sality | ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc

Analysis

max time kernel
29s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/12/2024, 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Size

147KB
MD5

75c865f1747b242051eb6a05e91f915a
SHA1

624e32dc35c81331bee657174ba5744ab262564b
SHA256

ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc
SHA512

b5ca5b998a12cede7c11cac166d6f839c3ba4cbd7a22b6cdfb0385cb42ebd2e94c163543d826419f05f4cd4780e3f72003ae20d69b6ac7bebe4afadf48926cea
SSDEEP

3072:YA/yzn2EpnbZdb1U4FwhKNUrvHc9c7AWTTYbDU:YJnjbyKUziXMTN

Score

10^/10

sality backdoor discovery evasion persistence trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	regedit.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	regedit.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Sality family
sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	USBInfo.com

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	USBInfo.com

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Drivers\Driver.sys	cmd.exe
File created	C:\Windows\SysWOW64\Drivers\USBInfo.vbe	cmd.exe
File created	C:\Windows\SysWOW64\Drivers\USBInfo.sy_	cmd.exe
File created	C:\Windows\SysWOW64\Drivers\USBSys.vbe	cmd.exe
File created	C:\Windows\SysWOW64\Drivers\USBInfo.com	cmd.exe
File opened for modification	C:\Windows\SysWOW64\Drivers\USBInfo.com	cmd.exe
File created	C:\Windows\SysWOW64\Drivers\USBStor.vbe	cmd.exe

Sets file to hidden 1 TTPs 64 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1132	attrib.exe
2524	attrib.exe
2056	attrib.exe
2808	attrib.exe
2584	attrib.exe
352	attrib.exe
1652	attrib.exe
1008	attrib.exe
1536	attrib.exe
1884	attrib.exe
2632	attrib.exe
1520	attrib.exe
2712	attrib.exe
2932	attrib.exe
1560	attrib.exe
2652	attrib.exe
340	attrib.exe
2972	attrib.exe
2440	attrib.exe
1552	attrib.exe
1732	attrib.exe
2556	attrib.exe
2108	attrib.exe
2616	attrib.exe
2216	attrib.exe
1748	attrib.exe
288	attrib.exe
1532	attrib.exe
1040	attrib.exe
576	attrib.exe
1260	attrib.exe
1600	attrib.exe
2308	attrib.exe
908	attrib.exe
2504	attrib.exe
1284	attrib.exe
2848	attrib.exe
1812	attrib.exe
2216	attrib.exe
1052	attrib.exe
1616	attrib.exe
1800	attrib.exe
2132	attrib.exe
2604	attrib.exe
484	attrib.exe
2032	attrib.exe
2920	attrib.exe
3024	attrib.exe
2744	attrib.exe
2420	attrib.exe
2480	attrib.exe
900	attrib.exe
1268	attrib.exe
1600	attrib.exe
1880	attrib.exe
2356	attrib.exe
2516	attrib.exe
1732	attrib.exe
1812	attrib.exe
2076	attrib.exe
2068	attrib.exe
2828	attrib.exe
2668	attrib.exe
2904	attrib.exe

Deletes itself 1 IoCs

pid	Process
1876	USBInfo.com

Executes dropped EXE 1 IoCs

pid	Process
1876	USBInfo.com

Loads dropped DLL 2 IoCs

pid	Process
600	WScript.exe
600	WScript.exe

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	USBInfo.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	USBInfo.com
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	USBInfo.com

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\@ = "c:\\windows\\system32\\Drivers\\USBInfo.com"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\@ = "c:\\windows\\system32\\Drivers\\USBInfo.com"	regedit.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	USBInfo.com

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\\desktop.ini	cmd.exe
File created	F:\\desktop.ini	cmd.exe

Enumerates connected drives 3 TTPs 9 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	USBInfo.com
File opened (read-only)	\??\J:	USBInfo.com
File opened (read-only)	\??\G:	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
File opened (read-only)	\??\H:	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
File opened (read-only)	\??\E:	USBInfo.com
File opened (read-only)	\??\H:	USBInfo.com
File opened (read-only)	\??\E:	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
File opened (read-only)	\??\I:	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
File opened (read-only)	\??\G:	USBInfo.com

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	F:\\autorun.inf	cmd.exe
File opened for modification	F:\autorun.inf	attrib.exe
File created	C:\\autorun.inf	cmd.exe
File opened for modification	C:\autorun.inf	attrib.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ScreenSave.scr	cmd.exe
File opened for modification	C:\Windows\SysWOW64\ScreenSave.scr	cmd.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1564-37-0x0000000001E90000-0x0000000002F1E000-memory.dmp	upx
behavioral1/memory/1564-13-0x0000000001E90000-0x0000000002F1E000-memory.dmp	upx
behavioral1/memory/1564-8-0x0000000001E90000-0x0000000002F1E000-memory.dmp	upx
behavioral1/memory/1564-5-0x0000000001E90000-0x0000000002F1E000-memory.dmp	upx
behavioral1/memory/1564-11-0x0000000001E90000-0x0000000002F1E000-memory.dmp	upx
behavioral1/memory/1564-10-0x0000000001E90000-0x0000000002F1E000-memory.dmp	upx
behavioral1/memory/1564-9-0x0000000001E90000-0x0000000002F1E000-memory.dmp	upx
behavioral1/memory/1564-7-0x0000000001E90000-0x0000000002F1E000-memory.dmp	upx
behavioral1/memory/1564-6-0x0000000001E90000-0x0000000002F1E000-memory.dmp	upx
behavioral1/memory/1564-62-0x0000000001E90000-0x0000000002F1E000-memory.dmp	upx
behavioral1/memory/1564-63-0x0000000001E90000-0x0000000002F1E000-memory.dmp	upx
behavioral1/memory/1564-65-0x0000000001E90000-0x0000000002F1E000-memory.dmp	upx
behavioral1/memory/1564-66-0x0000000001E90000-0x0000000002F1E000-memory.dmp	upx
behavioral1/memory/1564-67-0x0000000001E90000-0x0000000002F1E000-memory.dmp	upx
behavioral1/memory/1564-69-0x0000000001E90000-0x0000000002F1E000-memory.dmp	upx
behavioral1/memory/1564-70-0x0000000001E90000-0x0000000002F1E000-memory.dmp	upx
behavioral1/memory/1564-72-0x0000000001E90000-0x0000000002F1E000-memory.dmp	upx
behavioral1/memory/1564-73-0x0000000001E90000-0x0000000002F1E000-memory.dmp	upx
behavioral1/memory/1564-78-0x0000000001E90000-0x0000000002F1E000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 48 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBInfo.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Kills process with taskkill 7 IoCs

evasion

pid	Process
1904	taskkill.exe
1596	taskkill.exe
1672	taskkill.exe
2536	taskkill.exe
2252	taskkill.exe
1692	taskkill.exe
2252	taskkill.exe

Runs regedit.exe 7 IoCs

pid	Process
2380	regedit.exe
1036	regedit.exe
2348	regedit.exe
768	regedit.exe
1936	regedit.exe
380	regedit.exe
832	regedit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
1876	USBInfo.com

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Token: SeDebugPrivilege	1672	taskkill.exe
Token: SeDebugPrivilege	2536	taskkill.exe
Token: SeDebugPrivilege	1876	USBInfo.com
Token: SeDebugPrivilege	1876	USBInfo.com
Token: SeDebugPrivilege	1876	USBInfo.com
Token: SeDebugPrivilege	1876	USBInfo.com
Token: SeDebugPrivilege	1876	USBInfo.com
Token: SeDebugPrivilege	1876	USBInfo.com
Token: SeDebugPrivilege	1876	USBInfo.com
Token: SeDebugPrivilege	1876	USBInfo.com
Token: SeDebugPrivilege	1876	USBInfo.com
Token: SeDebugPrivilege	1876	USBInfo.com
Token: SeDebugPrivilege	1876	USBInfo.com
Token: SeDebugPrivilege	1876	USBInfo.com
Token: SeDebugPrivilege	1876	USBInfo.com
Token: SeDebugPrivilege	1876	USBInfo.com
Token: SeDebugPrivilege	1876	USBInfo.com
Token: SeDebugPrivilege	1876	USBInfo.com
Token: SeDebugPrivilege	1876	USBInfo.com
Token: SeDebugPrivilege	1876	USBInfo.com
Token: SeDebugPrivilege	1876	USBInfo.com
Token: SeDebugPrivilege	1876	USBInfo.com
Token: SeDebugPrivilege	1876	USBInfo.com
Token: SeDebugPrivilege	1876	USBInfo.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 2972	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	29
PID 1564 wrote to memory of 2972	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	29
PID 1564 wrote to memory of 2972	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	29
PID 1564 wrote to memory of 2972	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	29
PID 2972 wrote to memory of 2544	2972	cmd.exe	31
PID 2972 wrote to memory of 2544	2972	cmd.exe	31
PID 2972 wrote to memory of 2544	2972	cmd.exe	31
PID 2972 wrote to memory of 2544	2972	cmd.exe	31
PID 1564 wrote to memory of 1112	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	19
PID 1564 wrote to memory of 1180	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	20
PID 1564 wrote to memory of 1236	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	21
PID 1564 wrote to memory of 1188	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	23
PID 1564 wrote to memory of 2972	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	29
PID 1564 wrote to memory of 2972	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	29
PID 1564 wrote to memory of 1196	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	30
PID 1564 wrote to memory of 2544	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	31
PID 1564 wrote to memory of 2544	1564	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe	31
PID 2972 wrote to memory of 576	2972	cmd.exe	32
PID 2972 wrote to memory of 576	2972	cmd.exe	32
PID 2972 wrote to memory of 576	2972	cmd.exe	32
PID 2972 wrote to memory of 576	2972	cmd.exe	32
PID 2972 wrote to memory of 600	2972	cmd.exe	33
PID 2972 wrote to memory of 600	2972	cmd.exe	33
PID 2972 wrote to memory of 600	2972	cmd.exe	33
PID 2972 wrote to memory of 600	2972	cmd.exe	33
PID 600 wrote to memory of 1876	600	WScript.exe	34
PID 600 wrote to memory of 1876	600	WScript.exe	34
PID 600 wrote to memory of 1876	600	WScript.exe	34
PID 600 wrote to memory of 1876	600	WScript.exe	34
PID 1876 wrote to memory of 2824	1876	USBInfo.com	35
PID 1876 wrote to memory of 2824	1876	USBInfo.com	35
PID 1876 wrote to memory of 2824	1876	USBInfo.com	35
PID 1876 wrote to memory of 2824	1876	USBInfo.com	35
PID 2824 wrote to memory of 1672	2824	cmd.exe	37
PID 2824 wrote to memory of 1672	2824	cmd.exe	37
PID 2824 wrote to memory of 1672	2824	cmd.exe	37
PID 2824 wrote to memory of 1672	2824	cmd.exe	37
PID 2824 wrote to memory of 1036	2824	cmd.exe	39
PID 2824 wrote to memory of 1036	2824	cmd.exe	39
PID 2824 wrote to memory of 1036	2824	cmd.exe	39
PID 2824 wrote to memory of 1036	2824	cmd.exe	39
PID 2824 wrote to memory of 2756	2824	cmd.exe	40
PID 2824 wrote to memory of 2756	2824	cmd.exe	40
PID 2824 wrote to memory of 2756	2824	cmd.exe	40
PID 2824 wrote to memory of 2756	2824	cmd.exe	40
PID 2824 wrote to memory of 912	2824	cmd.exe	41
PID 2824 wrote to memory of 912	2824	cmd.exe	41
PID 2824 wrote to memory of 912	2824	cmd.exe	41
PID 2824 wrote to memory of 912	2824	cmd.exe	41
PID 2824 wrote to memory of 1520	2824	cmd.exe	42
PID 2824 wrote to memory of 1520	2824	cmd.exe	42
PID 2824 wrote to memory of 1520	2824	cmd.exe	42
PID 2824 wrote to memory of 1520	2824	cmd.exe	42
PID 2824 wrote to memory of 1536	2824	cmd.exe	43
PID 2824 wrote to memory of 1536	2824	cmd.exe	43
PID 2824 wrote to memory of 1536	2824	cmd.exe	43
PID 2824 wrote to memory of 1536	2824	cmd.exe	43
PID 2824 wrote to memory of 340	2824	cmd.exe	44
PID 2824 wrote to memory of 340	2824	cmd.exe	44
PID 2824 wrote to memory of 340	2824	cmd.exe	44
PID 2824 wrote to memory of 340	2824	cmd.exe	44
PID 2824 wrote to memory of 2604	2824	cmd.exe	45
PID 2824 wrote to memory of 2604	2824	cmd.exe	45
PID 2824 wrote to memory of 2604	2824	cmd.exe	45

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	USBInfo.com

Views/modifies file attributes 1 TTPs 64 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1520	attrib.exe
1536	attrib.exe
2604	attrib.exe
2828	attrib.exe
1748	attrib.exe
2440	attrib.exe
2108	attrib.exe
1284	attrib.exe
2808	attrib.exe
1880	attrib.exe
2504	attrib.exe
908	attrib.exe
776	attrib.exe
1812	attrib.exe
352	attrib.exe
1884	attrib.exe
2744	attrib.exe
1260	attrib.exe
1616	attrib.exe
2544	attrib.exe
340	attrib.exe
484	attrib.exe
2356	attrib.exe
2668	attrib.exe
2420	attrib.exe
1052	attrib.exe
900	attrib.exe
288	attrib.exe
2616	attrib.exe
2216	attrib.exe
1132	attrib.exe
1560	attrib.exe
2132	attrib.exe
2076	attrib.exe
2056	attrib.exe
2556	attrib.exe
2632	attrib.exe
1552	attrib.exe
1532	attrib.exe
2216	attrib.exe
1732	attrib.exe
2972	attrib.exe
1652	attrib.exe
1600	attrib.exe
1812	attrib.exe
2848	attrib.exe
2932	attrib.exe
1600	attrib.exe
3024	attrib.exe
2904	attrib.exe
1008	attrib.exe
2516	attrib.exe
1040	attrib.exe
2480	attrib.exe
2584	attrib.exe
2308	attrib.exe
1384	attrib.exe
316	attrib.exe
1732	attrib.exe
2032	attrib.exe
2920	attrib.exe
2524	attrib.exe
2712	attrib.exe
1556	attrib.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1112

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1180

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1236
- C:\Users\Admin\AppData\Local\Temp\ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe
  "C:\Users\Admin\AppData\Local\Temp\ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe"
  2⤵
  - Modifies firewall policy service
  - UAC bypass
  - Windows security bypass
  - Windows security modification
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1564
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~FFD2.bat "C:\Users\Admin\AppData\Local\Temp\ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe"
    3⤵
    - Drops file in Drivers directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h "C:\Users\Admin\AppData\Local\Temp\ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2544
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:576
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBInfo.vbe"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:600
    - - C:\Windows\SysWOW64\Drivers\USBInfo.com
        
        "C:\Windows\system32\Drivers\USBInfo.com"
        5⤵
        Modifies firewall policy service
        UAC bypass
        Windows security bypass
        Deletes itself
        Executes dropped EXE
        Windows security modification
        Checks whether UAC is enabled
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1876
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~24A0.bat "C:\Windows\system32\Drivers\USBInfo.com"
        6⤵
        Drops file in Drivers directory
        Drops desktop.ini file(s)
        Drops autorun.inf file
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2824
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1672
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Runs regedit.exe
        
        PID:1036
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2756
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:912
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1520
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h autorun.inf
        7⤵
        Sets file to hidden
        Drops autorun.inf file
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1536
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "$Recycle.Bin"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:340
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "Documents and Settings"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2604
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "MSOCache"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:484
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "PerfLogs"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:900
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "Program Files"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        
        PID:2068
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "Program Files (x86)"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:352
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "ProgramData"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2848
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "Recovery"
        7⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:316
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "System Volume Information"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1884
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "Users"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1732
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "Windows"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2032
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:288
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2356
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1000
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:3024
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1600
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2920
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2856
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2524
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h autorun.inf
        7⤵
        Sets file to hidden
        Drops autorun.inf file
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2056
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "$RECYCLE.BIN"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2216
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2556
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2632
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2536
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Runs regedit.exe
        
        PID:2348
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1704
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1908
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2808
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2972
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2584
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2152
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1652
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        
        PID:1268
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2828
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1260
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2744
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2712
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1748
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        Kills process with taskkill
        
        PID:2252
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Runs regedit.exe
        
        PID:768
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1600
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2932
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2440
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Views/modifies file attributes
        
        PID:1556
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1552
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2668
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1880
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1616
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2904
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        Kills process with taskkill
        
        PID:1692
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Runs regedit.exe
        
        PID:1936
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1812
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2108
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1008
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2308
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:908
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2516
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2504
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Views/modifies file attributes
        
        PID:1384
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1532
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        Kills process with taskkill
        
        PID:2252
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Runs regedit.exe
        
        PID:380
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2616
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2216
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2420
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1132
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1040
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1732
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        
        PID:2652
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Views/modifies file attributes
        
        PID:776
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        
        PID:576
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        Kills process with taskkill
        
        PID:1904
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Runs regedit.exe
        
        PID:832
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        
        PID:772
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2480
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1560
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1052
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        
        PID:1800
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1812
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2132
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBSys.vbe"
        7⤵
        
        PID:408
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h ╬─╝■╝╨.exe
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2076
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "recycler.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1260
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +a +r +s +h "system volume information.exe"
        7⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1284
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im usbmon.exe /im U┼╠▓í╢╛├Γ╥▀╞≈.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
        7⤵
        Kills process with taskkill
        
        PID:1596
        
        C:\Windows\SysWOW64\regedit.exe
        
        regedit /s C:\Windows\system32\Drivers\USBInfo.sy_
        7⤵
        Runs regedit.exe
        
        PID:2380
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\Drivers\USBStor.vbe"
        7⤵
        
        PID:1964

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1188

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "889200431-569280326193843426211836923091571236423-989729089-20957142651000446718"
1⤵
PID:1196

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-155699798211510114801795613790990365110-1480472598-20445891785885436481126556125"
1⤵
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~FFD2.bat

Filesize
4KB

MD5
bc278224d87330dbedf84ddefdced3f1

SHA1
0a21b60897db6bd7559fef583bb095266110b653

SHA256
1d75230f2ab4daeb62d42bb1bea8a5c4c9f6831f3830407f9615677dc29dac7a

SHA512
6ff654c73c68420d97657657f77d3934aaa60fddceca095d0f9d3f169e6fab7435d3a758f0d3eae086b2ee32ea7e5c0fa3ba602bc9416e0e1e2ca8743f0d846a

Download Submit
C:\Windows\SYSTEM.INI

Filesize
256B

MD5
75ff72a0b3453735b4e1daf5a392a881

SHA1
01ed478d6ff4db3056d2e28d8816e87114f83a44

SHA256
b364003f9ee77bc908a97e936edd7cd244987fa28d17f7d5d168ff701d76a8c6

SHA512
9e6871ecc3fd6591c461f22c95d21619d113f0a623cf4b05258fc6277a9d5c03b11c8de8eca56f870d7120b1294e5e53a0ecc9e119c114707aed06c1083b27db

Download Submit
C:\Windows\SysWOW64\Drivers\USBInfo.com

Filesize
147KB

MD5
75c865f1747b242051eb6a05e91f915a

SHA1
624e32dc35c81331bee657174ba5744ab262564b

SHA256
ce3ecf3836b45da6e133fcd1a37a272d46cc6e6ba79b65d00a55bc6f81da8bdc

SHA512
b5ca5b998a12cede7c11cac166d6f839c3ba4cbd7a22b6cdfb0385cb42ebd2e94c163543d826419f05f4cd4780e3f72003ae20d69b6ac7bebe4afadf48926cea

Download Submit
C:\Windows\SysWOW64\Drivers\USBInfo.vbe

Filesize
77B

MD5
54ceb8eabaff522c097e4949d39fbd09

SHA1
304fd3c274aac25477ba1f3f500ae34e6c94612d

SHA256
d2d64a938a71d1b747112176eeb345991433fc81475a397b85b6b4c3d97f8550

SHA512
3c6ce4fe30121305b176a3ccc7358343bfdd28537358e7289e4354b52f152c018acfe843659df5bd35228fca804b0285baa8350e2b6ca39719bdefdb77b2e0be

Download Submit
C:\Windows\SysWOW64\Drivers\USBStor.vbe

Filesize
20B

MD5
905d7a48a13a75ced1342bbdf0a3ace2

SHA1
3bcc021a82ed38810bcf61286eb1f4e578e3721f

SHA256
10338a72fbacb4fdf731d8937cdf23519896c5122b6a80079527cebf8406b3cd

SHA512
fe77b8b928ba1ffb1a8bf941b2a0279b3ca6512d30dd1a2e2f363f9b2be245e361fab40232bc868f0f7e79bacc476653a49b66d2cf6945ed87b0c776783db8c1

Download Submit
C:\Windows\SysWOW64\Drivers\USBSys.vbe

Filesize
19B

MD5
322866ac1312f3bc0dd8685949f35b6a

SHA1
dc3f64764aa99595ee48721142d2301ebbe07aec

SHA256
5417fd3704beb2760ed54c38048ae44d2cd49312be2a8f104e542bbd5bbc88d6

SHA512
1b5c2320beaeb34895a1d11882566463d365a128db4d260189850990e1215ce737334ee96b43ecd2c018f040548209cc6f11328a5a9b9eb5f57fc6ac61afe03d

Download Submit
C:\Windows\SysWOW64\drivers\USBInfo.sy_

Filesize
1KB

MD5
e3f32bf45469d18567e23485109ffdd4

SHA1
2e207b073a4237e05b5da89f9ca2e9771757620c

SHA256
e41ad345599c751ed8b124229df31681f2c44d322d092f85c2205b97f09c8a81

SHA512
e8ab034c883c747d6a093d1221e080adf84a1c3662e4469c59cf49f693561262d435c28eede60e18151222fd9562abc6c81b6a57fa5587032cbc2d0b74a0c0e5

Download Submit
C:\autorun.inf

Filesize
149B

MD5
babb9292822f6963475088494e446a00

SHA1
d0f96ea279562a899f24b5a6905065de029877b0

SHA256
bff5694d6d4c8a41217fa9d98d95c355a6f63ef939a4ef89bc45d1cf443a1f9d

SHA512
b96daa0a52867f7f0454c8b35d85682aa22c3ac59495760c95204cc1cfc419bd88b5cc59d92dfab5a6343f8f86659e35e2f38cda0c1ea014d2377ab5e525fd5b

Download Submit
C:\desktop.ini

Filesize
160B

MD5
748a0be2fe2d85bb05d034b99e8e0d7d

SHA1
9ccddfb983fc4032b43019b2f7ebfa8c3b3b9d0b

SHA256
1071b18912a1ed7d89a9f47c3a0417c66578a6ab0ffce30310f659ea54f2fdd0

SHA512
b285a29b3651a02ba092c91d62f8891d726615953754a6919f3055ea2d169364157cb6470211b01c7edcb9390d90c851cecda78d1d9dfee1e846f56342ab558b

Download Submit
C:\xfugaw.exe

Filesize
100KB

MD5
a9d3dc0e13ba721c4cc03e34b783cd25

SHA1
fb1abe2e0e478dcf4fc5f93e75c41fcd5acd4e9b

SHA256
346c6f622a740a4354c2a11d584a7900cc49bd16cc1ec1382fbb16f736a3c015

SHA512
57c0f062eb0d9978a6aa7d39a99da68834a269daf43d61de48abcd3308d87cfda55823315f4d775aa975cce6f5d91a9ac4bad75ec304e4d082d482b0112d7590

Download Submit
F:\desktop.ini

Filesize
14B

MD5
6feef98a8a0a708c076c6229fe3eb8e3

SHA1
21213d15bc8741f275d2f3b8c195ed7ce0548a78

SHA256
8df87f65c0941524972d4b9ed54a7b652f6ce23980f3e35c2baa651f0b2df8a8

SHA512
d00de3a17c0e66266cc02513a690e1bfa504122873926b035da2de492758df88930f999003638523faf211f085da6c755581f195bf1f3c2f3c74b75652b0f101

Download Submit
memory/600-95-0x0000000002250000-0x000000000227B000-memory.dmp

Filesize
172KB

Download
memory/600-93-0x0000000002250000-0x000000000227B000-memory.dmp

Filesize
172KB

Download
memory/1112-14-0x0000000000250000-0x0000000000252000-memory.dmp

Filesize
8KB

Download
memory/1564-5-0x0000000001E90000-0x0000000002F1E000-memory.dmp

Filesize
16.6MB

Download
memory/1564-73-0x0000000001E90000-0x0000000002F1E000-memory.dmp

Filesize
16.6MB

Download
memory/1564-9-0x0000000001E90000-0x0000000002F1E000-memory.dmp

Filesize
16.6MB

Download
memory/1564-7-0x0000000001E90000-0x0000000002F1E000-memory.dmp

Filesize
16.6MB

Download
memory/1564-6-0x0000000001E90000-0x0000000002F1E000-memory.dmp

Filesize
16.6MB

Download
memory/1564-10-0x0000000001E90000-0x0000000002F1E000-memory.dmp

Filesize
16.6MB

Download
memory/1564-24-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1564-62-0x0000000001E90000-0x0000000002F1E000-memory.dmp

Filesize
16.6MB

Download
memory/1564-63-0x0000000001E90000-0x0000000002F1E000-memory.dmp

Filesize
16.6MB

Download
memory/1564-11-0x0000000001E90000-0x0000000002F1E000-memory.dmp

Filesize
16.6MB

Download
memory/1564-65-0x0000000001E90000-0x0000000002F1E000-memory.dmp

Filesize
16.6MB

Download
memory/1564-66-0x0000000001E90000-0x0000000002F1E000-memory.dmp

Filesize
16.6MB

Download
memory/1564-67-0x0000000001E90000-0x0000000002F1E000-memory.dmp

Filesize
16.6MB

Download
memory/1564-69-0x0000000001E90000-0x0000000002F1E000-memory.dmp

Filesize
16.6MB

Download
memory/1564-70-0x0000000001E90000-0x0000000002F1E000-memory.dmp

Filesize
16.6MB

Download
memory/1564-71-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1564-72-0x0000000001E90000-0x0000000002F1E000-memory.dmp

Filesize
16.6MB

Download
memory/1564-22-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1564-88-0x0000000000290000-0x0000000000292000-memory.dmp

Filesize
8KB

Download
memory/1564-78-0x0000000001E90000-0x0000000002F1E000-memory.dmp

Filesize
16.6MB

Download
memory/1564-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1564-8-0x0000000001E90000-0x0000000002F1E000-memory.dmp

Filesize
16.6MB

Download
memory/1564-13-0x0000000001E90000-0x0000000002F1E000-memory.dmp

Filesize
16.6MB

Download
memory/1564-35-0x0000000000290000-0x0000000000292000-memory.dmp

Filesize
8KB

Download
memory/1564-21-0x0000000000290000-0x0000000000292000-memory.dmp

Filesize
8KB

Download
memory/1564-118-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1564-37-0x0000000001E90000-0x0000000002F1E000-memory.dmp

Filesize
16.6MB

Download
memory/1564-38-0x0000000000290000-0x0000000000292000-memory.dmp

Filesize
8KB

Download
memory/1876-223-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2544-34-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2972-92-0x0000000000170000-0x0000000000172000-memory.dmp

Filesize
8KB

Download
memory/2972-41-0x0000000000170000-0x0000000000172000-memory.dmp

Filesize
8KB

Download
memory/2972-40-0x0000000000170000-0x0000000000172000-memory.dmp

Filesize
8KB

Download
memory/2972-28-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download