| File name: | USBGuard6.6.0.0.exe |
| Full analysis: | https://app.any.run/tasks/eb728d25-4731-46fe-9f07-ee4a2375418d |
| Verdict: | Malicious activity |
| Analysis date: | January 15, 2019, 18:07:57 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | D9E7071623C26A11E2DB868360651DAB |
| SHA1: | B36BBCB78CD8268A9F961D5DD5E4A899B9790475 |
| SHA256: | 077BFBB56056BECC2B984EE6C0EB487C02BF7C05F9E2F758655D6551E06A2736 |
| SSDEEP: | 196608:3rZEwMZlefOKWtqcpFVVNY4VwGrl9Y3FHkIRy4zdC9JCfGwqQzn0i+LmohV:1EfZlGOLqMTP9c3FRRrzdC9OQkkhV |
MALICIOUS
Application was dropped or rewritten from another process
- backupmaster.exe (PID: 872)
- linkzb.exe (PID: 3284)
Loads dropped or rewritten executable
- backupmaster.exe (PID: 872)
- linkzb.exe (PID: 3284)
Changes the autorun value in the registry
- USBGuard6.6.0.0.tmp (PID: 2448)
SUSPICIOUS
Executable content was dropped or overwritten
- USBGuard6.6.0.0.exe (PID: 3172)
- USBGuard6.6.0.0.exe (PID: 2100)
- USBGuard6.6.0.0.tmp (PID: 2448)
Reads the Windows organization settings
- USBGuard6.6.0.0.tmp (PID: 2448)
Creates files in the user directory
- backupmaster.exe (PID: 872)
Starts Internet Explorer
- linkzb.exe (PID: 3284)
Reads Windows owner or organization settings
- USBGuard6.6.0.0.tmp (PID: 2448)
INFO
Creates files in the program directory
- USBGuard6.6.0.0.tmp (PID: 2448)
Dropped object may contain Bitcoin addresses
- USBGuard6.6.0.0.tmp (PID: 2448)
Changes internet zones settings
- iexplore.exe (PID: 2192)
Loads dropped or rewritten executable
- USBGuard6.6.0.0.tmp (PID: 2448)
Application was dropped or rewritten from another process
- USBGuard6.6.0.0.tmp (PID: 3852)
- USBGuard6.6.0.0.tmp (PID: 2448)
Application launched itself
- iexplore.exe (PID: 2192)
Creates files in the user directory
- FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2724)
- iexplore.exe (PID: 1352)
Reads Internet Cache Settings
- iexplore.exe (PID: 2492)
- iexplore.exe (PID: 1352)
Reads internet explorer settings
- iexplore.exe (PID: 1352)
Reads settings of System Certificates
- iexplore.exe (PID: 1352)
Creates a software uninstall entry
- USBGuard6.6.0.0.tmp (PID: 2448)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Delphi generic (45.2) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (20.9) |
| .exe | | | Win32 Executable (generic) (14.3) |
| .exe | | | Win16/32 Executable Delphi generic (6.6) |
| .exe | | | Generic Win/DOS Executable (6.3) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2014:07:09 09:58:13+02:00 |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 65024 |
| InitializedDataSize: | 58368 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x113bc |
| OSVersion: | 5 |
| ImageVersion: | 6 |
| SubsystemVersion: | 5 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 6.6.0.0 |
| ProductVersionNumber: | 6.6.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | Zbshareware Lab |
| FileDescription: | USB Disk Security Setup |
| FileVersion: | 6.6.0.0 |
| LegalCopyright: | |
| ProductName: | USB Disk Security |
| ProductVersion: | 6.6.0.0 |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 09-Jul-2014 07:58:13 |
| Detected languages: |
|
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | Zbshareware Lab |
| FileDescription: | USB Disk Security Setup |
| FileVersion: | 6.6.0.0 |
| LegalCopyright: | - |
| ProductName: | USB Disk Security |
| ProductVersion: | 6.6.0.0 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0050 |
| Pages in file: | 0x0002 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x000F |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x001A |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000100 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 8 |
| Time date stamp: | 09-Jul-2014 07:58:13 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x0000F12C | 0x0000F200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.39148 |
.itext | 0x00011000 | 0x00000B44 | 0x00000C00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 5.73207 |
.data | 0x00012000 | 0x00000C88 | 0x00000E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.24631 |
.bss | 0x00013000 | 0x000056B4 | 0x00000000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.idata | 0x00019000 | 0x00000DD0 | 0x00000E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.97188 |
.tls | 0x0001A000 | 0x00000008 | 0x00000000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rdata | 0x0001B000 | 0x00000018 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.204488 |
.rsrc | 0x0001C000 | 0x0000C5C4 | 0x0000C600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.43784 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.11919 | 1512 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 4.13669 | 1384 | Latin 1 / Western European | English - United States | RT_ICON |
3 | 3.91985 | 744 | Latin 1 / Western European | English - United States | RT_ICON |
4 | 4.57076 | 2216 | Latin 1 / Western European | English - United States | RT_ICON |
5 | 3.68656 | 1640 | Latin 1 / Western European | English - United States | RT_ICON |
6 | 4.50268 | 3752 | Latin 1 / Western European | English - United States | RT_ICON |
4091 | 2.56031 | 104 | Latin 1 / Western European | UNKNOWN | RT_STRING |
4092 | 3.25287 | 212 | Latin 1 / Western European | UNKNOWN | RT_STRING |
4093 | 3.26919 | 164 | Latin 1 / Western European | UNKNOWN | RT_STRING |
4094 | 3.33268 | 684 | Latin 1 / Western European | UNKNOWN | RT_STRING |
Imports
advapi32.dll |
comctl32.dll |
kernel32.dll |
oleaut32.dll |
user32.dll |
Total processes
46
Monitored processes
10
Malicious processes
4
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 872 | "C:\Program Files\USB Disk Security\backupmaster.exe" | C:\Program Files\USB Disk Security\backupmaster.exe | USBGuard6.6.0.0.tmp | ||||||||||||
User: admin Company: Bo Zheng Integrity Level: MEDIUM Description: Autotransfer to PC Exit code: 0 Version: 1.0.0.1 Modules
| |||||||||||||||
| 1352 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2192 CREDAT:71938 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2100 | "C:\Users\admin\AppData\Local\Temp\USBGuard6.6.0.0.exe" /SPAWNWND=$20116 /NOTIFYWND=$2011C | C:\Users\admin\AppData\Local\Temp\USBGuard6.6.0.0.exe | USBGuard6.6.0.0.tmp | ||||||||||||
User: admin Company: Zbshareware Lab Integrity Level: HIGH Description: USB Disk Security Setup Exit code: 0 Version: 6.6.0.0 Modules
| |||||||||||||||
| 2192 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | linkzb.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2448 | "C:\Users\admin\AppData\Local\Temp\is-0NTNO.tmp\USBGuard6.6.0.0.tmp" /SL5="$20120,8122254,124416,C:\Users\admin\AppData\Local\Temp\USBGuard6.6.0.0.exe" /SPAWNWND=$20116 /NOTIFYWND=$2011C | C:\Users\admin\AppData\Local\Temp\is-0NTNO.tmp\USBGuard6.6.0.0.tmp | USBGuard6.6.0.0.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 2492 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2192 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | — | iexplore.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2724 | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe | — | svchost.exe | |||||||||||
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Exit code: 0 Version: 26,0,0,131 Modules
| |||||||||||||||
| 3172 | "C:\Users\admin\AppData\Local\Temp\USBGuard6.6.0.0.exe" | C:\Users\admin\AppData\Local\Temp\USBGuard6.6.0.0.exe | explorer.exe | ||||||||||||
User: admin Company: Zbshareware Lab Integrity Level: MEDIUM Description: USB Disk Security Setup Exit code: 0 Version: 6.6.0.0 Modules
| |||||||||||||||
| 3284 | "C:\Program Files\USB Disk Security\linkzb.exe" | C:\Program Files\USB Disk Security\linkzb.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3852 | "C:\Users\admin\AppData\Local\Temp\is-D3III.tmp\USBGuard6.6.0.0.tmp" /SL5="$2011C,8122254,124416,C:\Users\admin\AppData\Local\Temp\USBGuard6.6.0.0.exe" | C:\Users\admin\AppData\Local\Temp\is-D3III.tmp\USBGuard6.6.0.0.tmp | — | USBGuard6.6.0.0.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
Total events
1 124
Read events
991
Write events
124
Delete events
9
Modification events
| (PID) Process: | (2448) USBGuard6.6.0.0.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Owner |
Value: 90090000A0D2A74BFDACD401 | |||
| (PID) Process: | (2448) USBGuard6.6.0.0.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | SessionHash |
Value: E69F2CA39F7A2628157E21842385B14A5852B11C5FA8AF7545CAE81764B8F118 | |||
| (PID) Process: | (2448) USBGuard6.6.0.0.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Sequence |
Value: 1 | |||
| (PID) Process: | (2448) USBGuard6.6.0.0.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | RegFiles0000 |
Value: C:\Program Files\USB Disk Security\USBGuard.exe | |||
| (PID) Process: | (2448) USBGuard6.6.0.0.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | RegFilesHash |
Value: 7DC7DD9247E7BB875434E2A1BA4BEF741CF60C55A225EDEE3FEE05932DDE9EBE | |||
| (PID) Process: | (2448) USBGuard6.6.0.0.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | USB Security |
Value: C:\Program Files\USB Disk Security\USBGuard.exe | |||
| (PID) Process: | (2448) USBGuard6.6.0.0.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | AutoTransfer PC |
Value: C:\Program Files\USB Disk Security\backupmaster.exe | |||
| (PID) Process: | (2448) USBGuard6.6.0.0.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\USB Disk Security_is1 |
| Operation: | write | Name: | Inno Setup: Setup Version |
Value: 5.5.5 (u) | |||
| (PID) Process: | (2448) USBGuard6.6.0.0.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\USB Disk Security_is1 |
| Operation: | write | Name: | Inno Setup: App Path |
Value: C:\Program Files\USB Disk Security | |||
| (PID) Process: | (2448) USBGuard6.6.0.0.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\USB Disk Security_is1 |
| Operation: | write | Name: | InstallLocation |
Value: C:\Program Files\USB Disk Security\ | |||
Executable files
42
Suspicious files
4
Text files
28
Unknown types
13
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2448 | USBGuard6.6.0.0.tmp | C:\Program Files\USB Disk Security\is-KUM4F.tmp | — | |
MD5:— | SHA256:— | |||
| 2448 | USBGuard6.6.0.0.tmp | C:\Program Files\USB Disk Security\is-HH2O0.tmp | — | |
MD5:— | SHA256:— | |||
| 2448 | USBGuard6.6.0.0.tmp | C:\Program Files\USB Disk Security\is-M5E8U.tmp | — | |
MD5:— | SHA256:— | |||
| 2448 | USBGuard6.6.0.0.tmp | C:\Program Files\USB Disk Security\is-9SE9T.tmp | — | |
MD5:— | SHA256:— | |||
| 2448 | USBGuard6.6.0.0.tmp | C:\Program Files\USB Disk Security\is-HPMBU.tmp | — | |
MD5:— | SHA256:— | |||
| 2448 | USBGuard6.6.0.0.tmp | C:\Program Files\USB Disk Security\is-D4E8D.tmp | — | |
MD5:— | SHA256:— | |||
| 2448 | USBGuard6.6.0.0.tmp | C:\Program Files\USB Disk Security\is-UERHU.tmp | — | |
MD5:— | SHA256:— | |||
| 2448 | USBGuard6.6.0.0.tmp | C:\Program Files\USB Disk Security\is-5DJ9R.tmp | — | |
MD5:— | SHA256:— | |||
| 2448 | USBGuard6.6.0.0.tmp | C:\Program Files\USB Disk Security\is-RCSAK.tmp | — | |
MD5:— | SHA256:— | |||
| 2448 | USBGuard6.6.0.0.tmp | C:\Program Files\USB Disk Security\is-OMCSQ.tmp | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
10
DNS requests
7
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1352 | iexplore.exe | GET | 302 | 216.92.92.222:80 | http://www.linkzb.com/ | US | — | — | suspicious |
1352 | iexplore.exe | GET | 200 | 66.39.18.183:80 | http://www.linkzb.net/country/eng/index-yh.html | US | html | 22.3 Kb | malicious |
1352 | iexplore.exe | GET | 200 | 66.39.18.183:80 | http://www.linkzb.net/images/img_1.6.gif | US | image | 4.67 Kb | malicious |
1352 | iexplore.exe | GET | 200 | 172.217.21.194:80 | http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js | US | text | 28.2 Kb | whitelisted |
2192 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
1352 | iexplore.exe | GET | 200 | 172.217.18.110:80 | http://www.google-analytics.com/r/collect?v=1&_v=j72&a=1992142097&t=pageview&_s=1&dl=http%3A%2F%2Fwww.linkzb.net%2Fcountry%2Feng%2Findex-yh.html&ul=en-us&de=utf-8&dt=Linkzb%20-%20A%20quick%20and%20safe%20way%20to%20browse%20online.&sd=32-bit&sr=1280x720&vp=788x444&je=0&fl=26.0%20r0&_u=IEBAAE~&jid=1222653941&gjid=345197023&cid=1291000851.1547575812&tid=UA-2316786-3&_gid=2549196.1547575812&_r=1&z=325162282 | US | image | 35 b | whitelisted |
2192 | iexplore.exe | GET | 404 | 66.39.18.183:80 | http://www.linkzb.net/favicon.ico | US | html | 209 b | malicious |
1352 | iexplore.exe | GET | 200 | 172.217.18.110:80 | http://www.google-analytics.com/analytics.js | US | text | 17.0 Kb | whitelisted |
2192 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
1352 | iexplore.exe | GET | 200 | 66.39.18.183:80 | http://linkzb.net/javascript/3.0/linkzb-3.0.index.min.js | US | html | 62.5 Kb | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2192 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
1352 | iexplore.exe | 216.92.92.222:80 | www.linkzb.com | pair Networks | US | suspicious |
1352 | iexplore.exe | 66.39.18.183:80 | www.linkzb.net | pair Networks | US | unknown |
1352 | iexplore.exe | 172.217.18.110:80 | www.google-analytics.com | Google Inc. | US | whitelisted |
1352 | iexplore.exe | 172.217.21.194:80 | pagead2.googlesyndication.com | Google Inc. | US | whitelisted |
1352 | iexplore.exe | 216.58.208.34:443 | adservice.google.com | Google Inc. | US | whitelisted |
2192 | iexplore.exe | 66.39.18.183:80 | www.linkzb.net | pair Networks | US | unknown |
1352 | iexplore.exe | 172.217.21.194:443 | pagead2.googlesyndication.com | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.linkzb.com |
| suspicious |
www.bing.com |
| whitelisted |
www.linkzb.net |
| malicious |
www.google-analytics.com |
| whitelisted |
pagead2.googlesyndication.com |
| whitelisted |
adservice.google.no |
| whitelisted |
adservice.google.com |
| whitelisted |