Overview
overview
10Static
static
XISE WBMS ...��.exe
windows7-x64
10XISE WBMS ...��.exe
windows10-2004-x64
10fz.dll
windows7-x64
3fz.dll
windows10-2004-x64
3jiaoben/zhu/asp/1.asp
windows7-x64
3jiaoben/zhu/asp/1.asp
windows10-2004-x64
3xise/XISE ....9.exe
windows7-x64
10xise/XISE ....9.exe
windows10-2004-x64
10xise/jiaob...se.vbs
windows7-x64
1xise/jiaob...se.vbs
windows10-2004-x64
1xise/jsc.dll
windows7-x64
3xise/jsc.dll
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
18-09-2022 01:45
Static task
static1
Behavioral task
behavioral1
Sample
XISE WBMS 2020官方正版.exe
Resource
win7-20220812-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
XISE WBMS 2020官方正版.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral3
Sample
fz.dll
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
fz.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
jiaoben/zhu/asp/1.asp
Resource
win7-20220901-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
jiaoben/zhu/asp/1.asp
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
xise/XISE 菜刀管理7.9.exe
Resource
win7-20220812-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral8
Sample
xise/XISE 菜刀管理7.9.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral9
Sample
xise/jiaoben/ASPhorse.vbs
Resource
win7-20220901-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
xise/jiaoben/ASPhorse.vbs
Resource
win10v2004-20220812-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
xise/jsc.dll
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
xise/jsc.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
XISE WBMS 2020官方正版.exe
-
Size
4.0MB
-
MD5
a47caab73754524cc784192093c20e29
-
SHA1
e51864c3b164629bc1fc37b45fee5681dc8acacb
-
SHA256
aac091f5d270dc494cb1730c74d6568a3bc4eef593f7de539bf258acebaa46d0
-
SHA512
b6e06a55208fbeb74fa281666366bd88a2c62a52fa501e08d8deeed16ecf9c703fee477a9920da05e38be6a8946045024a4d398135fcc986a5294690cfef2292
-
SSDEEP
98304:Hnsmtk2aakvWib3jEvh6TnA20+eYiwgyvraKFt:HLab3o56TA20nAdu8t
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" XISE WBMS 2020官方正版.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" XISE WBMS 2020官方正版.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" XISE WBMS 2020官方正版.exe -
resource yara_rule behavioral1/memory/1504-55-0x00000000021D0000-0x000000000325E000-memory.dmp upx behavioral1/memory/1504-56-0x00000000021D0000-0x000000000325E000-memory.dmp upx behavioral1/memory/1504-59-0x00000000021D0000-0x000000000325E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" XISE WBMS 2020官方正版.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" XISE WBMS 2020官方正版.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" XISE WBMS 2020官方正版.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" XISE WBMS 2020官方正版.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: XISE WBMS 2020官方正版.exe File opened (read-only) \??\I: XISE WBMS 2020官方正版.exe File opened (read-only) \??\J: XISE WBMS 2020官方正版.exe File opened (read-only) \??\N: XISE WBMS 2020官方正版.exe File opened (read-only) \??\Q: XISE WBMS 2020官方正版.exe File opened (read-only) \??\W: XISE WBMS 2020官方正版.exe File opened (read-only) \??\X: XISE WBMS 2020官方正版.exe File opened (read-only) \??\F: XISE WBMS 2020官方正版.exe File opened (read-only) \??\H: XISE WBMS 2020官方正版.exe File opened (read-only) \??\K: XISE WBMS 2020官方正版.exe File opened (read-only) \??\M: XISE WBMS 2020官方正版.exe File opened (read-only) \??\O: XISE WBMS 2020官方正版.exe File opened (read-only) \??\R: XISE WBMS 2020官方正版.exe File opened (read-only) \??\P: XISE WBMS 2020官方正版.exe File opened (read-only) \??\S: XISE WBMS 2020官方正版.exe File opened (read-only) \??\T: XISE WBMS 2020官方正版.exe File opened (read-only) \??\V: XISE WBMS 2020官方正版.exe File opened (read-only) \??\G: XISE WBMS 2020官方正版.exe File opened (read-only) \??\L: XISE WBMS 2020官方正版.exe File opened (read-only) \??\U: XISE WBMS 2020官方正版.exe File opened (read-only) \??\Y: XISE WBMS 2020官方正版.exe File opened (read-only) \??\Z: XISE WBMS 2020官方正版.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf XISE WBMS 2020官方正版.exe -
Drops file in Program Files directory 9 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe XISE WBMS 2020官方正版.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7ZFM.EXE XISE WBMS 2020官方正版.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7ZG.EXE XISE WBMS 2020官方正版.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe XISE WBMS 2020官方正版.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe XISE WBMS 2020官方正版.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7Z.EXE XISE WBMS 2020官方正版.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe XISE WBMS 2020官方正版.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe XISE WBMS 2020官方正版.exe File opened for modification C:\PROGRAM FILES\7-ZIP\UNINSTALL.EXE XISE WBMS 2020官方正版.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI XISE WBMS 2020官方正版.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe -
Suspicious behavior: MapViewOfSection 20 IoCs
pid Process 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe 1504 XISE WBMS 2020官方正版.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeDebugPrivilege 1504 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 1504 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 1504 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 1504 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 1504 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 1504 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 1504 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 1504 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 1504 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 1504 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 1504 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 1504 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 1504 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 1504 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 1504 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 1504 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 1504 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 1504 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 1504 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 1504 XISE WBMS 2020官方正版.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1504 wrote to memory of 1260 1504 XISE WBMS 2020官方正版.exe 15 PID 1504 wrote to memory of 1344 1504 XISE WBMS 2020官方正版.exe 9 PID 1504 wrote to memory of 1396 1504 XISE WBMS 2020官方正版.exe 14 PID 1504 wrote to memory of 368 1504 XISE WBMS 2020官方正版.exe 5 PID 1504 wrote to memory of 368 1504 XISE WBMS 2020官方正版.exe 5 PID 1504 wrote to memory of 368 1504 XISE WBMS 2020官方正版.exe 5 PID 1504 wrote to memory of 368 1504 XISE WBMS 2020官方正版.exe 5 PID 1504 wrote to memory of 368 1504 XISE WBMS 2020官方正版.exe 5 PID 1504 wrote to memory of 368 1504 XISE WBMS 2020官方正版.exe 5 PID 1504 wrote to memory of 368 1504 XISE WBMS 2020官方正版.exe 5 PID 1504 wrote to memory of 376 1504 XISE WBMS 2020官方正版.exe 4 PID 1504 wrote to memory of 376 1504 XISE WBMS 2020官方正版.exe 4 PID 1504 wrote to memory of 376 1504 XISE WBMS 2020官方正版.exe 4 PID 1504 wrote to memory of 376 1504 XISE WBMS 2020官方正版.exe 4 PID 1504 wrote to memory of 376 1504 XISE WBMS 2020官方正版.exe 4 PID 1504 wrote to memory of 376 1504 XISE WBMS 2020官方正版.exe 4 PID 1504 wrote to memory of 376 1504 XISE WBMS 2020官方正版.exe 4 PID 1504 wrote to memory of 416 1504 XISE WBMS 2020官方正版.exe 3 PID 1504 wrote to memory of 416 1504 XISE WBMS 2020官方正版.exe 3 PID 1504 wrote to memory of 416 1504 XISE WBMS 2020官方正版.exe 3 PID 1504 wrote to memory of 416 1504 XISE WBMS 2020官方正版.exe 3 PID 1504 wrote to memory of 416 1504 XISE WBMS 2020官方正版.exe 3 PID 1504 wrote to memory of 416 1504 XISE WBMS 2020官方正版.exe 3 PID 1504 wrote to memory of 416 1504 XISE WBMS 2020官方正版.exe 3 PID 1504 wrote to memory of 460 1504 XISE WBMS 2020官方正版.exe 2 PID 1504 wrote to memory of 460 1504 XISE WBMS 2020官方正版.exe 2 PID 1504 wrote to memory of 460 1504 XISE WBMS 2020官方正版.exe 2 PID 1504 wrote to memory of 460 1504 XISE WBMS 2020官方正版.exe 2 PID 1504 wrote to memory of 460 1504 XISE WBMS 2020官方正版.exe 2 PID 1504 wrote to memory of 460 1504 XISE WBMS 2020官方正版.exe 2 PID 1504 wrote to memory of 460 1504 XISE WBMS 2020官方正版.exe 2 PID 1504 wrote to memory of 476 1504 XISE WBMS 2020官方正版.exe 1 PID 1504 wrote to memory of 476 1504 XISE WBMS 2020官方正版.exe 1 PID 1504 wrote to memory of 476 1504 XISE WBMS 2020官方正版.exe 1 PID 1504 wrote to memory of 476 1504 XISE WBMS 2020官方正版.exe 1 PID 1504 wrote to memory of 476 1504 XISE WBMS 2020官方正版.exe 1 PID 1504 wrote to memory of 476 1504 XISE WBMS 2020官方正版.exe 1 PID 1504 wrote to memory of 476 1504 XISE WBMS 2020官方正版.exe 1 PID 1504 wrote to memory of 484 1504 XISE WBMS 2020官方正版.exe 8 PID 1504 wrote to memory of 484 1504 XISE WBMS 2020官方正版.exe 8 PID 1504 wrote to memory of 484 1504 XISE WBMS 2020官方正版.exe 8 PID 1504 wrote to memory of 484 1504 XISE WBMS 2020官方正版.exe 8 PID 1504 wrote to memory of 484 1504 XISE WBMS 2020官方正版.exe 8 PID 1504 wrote to memory of 484 1504 XISE WBMS 2020官方正版.exe 8 PID 1504 wrote to memory of 484 1504 XISE WBMS 2020官方正版.exe 8 PID 1504 wrote to memory of 596 1504 XISE WBMS 2020官方正版.exe 24 PID 1504 wrote to memory of 596 1504 XISE WBMS 2020官方正版.exe 24 PID 1504 wrote to memory of 596 1504 XISE WBMS 2020官方正版.exe 24 PID 1504 wrote to memory of 596 1504 XISE WBMS 2020官方正版.exe 24 PID 1504 wrote to memory of 596 1504 XISE WBMS 2020官方正版.exe 24 PID 1504 wrote to memory of 596 1504 XISE WBMS 2020官方正版.exe 24 PID 1504 wrote to memory of 596 1504 XISE WBMS 2020官方正版.exe 24 PID 1504 wrote to memory of 676 1504 XISE WBMS 2020官方正版.exe 23 PID 1504 wrote to memory of 676 1504 XISE WBMS 2020官方正版.exe 23 PID 1504 wrote to memory of 676 1504 XISE WBMS 2020官方正版.exe 23 PID 1504 wrote to memory of 676 1504 XISE WBMS 2020官方正版.exe 23 PID 1504 wrote to memory of 676 1504 XISE WBMS 2020官方正版.exe 23 PID 1504 wrote to memory of 676 1504 XISE WBMS 2020官方正版.exe 23 PID 1504 wrote to memory of 676 1504 XISE WBMS 2020官方正版.exe 23 PID 1504 wrote to memory of 752 1504 XISE WBMS 2020官方正版.exe 22 PID 1504 wrote to memory of 752 1504 XISE WBMS 2020官方正版.exe 22 PID 1504 wrote to memory of 752 1504 XISE WBMS 2020官方正版.exe 22 PID 1504 wrote to memory of 752 1504 XISE WBMS 2020官方正版.exe 22 PID 1504 wrote to memory of 752 1504 XISE WBMS 2020官方正版.exe 22 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" XISE WBMS 2020官方正版.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:476
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:460
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:2024
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:1980
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1260
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1040
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:536
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:328
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:868
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:844
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:808
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:752
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:676
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:596
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:416
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:376
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:368
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:484
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1344
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\XISE WBMS 2020官方正版.exe"C:\Users\Admin\AppData\Local\Temp\XISE WBMS 2020官方正版.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1504
-