
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2356
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2568
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1220
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2188
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1632
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2344
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1212
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1832
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1820
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2316
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1572
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1508
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1952
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1948
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2236
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2364
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1784
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:336
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:480
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:576
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:352
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1872
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1824
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:696
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2828
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1072
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2852
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3036
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1480
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1288
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1676
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2360
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:924
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2340
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2936
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1412
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2928
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3048
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2004
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:3020
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2028
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2492
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2588
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2652
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2408
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2808
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2664
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2460
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2320
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2792
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2620
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2804
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1712
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1016
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1616
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2568
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1564
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2692
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:240
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1632
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2344
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1212
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1800
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1888
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1548
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1604
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1444
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2112
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2120
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2224
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2152
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2104
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2076
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1148
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:588
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1708
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:840
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2452
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2780
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:784
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2348
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2960
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1792
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1988
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:332
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1672
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:888
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2848
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2940
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2948
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2044
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2892
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1780
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1520
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1640
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2524
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2636
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2900
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2640
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2412
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2716
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2540
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2984
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2164
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2812
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2504
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2972
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3012
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:876
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2276
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2140
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2356
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2308
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1456
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2180
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2304
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2952
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:240
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1224
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2300
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1212
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1800
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1888
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:3016
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2424
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1448
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2112
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3028
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2248
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1088
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2104
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:540
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:624
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1516
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1708
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2220
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Usbconeted.exe

Filesize
188KB

MD5
7ba0e6ffb92209afe74c5cd6b0db8529

SHA1
6c8967483fb708b451a0bf955938ddf5147bb21f

SHA256
216054dfbef3c8a1a645d0e5aec1c418fa1e965836b0cdf84fcd471fc1d85ce5

SHA512
ec6d4cc806b946312908a09de8aa28b3e2dc70b3e785c00abad075116078a8283c743535bb2b489673797ee490575241701fc5df010a977f1901f38da429a65e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads