sality | d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c

Analysis

max time kernel
32s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/12/2024, 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Size

147KB
MD5

61d3136be3658491acae074138b0505d
SHA1

b6c6312033e310df775044301840c9b3b8e0e53f
SHA256

d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c
SHA512

f792581a068d7f0e92ac7106188050c9bde1521d413ef5c96614ffea1ebcabd71a8df8202f46fea4e293e14f09af0141915151d31d58ff64616d6ae9e127f960
SSDEEP

3072:pA/yzn2spnbZdIImXXbxxwBAf0p8xb7AwcGH/K2NxAjhg:pJnMIWFxgAf0GxXAwNyAAg

Score

10^/10

sality backdoor discovery evasion persistence trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	USBInfo.com

Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	regedit.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	regedit.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Sality family
sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	USBInfo.com

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	USBInfo.com

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Drivers\USBInfo.com	cmd.exe
File opened for modification	C:\Windows\SysWOW64\Drivers\USBInfo.com	cmd.exe
File created	C:\Windows\SysWOW64\Drivers\USBStor.vbe	cmd.exe
File created	C:\Windows\SysWOW64\Drivers\Driver.sys	cmd.exe
File created	C:\Windows\SysWOW64\Drivers\USBInfo.vbe	cmd.exe
File created	C:\Windows\SysWOW64\Drivers\USBInfo.sy_	cmd.exe
File created	C:\Windows\SysWOW64\Drivers\USBSys.vbe	cmd.exe

Sets file to hidden 1 TTPs 64 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2388	attrib.exe
2820	attrib.exe
1076	attrib.exe
2704	attrib.exe
2256	attrib.exe
840	attrib.exe
1524	attrib.exe
1800	attrib.exe
748	attrib.exe
2700	attrib.exe
2184	attrib.exe
1864	attrib.exe
1420	attrib.exe
1556	attrib.exe
1000	attrib.exe
1036	attrib.exe
1784	attrib.exe
2864	attrib.exe
2804	attrib.exe
3056	attrib.exe
2756	attrib.exe
2440	attrib.exe
1756	attrib.exe
2172	attrib.exe
2660	attrib.exe
2964	attrib.exe
2696	attrib.exe
1732	attrib.exe
864	attrib.exe
492	attrib.exe
3016	attrib.exe
2772	attrib.exe
2408	attrib.exe
1856	attrib.exe
1756	attrib.exe
2280	attrib.exe
1652	attrib.exe
3040	attrib.exe
1784	attrib.exe
1264	attrib.exe
1056	attrib.exe
1840	attrib.exe
2276	attrib.exe
1484	attrib.exe
1200	attrib.exe
2816	attrib.exe
1680	attrib.exe
1864	attrib.exe
2076	attrib.exe
2684	attrib.exe
2860	attrib.exe
2072	attrib.exe
2868	attrib.exe
492	attrib.exe
1144	attrib.exe
2292	attrib.exe
2296	attrib.exe
344	attrib.exe
2188	attrib.exe
2852	attrib.exe
1980	attrib.exe
1784	attrib.exe
2364	attrib.exe
2428	attrib.exe

Deletes itself 1 IoCs

pid	Process
648	USBInfo.com

Executes dropped EXE 1 IoCs

pid	Process
648	USBInfo.com

Loads dropped DLL 2 IoCs

pid	Process
2804	WScript.exe
2804	WScript.exe

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	USBInfo.com

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\@ = "c:\\windows\\system32\\Drivers\\USBInfo.com"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\@ = "c:\\windows\\system32\\Drivers\\USBInfo.com"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\@ = "c:\\windows\\system32\\Drivers\\USBInfo.com"	regedit.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	USBInfo.com

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\\desktop.ini	cmd.exe
File created	F:\\desktop.ini	cmd.exe

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	USBInfo.com
File opened (read-only)	\??\N:	USBInfo.com
File opened (read-only)	\??\H:	USBInfo.com
File opened (read-only)	\??\J:	USBInfo.com
File opened (read-only)	\??\L:	USBInfo.com
File opened (read-only)	\??\I:	USBInfo.com
File opened (read-only)	\??\K:	USBInfo.com
File opened (read-only)	\??\E:	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
File opened (read-only)	\??\E:	USBInfo.com
File opened (read-only)	\??\G:	USBInfo.com

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\\autorun.inf	cmd.exe
File opened for modification	C:\autorun.inf	attrib.exe
File created	F:\\autorun.inf	cmd.exe
File opened for modification	F:\autorun.inf	attrib.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ScreenSave.scr	cmd.exe
File opened for modification	C:\Windows\SysWOW64\ScreenSave.scr	cmd.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2060-1-0x0000000001DA0000-0x0000000002E2E000-memory.dmp	upx
behavioral1/memory/2060-5-0x0000000001DA0000-0x0000000002E2E000-memory.dmp	upx
behavioral1/memory/2060-7-0x0000000001DA0000-0x0000000002E2E000-memory.dmp	upx
behavioral1/memory/2060-11-0x0000000001DA0000-0x0000000002E2E000-memory.dmp	upx
behavioral1/memory/2060-12-0x0000000001DA0000-0x0000000002E2E000-memory.dmp	upx
behavioral1/memory/2060-10-0x0000000001DA0000-0x0000000002E2E000-memory.dmp	upx
behavioral1/memory/2060-9-0x0000000001DA0000-0x0000000002E2E000-memory.dmp	upx
behavioral1/memory/2060-6-0x0000000001DA0000-0x0000000002E2E000-memory.dmp	upx
behavioral1/memory/2060-8-0x0000000001DA0000-0x0000000002E2E000-memory.dmp	upx
behavioral1/memory/2060-14-0x0000000001DA0000-0x0000000002E2E000-memory.dmp	upx
behavioral1/memory/2060-15-0x0000000001DA0000-0x0000000002E2E000-memory.dmp	upx
behavioral1/memory/2060-59-0x0000000001DA0000-0x0000000002E2E000-memory.dmp	upx
behavioral1/memory/2060-60-0x0000000001DA0000-0x0000000002E2E000-memory.dmp	upx
behavioral1/memory/2060-61-0x0000000001DA0000-0x0000000002E2E000-memory.dmp	upx
behavioral1/memory/2060-106-0x0000000001DA0000-0x0000000002E2E000-memory.dmp	upx
behavioral1/memory/648-206-0x0000000001ED0000-0x0000000002F5E000-memory.dmp	upx
behavioral1/memory/648-213-0x0000000001ED0000-0x0000000002F5E000-memory.dmp	upx
behavioral1/memory/648-211-0x0000000001ED0000-0x0000000002F5E000-memory.dmp	upx
behavioral1/memory/648-208-0x0000000001ED0000-0x0000000002F5E000-memory.dmp	upx
behavioral1/memory/648-209-0x0000000001ED0000-0x0000000002F5E000-memory.dmp	upx
behavioral1/memory/648-210-0x0000000001ED0000-0x0000000002F5E000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 58 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBInfo.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Kills process with taskkill 10 IoCs

evasion

pid	Process
1508	taskkill.exe
2848	taskkill.exe
2988	taskkill.exe
264	taskkill.exe
1784	taskkill.exe
1588	taskkill.exe
1308	taskkill.exe
268	taskkill.exe
884	taskkill.exe
668	taskkill.exe

Runs regedit.exe 10 IoCs

pid	Process
2296	regedit.exe
2568	regedit.exe
1332	regedit.exe
2596	regedit.exe
2724	regedit.exe
2500	regedit.exe
2924	regedit.exe
1620	regedit.exe
2940	regedit.exe
2104	regedit.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
648	USBInfo.com
648	USBInfo.com

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Token: SeDebugPrivilege	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Token: SeDebugPrivilege	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Token: SeDebugPrivilege	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Token: SeDebugPrivilege	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Token: SeDebugPrivilege	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Token: SeDebugPrivilege	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Token: SeDebugPrivilege	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Token: SeDebugPrivilege	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Token: SeDebugPrivilege	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Token: SeDebugPrivilege	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Token: SeDebugPrivilege	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Token: SeDebugPrivilege	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Token: SeDebugPrivilege	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Token: SeDebugPrivilege	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Token: SeDebugPrivilege	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Token: SeDebugPrivilege	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Token: SeDebugPrivilege	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Token: SeDebugPrivilege	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Token: SeDebugPrivilege	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Token: SeDebugPrivilege	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Token: SeDebugPrivilege	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Token: SeDebugPrivilege	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
Token: SeDebugPrivilege	1784	taskkill.exe
Token: SeDebugPrivilege	1588	taskkill.exe
Token: SeDebugPrivilege	648	USBInfo.com
Token: SeDebugPrivilege	648	USBInfo.com
Token: SeDebugPrivilege	648	USBInfo.com
Token: SeDebugPrivilege	648	USBInfo.com
Token: SeDebugPrivilege	648	USBInfo.com
Token: SeDebugPrivilege	648	USBInfo.com
Token: SeDebugPrivilege	648	USBInfo.com
Token: SeDebugPrivilege	648	USBInfo.com
Token: SeDebugPrivilege	648	USBInfo.com
Token: SeDebugPrivilege	648	USBInfo.com
Token: SeDebugPrivilege	648	USBInfo.com
Token: SeDebugPrivilege	648	USBInfo.com
Token: SeDebugPrivilege	648	USBInfo.com
Token: SeDebugPrivilege	648	USBInfo.com
Token: SeDebugPrivilege	648	USBInfo.com
Token: SeDebugPrivilege	648	USBInfo.com
Token: SeDebugPrivilege	648	USBInfo.com
Token: SeDebugPrivilege	648	USBInfo.com
Token: SeDebugPrivilege	648	USBInfo.com
Token: SeDebugPrivilege	648	USBInfo.com
Token: SeDebugPrivilege	648	USBInfo.com
Token: SeDebugPrivilege	648	USBInfo.com
Token: SeDebugPrivilege	648	USBInfo.com
Token: SeDebugPrivilege	1308	taskkill.exe
Token: SeDebugPrivilege	648	USBInfo.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2488	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe	31
PID 2060 wrote to memory of 2488	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe	31
PID 2060 wrote to memory of 2488	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe	31
PID 2060 wrote to memory of 2488	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe	31
PID 2488 wrote to memory of 2204	2488	cmd.exe	33
PID 2488 wrote to memory of 2204	2488	cmd.exe	33
PID 2488 wrote to memory of 2204	2488	cmd.exe	33
PID 2488 wrote to memory of 2204	2488	cmd.exe	33
PID 2488 wrote to memory of 2636	2488	cmd.exe	34
PID 2488 wrote to memory of 2636	2488	cmd.exe	34
PID 2488 wrote to memory of 2636	2488	cmd.exe	34
PID 2488 wrote to memory of 2636	2488	cmd.exe	34
PID 2060 wrote to memory of 1108	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe	19
PID 2060 wrote to memory of 1160	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe	20
PID 2060 wrote to memory of 1208	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe	21
PID 2060 wrote to memory of 1700	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe	25
PID 2060 wrote to memory of 2488	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe	31
PID 2060 wrote to memory of 2488	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe	31
PID 2060 wrote to memory of 1036	2060	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe	32
PID 2488 wrote to memory of 2804	2488	cmd.exe	35
PID 2488 wrote to memory of 2804	2488	cmd.exe	35
PID 2488 wrote to memory of 2804	2488	cmd.exe	35
PID 2488 wrote to memory of 2804	2488	cmd.exe	35
PID 2804 wrote to memory of 648	2804	WScript.exe	36
PID 2804 wrote to memory of 648	2804	WScript.exe	36
PID 2804 wrote to memory of 648	2804	WScript.exe	36
PID 2804 wrote to memory of 648	2804	WScript.exe	36
PID 648 wrote to memory of 1232	648	USBInfo.com	37
PID 648 wrote to memory of 1232	648	USBInfo.com	37
PID 648 wrote to memory of 1232	648	USBInfo.com	37
PID 648 wrote to memory of 1232	648	USBInfo.com	37
PID 1232 wrote to memory of 1784	1232	cmd.exe	39
PID 1232 wrote to memory of 1784	1232	cmd.exe	39
PID 1232 wrote to memory of 1784	1232	cmd.exe	39
PID 1232 wrote to memory of 1784	1232	cmd.exe	39
PID 1232 wrote to memory of 1620	1232	cmd.exe	41
PID 1232 wrote to memory of 1620	1232	cmd.exe	41
PID 1232 wrote to memory of 1620	1232	cmd.exe	41
PID 1232 wrote to memory of 1620	1232	cmd.exe	41
PID 1232 wrote to memory of 2104	1232	cmd.exe	42
PID 1232 wrote to memory of 2104	1232	cmd.exe	42
PID 1232 wrote to memory of 2104	1232	cmd.exe	42
PID 1232 wrote to memory of 2104	1232	cmd.exe	42
PID 1232 wrote to memory of 688	1232	cmd.exe	43
PID 1232 wrote to memory of 688	1232	cmd.exe	43
PID 1232 wrote to memory of 688	1232	cmd.exe	43
PID 1232 wrote to memory of 688	1232	cmd.exe	43
PID 1232 wrote to memory of 2120	1232	cmd.exe	44
PID 1232 wrote to memory of 2120	1232	cmd.exe	44
PID 1232 wrote to memory of 2120	1232	cmd.exe	44
PID 1232 wrote to memory of 2120	1232	cmd.exe	44
PID 1232 wrote to memory of 840	1232	cmd.exe	45
PID 1232 wrote to memory of 840	1232	cmd.exe	45
PID 1232 wrote to memory of 840	1232	cmd.exe	45
PID 1232 wrote to memory of 840	1232	cmd.exe	45
PID 1232 wrote to memory of 1608	1232	cmd.exe	46
PID 1232 wrote to memory of 1608	1232	cmd.exe	46
PID 1232 wrote to memory of 1608	1232	cmd.exe	46
PID 1232 wrote to memory of 1608	1232	cmd.exe	46
PID 1232 wrote to memory of 1600	1232	cmd.exe	47
PID 1232 wrote to memory of 1600	1232	cmd.exe	47
PID 1232 wrote to memory of 1600	1232	cmd.exe	47
PID 1232 wrote to memory of 1600	1232	cmd.exe	47
PID 1232 wrote to memory of 1524	1232	cmd.exe	48

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe

Views/modifies file attributes 1 TTPs 64 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2440	attrib.exe
2700	attrib.exe
2964	attrib.exe
1000	attrib.exe
688	attrib.exe
1800	attrib.exe
1476	attrib.exe
2280	attrib.exe
2076	attrib.exe
492	attrib.exe
2852	attrib.exe
2816	attrib.exe
2604	attrib.exe
344	attrib.exe
1072	attrib.exe
748	attrib.exe
3016	attrib.exe
1076	attrib.exe
2684	attrib.exe
1784	attrib.exe
1756	attrib.exe
2368	attrib.exe
2428	attrib.exe
884	attrib.exe
3040	attrib.exe
2208	attrib.exe
2460	attrib.exe
2184	attrib.exe
1484	attrib.exe
2648	attrib.exe
2100	attrib.exe
2388	attrib.exe
2296	attrib.exe
1784	attrib.exe
2280	attrib.exe
1712	attrib.exe
2792	attrib.exe
1140	attrib.exe
1856	attrib.exe
1840	attrib.exe
1144	attrib.exe
2504	attrib.exe
1652	attrib.exe
2036	attrib.exe
1728	attrib.exe
1600	attrib.exe
1756	attrib.exe
1056	attrib.exe
1264	attrib.exe
1036	attrib.exe
2188	attrib.exe
1748	attrib.exe
2388	attrib.exe
2704	attrib.exe
1980	attrib.exe
1524	attrib.exe
492	attrib.exe
1864	attrib.exe
2364	attrib.exe
864	attrib.exe
1864	attrib.exe
3056	attrib.exe
2772	attrib.exe
2256	attrib.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1108

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1160

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe
  "C:\Users\Admin\AppData\Local\Temp\d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe"
  2⤵
  - Modifies firewall policy service
  - UAC bypass
  - Windows security bypass
  - Windows security modification
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2060
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~E965.bat "C:\Users\Admin\AppData\Local\Temp\d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe"
    3⤵
    - Drops file in Drivers directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2204
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2636
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBInfo.vbe"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2804
    - - C:\Windows\SysWOW64\Drivers\USBInfo.com
        
        "C:\Windows\system32\Drivers\USBInfo.com"
        5⤵
        Modifies firewall policy service
        UAC bypass
        Windows security bypass
        Deletes itself
        Executes dropped EXE
        Windows security modification
        Checks whether UAC is enabled
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:648
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~4E1.bat "C:\Windows\system32\Drivers\USBInfo.com"
        6⤵
        Drops file in Drivers directory
        Drops desktop.ini file(s)
        Drops autorun.inf file
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1232
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1784
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Runs regedit.exe
        
        PID:1620
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2104
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:688
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2120
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h autorun.inf
        7⤵
        Sets file to hidden
        Drops autorun.inf file
        System Location Discovery: System Language Discovery
        
        PID:840
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "$Recycle.Bin"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1608
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "Documents and Settings"
        7⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1600
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "MSOCache"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1524
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "PerfLogs"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2184
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "Program Files"
        7⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1748
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "Program Files (x86)"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1744
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "ProgramData"
        7⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1712
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "Recovery"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1756
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "System Volume Information"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        
        PID:1732
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "Users"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1800
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "Windows"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1864
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        
        PID:1420
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1144
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2144
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2368
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2364
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1484
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2384
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        
        PID:2292
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h autorun.inf
        7⤵
        Sets file to hidden
        Drops autorun.inf file
        System Location Discovery: System Language Discovery
        
        PID:2296
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "$RECYCLE.BIN"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2004
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        
        PID:1556
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2428
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1588
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Runs regedit.exe
        
        PID:2724
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2708
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2804
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        
        PID:1200
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2816
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2440
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2604
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:864
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2504
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2648
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:492
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1784
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1476
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2100
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1308
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Runs regedit.exe
        
        PID:2500
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2992
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3016
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2388
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1864
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2280
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1652
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        
        PID:2368
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2188
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:1000
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Views/modifies file attributes
        
        PID:884
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2076
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Views/modifies file attributes
        
        PID:2296
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        Kills process with taskkill
        
        PID:268
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Runs regedit.exe
        
        PID:2924
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        
        PID:2864
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Views/modifies file attributes
        
        PID:2036
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        
        PID:2804
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2700
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Views/modifies file attributes
        
        PID:2604
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3056
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:492
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:344
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        Kills process with taskkill
        
        PID:1508
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Runs regedit.exe
        
        PID:2940
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1756
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        
        PID:3016
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Views/modifies file attributes
        
        PID:2388
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3040
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        
        PID:1680
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Views/modifies file attributes
        
        PID:1072
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2964
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1000
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        Kills process with taskkill
        
        PID:884
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Runs regedit.exe
        
        PID:2296
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        
        PID:2696
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2772
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h autorun.inf
        7⤵
        Views/modifies file attributes
        
        PID:2208
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Views/modifies file attributes
        
        PID:2460
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        
        PID:2860
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2852
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        
        PID:2172
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        
        PID:2820
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        Kills process with taskkill
        
        PID:2848
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Runs regedit.exe
        
        PID:2568
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1784
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h autorun.inf
        7⤵
        Sets file to hidden
        
        PID:2072
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        
        PID:2868
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Views/modifies file attributes
        
        PID:688
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1056
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:748
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Views/modifies file attributes
        
        PID:3016
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1264
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Views/modifies file attributes
        
        PID:2280
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        Kills process with taskkill
        
        PID:2988
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Runs regedit.exe
        
        PID:1332
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        
        PID:836
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        
        PID:2408
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1076
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2704
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        
        PID:2660
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2256
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1840
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        
        PID:2756
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Views/modifies file attributes
        
        PID:2792
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2684
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        Kills process with taskkill
        
        PID:264
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Runs regedit.exe
        
        PID:2596
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:492
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1980
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1036
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Views/modifies file attributes
        
        PID:1728
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        
        PID:1784
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Views/modifies file attributes
        
        PID:1140
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        
        PID:2276
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1856
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        Kills process with taskkill
        
        PID:668
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Runs regedit.exe
        
        PID:2104
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        
        PID:2372

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1700

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "983527543-19190672591975408307345498009977422752122579199-155219700-1818199377"
1⤵
PID:1036

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1808486885-13672963821378102644601709832300269903381554204-236409698-1024166174"
1⤵
PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~E965.bat

Filesize
4KB

MD5
bc278224d87330dbedf84ddefdced3f1

SHA1
0a21b60897db6bd7559fef583bb095266110b653

SHA256
1d75230f2ab4daeb62d42bb1bea8a5c4c9f6831f3830407f9615677dc29dac7a

SHA512
6ff654c73c68420d97657657f77d3934aaa60fddceca095d0f9d3f169e6fab7435d3a758f0d3eae086b2ee32ea7e5c0fa3ba602bc9416e0e1e2ca8743f0d846a

Download Submit
C:\Windows\SYSTEM.INI

Filesize
257B

MD5
3f0b7a7c07855c7e2b6a97453f0eaec8

SHA1
580826dab45732813e97aa66f81001569606efa3

SHA256
abb3f62bb201a3ceed0bdc098a7f3c91cd2a97751e63c1fad1966e7c570aa4e9

SHA512
e5159169a346643a5fe1d1b082d703f3f19f78e9ceceec537bb46214fa423ce1f207583c70e1a817bf86bef0286734be4ae6d9fda5138f89935ea7ab67a5d784

Download Submit
C:\Windows\SysWOW64\Drivers\USBInfo.com

Filesize
147KB

MD5
61d3136be3658491acae074138b0505d

SHA1
b6c6312033e310df775044301840c9b3b8e0e53f

SHA256
d55623794bdd7431f6fc71cc01160f1ba7fa2075c0ba5089ae4f55b92151342c

SHA512
f792581a068d7f0e92ac7106188050c9bde1521d413ef5c96614ffea1ebcabd71a8df8202f46fea4e293e14f09af0141915151d31d58ff64616d6ae9e127f960

Download Submit
C:\Windows\SysWOW64\Drivers\USBInfo.vbe

Filesize
77B

MD5
54ceb8eabaff522c097e4949d39fbd09

SHA1
304fd3c274aac25477ba1f3f500ae34e6c94612d

SHA256
d2d64a938a71d1b747112176eeb345991433fc81475a397b85b6b4c3d97f8550

SHA512
3c6ce4fe30121305b176a3ccc7358343bfdd28537358e7289e4354b52f152c018acfe843659df5bd35228fca804b0285baa8350e2b6ca39719bdefdb77b2e0be

Download Submit
C:\Windows\SysWOW64\Drivers\USBStor.vbe

Filesize
20B

MD5
905d7a48a13a75ced1342bbdf0a3ace2

SHA1
3bcc021a82ed38810bcf61286eb1f4e578e3721f

SHA256
10338a72fbacb4fdf731d8937cdf23519896c5122b6a80079527cebf8406b3cd

SHA512
fe77b8b928ba1ffb1a8bf941b2a0279b3ca6512d30dd1a2e2f363f9b2be245e361fab40232bc868f0f7e79bacc476653a49b66d2cf6945ed87b0c776783db8c1

Download Submit
C:\Windows\SysWOW64\Drivers\USBSys.vbe

Filesize
19B

MD5
322866ac1312f3bc0dd8685949f35b6a

SHA1
dc3f64764aa99595ee48721142d2301ebbe07aec

SHA256
5417fd3704beb2760ed54c38048ae44d2cd49312be2a8f104e542bbd5bbc88d6

SHA512
1b5c2320beaeb34895a1d11882566463d365a128db4d260189850990e1215ce737334ee96b43ecd2c018f040548209cc6f11328a5a9b9eb5f57fc6ac61afe03d

Download Submit
C:\Windows\SysWOW64\drivers\USBInfo.sy_

Filesize
1KB

MD5
e3f32bf45469d18567e23485109ffdd4

SHA1
2e207b073a4237e05b5da89f9ca2e9771757620c

SHA256
e41ad345599c751ed8b124229df31681f2c44d322d092f85c2205b97f09c8a81

SHA512
e8ab034c883c747d6a093d1221e080adf84a1c3662e4469c59cf49f693561262d435c28eede60e18151222fd9562abc6c81b6a57fa5587032cbc2d0b74a0c0e5

Download Submit
C:\autorun.inf

Filesize
149B

MD5
babb9292822f6963475088494e446a00

SHA1
d0f96ea279562a899f24b5a6905065de029877b0

SHA256
bff5694d6d4c8a41217fa9d98d95c355a6f63ef939a4ef89bc45d1cf443a1f9d

SHA512
b96daa0a52867f7f0454c8b35d85682aa22c3ac59495760c95204cc1cfc419bd88b5cc59d92dfab5a6343f8f86659e35e2f38cda0c1ea014d2377ab5e525fd5b

Download Submit
C:\desktop.ini

Filesize
160B

MD5
748a0be2fe2d85bb05d034b99e8e0d7d

SHA1
9ccddfb983fc4032b43019b2f7ebfa8c3b3b9d0b

SHA256
1071b18912a1ed7d89a9f47c3a0417c66578a6ab0ffce30310f659ea54f2fdd0

SHA512
b285a29b3651a02ba092c91d62f8891d726615953754a6919f3055ea2d169364157cb6470211b01c7edcb9390d90c851cecda78d1d9dfee1e846f56342ab558b

Download Submit
F:\desktop.ini

Filesize
14B

MD5
6feef98a8a0a708c076c6229fe3eb8e3

SHA1
21213d15bc8741f275d2f3b8c195ed7ce0548a78

SHA256
8df87f65c0941524972d4b9ed54a7b652f6ce23980f3e35c2baa651f0b2df8a8

SHA512
d00de3a17c0e66266cc02513a690e1bfa504122873926b035da2de492758df88930f999003638523faf211f085da6c755581f195bf1f3c2f3c74b75652b0f101

Download Submit
F:\mkfvn.pif

Filesize
100KB

MD5
b7e18d53522f2da200ecf939b9779347

SHA1
b4588eb176e7accd0289ff5d0470672e8e5a95d7

SHA256
6f4f030db1be9bc49fb98685f04a3b61b30fd796f44a287faa06f5ff4466bde5

SHA512
8b6264b8f38f1ce93c45d1dff732f1e8790df2e0ccad7182ddc9f7681801f80936115b0972d985f2a49ed279e06a8c5e23ad3f10b50eb415e0728c887215e355

Download Submit
memory/648-208-0x0000000001ED0000-0x0000000002F5E000-memory.dmp

Filesize
16.6MB

Download
memory/648-206-0x0000000001ED0000-0x0000000002F5E000-memory.dmp

Filesize
16.6MB

Download
memory/648-213-0x0000000001ED0000-0x0000000002F5E000-memory.dmp

Filesize
16.6MB

Download
memory/648-211-0x0000000001ED0000-0x0000000002F5E000-memory.dmp

Filesize
16.6MB

Download
memory/648-247-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/648-209-0x0000000001ED0000-0x0000000002F5E000-memory.dmp

Filesize
16.6MB

Download
memory/648-210-0x0000000001ED0000-0x0000000002F5E000-memory.dmp

Filesize
16.6MB

Download
memory/1108-36-0x0000000000320000-0x0000000000322000-memory.dmp

Filesize
8KB

Download
memory/2060-15-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

Filesize
16.6MB

Download
memory/2060-49-0x0000000003E20000-0x0000000003E22000-memory.dmp

Filesize
8KB

Download
memory/2060-45-0x0000000003E30000-0x0000000003E31000-memory.dmp

Filesize
4KB

Download
memory/2060-59-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

Filesize
16.6MB

Download
memory/2060-60-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

Filesize
16.6MB

Download
memory/2060-62-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2060-61-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

Filesize
16.6MB

Download
memory/2060-47-0x0000000003E30000-0x0000000003E31000-memory.dmp

Filesize
4KB

Download
memory/2060-48-0x0000000003E20000-0x0000000003E22000-memory.dmp

Filesize
8KB

Download
memory/2060-79-0x0000000003E20000-0x0000000003E22000-memory.dmp

Filesize
8KB

Download
memory/2060-1-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

Filesize
16.6MB

Download
memory/2060-5-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

Filesize
16.6MB

Download
memory/2060-7-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

Filesize
16.6MB

Download
memory/2060-106-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

Filesize
16.6MB

Download
memory/2060-103-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2060-44-0x0000000003E20000-0x0000000003E22000-memory.dmp

Filesize
8KB

Download
memory/2060-11-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

Filesize
16.6MB

Download
memory/2060-12-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

Filesize
16.6MB

Download
memory/2060-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2060-14-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

Filesize
16.6MB

Download
memory/2060-8-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

Filesize
16.6MB

Download
memory/2060-6-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

Filesize
16.6MB

Download
memory/2060-9-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

Filesize
16.6MB

Download
memory/2060-10-0x0000000001DA0000-0x0000000002E2E000-memory.dmp

Filesize
16.6MB

Download
memory/2488-54-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/2488-57-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download
memory/2488-85-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download
memory/2804-82-0x00000000007C0000-0x00000000007EB000-memory.dmp

Filesize
172KB

Download
memory/2804-80-0x00000000007C0000-0x00000000007EB000-memory.dmp

Filesize
172KB

Download