87a7edf9bbbcf07b5f4373d9a192a6770d2ff3add7aa1e276e82e38582ccb622

Analysis

max time kernel
898s
max time network
492s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/05/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
USBPcapSetup-1.5.4.0.exe
Size 190KB
Sample260505-dmaclabw8j
SHA256 87a7edf9bbbcf07b5f4373d9a192a6770d2ff3add7aa1e276e82e38582ccb622
MD5 93c9b5098b1d42c53c7bdd68fe9cd6cf
SHA1 ccfb1497abed432844ad972dea65853dd0e7cba1
SHA512 dc6b84d0784ae36941615565ff21e8634bf36e3efdaff598d470035157a2f148cd1f10031504476f821cd0ce0180c61ee9fe6a7bd0beb3721c4b1c738f61fef1
SSDEEP 3072:PQZmPYFFiorvcQNpDjrc5nMDi93g6HC+0vaiFxMv6mwSARrwPKVvbygEXoHApLG6:PQLFhJXrcVMDcgoCtswShkTAoRA9
TLSH
T14D14025A23E1C0A3D797063098F66637BEF5E2100152691F63B0A6673E872568F5B1CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\DRIVERS\SETA37.tmp	RUNDLL32.EXE
File opened for modification	C:\Windows\system32\DRIVERS\USBPcap.sys	RUNDLL32.EXE
File opened for modification	C:\Windows\system32\DRIVERS\SETA37.tmp	RUNDLL32.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	RUNDLL32.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\USBPcap\USBPcap.sys	USBPcapSetup-1.5.4.0.exe
File created	C:\Program Files\USBPcap\usbpcapamd64.cat	USBPcapSetup-1.5.4.0.exe
File created	C:\Program Files\USBPcap\Uninstall.exe	USBPcapSetup-1.5.4.0.exe
File created	C:\Program Files\USBPcap\USBPcapCMD.exe	USBPcapSetup-1.5.4.0.exe
File created	C:\Program Files\USBPcap\USBPcap.inf	USBPcapSetup-1.5.4.0.exe

Executes dropped EXE 1 IoCs

pid	Process
2420	USBPcapCMD.exe

Loads dropped DLL 2 IoCs

pid	Process
2752	USBPcapSetup-1.5.4.0.exe
2752	USBPcapSetup-1.5.4.0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBPcapSetup-1.5.4.0.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a09cc7b9ddbd1cc00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a09cc7b90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900a09cc7b9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aa09cc7b9000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da09cc7b9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeBackupPrivilege	4128	vssvc.exe
Token: SeRestorePrivilege	4128	vssvc.exe
Token: SeAuditPrivilege	4128	vssvc.exe
Token: SeBackupPrivilege	4084	srtasks.exe
Token: SeRestorePrivilege	4084	srtasks.exe
Token: SeSecurityPrivilege	4084	srtasks.exe
Token: SeTakeOwnershipPrivilege	4084	srtasks.exe
Token: SeBackupPrivilege	4084	srtasks.exe
Token: SeRestorePrivilege	4084	srtasks.exe
Token: SeSecurityPrivilege	4084	srtasks.exe
Token: SeTakeOwnershipPrivilege	4084	srtasks.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2900	2752	USBPcapSetup-1.5.4.0.exe	84
PID 2900 wrote to memory of 1580	2900	RUNDLL32.EXE	85
PID 1580 wrote to memory of 3912	1580	runonce.exe	86
PID 2752 wrote to memory of 2420	2752	USBPcapSetup-1.5.4.0.exe	88

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\USBPcapSetup-1.5.4.0.exe
"C:\Users\Admin\AppData\Local\Temp\USBPcapSetup-1.5.4.0.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\system32\RUNDLL32.EXE
  C:\Windows\system32\RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 .\USBPcap.inf
  2⤵
  - Drops file in Drivers directory
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\system32\runonce.exe
    "C:\Windows\system32\runonce.exe" -r
    3⤵
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:1580
  - - C:\Windows\System32\grpconv.exe
      "C:\Windows\System32\grpconv.exe" -o
      4⤵
      PID:3912
- C:\Program Files\USBPcap\USBPcapCMD.exe
  "C:\Program Files\USBPcap\USBPcapCMD.exe" -I
  2⤵
  - Executes dropped EXE
  PID:2420

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4128

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4084

C:\Windows\system32\grpconv.exe
grpconv -o
1⤵
PID:1856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

USBPcap.sys

Path C:\PROGRA~1\USBPcap\USBPcap.sys
Size 51KB
SHA256 f340a8cf2f127be2e6b558586b76b51ba5e8c58c462a8d9eecc1955771cb2974
MD5 01304fc31498030c789e80910a356e6b
SHA1 8a8da048c75a6a587b7636ade603cc611b3c4833
SHA512 48921040e1108478f5bc5969ede09c9fdc1cb76df05cee47fd97502343e2975b0e161607596eaf6e384586e006da4820adbd65937d65d51e14fb9bdcb4d4c7fd
SSDEEP 768:Fv9neO3gPvnCORE+KvWt74cTuzWoYKpuYuYZFb2aL3hP0p33b0gj:inbtYUYfb283hP0tI
TLSH
T122338DD326B868D2E597DA3082E8D65BFAB5F2C2271187CF0228D1951F137D1AB39309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

USBPcap.inf

Path C:\Program Files\USBPcap\USBPcap.inf
Size 1KB
SHA256 08289f227abc0ee9a681f6af3f9abb12c160f95c37f02691e46b70305961f76e
MD5 98ccf371dde01388184d06b470ce4303
SHA1 0a7b549c80fea977aa8073facfacd33d548c8746
SHA512 757ed42e4372228818d61eae83c605d86e604e49441d795a2d4caf4fe8c3164263deb1868b795fb0e5a9c8f9236ab733c15cd1c906b9affa28c98717ed072e8a
TLSH
T1C041CC463DE757B0BB9379D4FE870981F154B90091DE205232DE808047FA90F9BBD2E9
MD5 SHA1 SHA512 TLSH

Submit Download

USBPcapCMD.exe

Path C:\Program Files\USBPcap\USBPcapCMD.exe
Size 55KB
SHA256 8b13173e9453fda9914d707c732880de44081e20e1113b3a2c827abd7a28b15d
MD5 939020f02ba0dffd7a7a1d45182c3bc4
SHA1 c219269325c53ed5d69343086dfdd853e533b072
SHA512 d0c09838a028bfbf3477fbf13d05753a3ec2fa7f87b92d94c516fbe9d35fb4c9b7fb85efa78d6c8fff8b4105cd8e2db107974800695b49dc85e3745b646c4055
SSDEEP 1536:iTCVdyj0+mnBIPtZ34H/hOMhVSb2qf3hZ1:iTCg1qIPjofnSbH1
TLSH
T12D438D6A7BA440F5C0AB82B6D9D14B22FEB1B4454B2807CF0464C6A92E137F6D63F717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SysRestore.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb4841.tmp\SysRestore.dll
Size 5KB
SHA256 9176c65e37d931edeeb51f9deb1ab9b5ac2d1c6311ad85339bb79f0f2840b2a9
MD5 c1e07f0ea14ebf4142176d340ed421f3
SHA1 f3524213ebbb53b4ce9ae1a1172897d4438445ed
SHA512 3e69f403bdd041ce9da91307659645f44a760360e69e986c1740b04be0dd66bfa017ce8783f9f4f81d545eb43eb68df09c90c8391c2a417cf611064dba5453a6
SSDEEP 48:KSOluw74Rqzy+uMD2CWoI7Npom7QEDQY/6232uK6hmX3//fTQvSl5B0KQg8mmad8:Glu03/Dwz53dKNEv05B030neZV36s
TLSH
T1FBC1C736BED159F1DE950A372CC7089916B6662183C445F31E239D8E2E00CC5EE3A306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb4841.tmp\System.dll
Size 11KB
SHA256 ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
MD5 0063d48afe5a0cdc02833145667b6641
SHA1 e7eb614805d183ecb1127c62decb1a6be1b4f7a8
SHA512 71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
SSDEEP 192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
TLSH
T1CB326D5503504AF3E996863C00263BBFAF796A2095F14D53CFA394C0FE2E5C9AD78352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2752-4-0x00000000009A0000-0x0000000000A62000-memory.dmp

Download

memory/2752-20-0x00000000009A0000-0x0000000000A62000-memory.dmp

Download

memory/2752-29-0x00000000009A0000-0x0000000000A62000-memory.dmp

Download

memory/2752-33-0x00000000009A0000-0x0000000000A62000-memory.dmp

Download

memory/2900-22-0x00000234D0990000-0x00000234D0A3E000-memory.dmp

Download

memory/4128-28-0x0000026FFCBB0000-0x0000026FFCC5E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads