Overview
overview
10Static
static
XISE WBMS ...��.exe
windows7-x64
10XISE WBMS ...��.exe
windows10-2004-x64
10fz.dll
windows7-x64
3fz.dll
windows10-2004-x64
3jiaoben/zhu/asp/1.asp
windows7-x64
3jiaoben/zhu/asp/1.asp
windows10-2004-x64
3xise/XISE ....9.exe
windows7-x64
10xise/XISE ....9.exe
windows10-2004-x64
10xise/jiaob...se.vbs
windows7-x64
1xise/jiaob...se.vbs
windows10-2004-x64
1xise/jsc.dll
windows7-x64
3xise/jsc.dll
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
18-09-2022 01:45
Static task
static1
Behavioral task
behavioral1
Sample
XISE WBMS 2020官方正版.exe
Resource
win7-20220812-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
XISE WBMS 2020官方正版.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral3
Sample
fz.dll
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
fz.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
jiaoben/zhu/asp/1.asp
Resource
win7-20220901-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
jiaoben/zhu/asp/1.asp
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
xise/XISE 菜刀管理7.9.exe
Resource
win7-20220812-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral8
Sample
xise/XISE 菜刀管理7.9.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral9
Sample
xise/jiaoben/ASPhorse.vbs
Resource
win7-20220901-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
xise/jiaoben/ASPhorse.vbs
Resource
win10v2004-20220812-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
xise/jsc.dll
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
xise/jsc.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
xise/XISE 菜刀管理7.9.exe
-
Size
3.5MB
-
MD5
96982ad9d89aed47ae7745e629ac5e94
-
SHA1
a38cd9ca46a12465e167fa4e142566dcbacd52c0
-
SHA256
1af112aa05fff8e947f7d0736bbd22b103bfaeadaf8df008d0a8420399411f36
-
SHA512
1a9711e65786155e1e6f263d3d1871a44e4c4465ea7497996dbab5ae4fb95241bcb47c4f9e5fcb3a924fc31d547ecbb9ee2eecbc5ea551c8005688976f7b256a
-
SSDEEP
49152:pnsHyjtk2MYC5GDBBV14O01+D/PO+pC6x692Aa+36/jOk:pnsmtk2aqVmOC+D/PO+pC6x69ja+Gjj
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" XISE 菜刀管理7.9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" XISE 菜刀管理7.9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" XISE 菜刀管理7.9.exe -
resource yara_rule behavioral7/memory/1532-55-0x0000000002320000-0x00000000033AE000-memory.dmp upx behavioral7/memory/1532-56-0x0000000002320000-0x00000000033AE000-memory.dmp upx behavioral7/memory/1532-59-0x0000000002320000-0x00000000033AE000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" XISE 菜刀管理7.9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc XISE 菜刀管理7.9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" XISE 菜刀管理7.9.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" XISE 菜刀管理7.9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" XISE 菜刀管理7.9.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: XISE 菜刀管理7.9.exe File opened (read-only) \??\U: XISE 菜刀管理7.9.exe File opened (read-only) \??\M: XISE 菜刀管理7.9.exe File opened (read-only) \??\P: XISE 菜刀管理7.9.exe File opened (read-only) \??\Q: XISE 菜刀管理7.9.exe File opened (read-only) \??\V: XISE 菜刀管理7.9.exe File opened (read-only) \??\Y: XISE 菜刀管理7.9.exe File opened (read-only) \??\W: XISE 菜刀管理7.9.exe File opened (read-only) \??\Z: XISE 菜刀管理7.9.exe File opened (read-only) \??\H: XISE 菜刀管理7.9.exe File opened (read-only) \??\I: XISE 菜刀管理7.9.exe File opened (read-only) \??\J: XISE 菜刀管理7.9.exe File opened (read-only) \??\L: XISE 菜刀管理7.9.exe File opened (read-only) \??\N: XISE 菜刀管理7.9.exe File opened (read-only) \??\R: XISE 菜刀管理7.9.exe File opened (read-only) \??\X: XISE 菜刀管理7.9.exe File opened (read-only) \??\E: XISE 菜刀管理7.9.exe File opened (read-only) \??\F: XISE 菜刀管理7.9.exe File opened (read-only) \??\G: XISE 菜刀管理7.9.exe File opened (read-only) \??\K: XISE 菜刀管理7.9.exe File opened (read-only) \??\O: XISE 菜刀管理7.9.exe File opened (read-only) \??\T: XISE 菜刀管理7.9.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf XISE 菜刀管理7.9.exe -
Drops file in Program Files directory 9 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe XISE 菜刀管理7.9.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe XISE 菜刀管理7.9.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7Z.EXE XISE 菜刀管理7.9.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7ZFM.EXE XISE 菜刀管理7.9.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7ZG.EXE XISE 菜刀管理7.9.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe XISE 菜刀管理7.9.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe XISE 菜刀管理7.9.exe File opened for modification C:\PROGRAM FILES\7-ZIP\UNINSTALL.EXE XISE 菜刀管理7.9.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe XISE 菜刀管理7.9.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI XISE 菜刀管理7.9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe -
Suspicious behavior: MapViewOfSection 21 IoCs
pid Process 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe 1532 XISE 菜刀管理7.9.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 1532 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 1532 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 1532 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 1532 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 1532 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 1532 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 1532 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 1532 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 1532 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 1532 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 1532 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 1532 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 1532 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 1532 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 1532 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 1532 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 1532 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 1532 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 1532 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 1532 XISE 菜刀管理7.9.exe Token: SeDebugPrivilege 1532 XISE 菜刀管理7.9.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1532 wrote to memory of 1244 1532 XISE 菜刀管理7.9.exe 19 PID 1532 wrote to memory of 1348 1532 XISE 菜刀管理7.9.exe 18 PID 1532 wrote to memory of 1412 1532 XISE 菜刀管理7.9.exe 17 PID 1532 wrote to memory of 368 1532 XISE 菜刀管理7.9.exe 5 PID 1532 wrote to memory of 368 1532 XISE 菜刀管理7.9.exe 5 PID 1532 wrote to memory of 368 1532 XISE 菜刀管理7.9.exe 5 PID 1532 wrote to memory of 368 1532 XISE 菜刀管理7.9.exe 5 PID 1532 wrote to memory of 368 1532 XISE 菜刀管理7.9.exe 5 PID 1532 wrote to memory of 368 1532 XISE 菜刀管理7.9.exe 5 PID 1532 wrote to memory of 368 1532 XISE 菜刀管理7.9.exe 5 PID 1532 wrote to memory of 376 1532 XISE 菜刀管理7.9.exe 4 PID 1532 wrote to memory of 376 1532 XISE 菜刀管理7.9.exe 4 PID 1532 wrote to memory of 376 1532 XISE 菜刀管理7.9.exe 4 PID 1532 wrote to memory of 376 1532 XISE 菜刀管理7.9.exe 4 PID 1532 wrote to memory of 376 1532 XISE 菜刀管理7.9.exe 4 PID 1532 wrote to memory of 376 1532 XISE 菜刀管理7.9.exe 4 PID 1532 wrote to memory of 376 1532 XISE 菜刀管理7.9.exe 4 PID 1532 wrote to memory of 416 1532 XISE 菜刀管理7.9.exe 3 PID 1532 wrote to memory of 416 1532 XISE 菜刀管理7.9.exe 3 PID 1532 wrote to memory of 416 1532 XISE 菜刀管理7.9.exe 3 PID 1532 wrote to memory of 416 1532 XISE 菜刀管理7.9.exe 3 PID 1532 wrote to memory of 416 1532 XISE 菜刀管理7.9.exe 3 PID 1532 wrote to memory of 416 1532 XISE 菜刀管理7.9.exe 3 PID 1532 wrote to memory of 416 1532 XISE 菜刀管理7.9.exe 3 PID 1532 wrote to memory of 460 1532 XISE 菜刀管理7.9.exe 2 PID 1532 wrote to memory of 460 1532 XISE 菜刀管理7.9.exe 2 PID 1532 wrote to memory of 460 1532 XISE 菜刀管理7.9.exe 2 PID 1532 wrote to memory of 460 1532 XISE 菜刀管理7.9.exe 2 PID 1532 wrote to memory of 460 1532 XISE 菜刀管理7.9.exe 2 PID 1532 wrote to memory of 460 1532 XISE 菜刀管理7.9.exe 2 PID 1532 wrote to memory of 460 1532 XISE 菜刀管理7.9.exe 2 PID 1532 wrote to memory of 476 1532 XISE 菜刀管理7.9.exe 1 PID 1532 wrote to memory of 476 1532 XISE 菜刀管理7.9.exe 1 PID 1532 wrote to memory of 476 1532 XISE 菜刀管理7.9.exe 1 PID 1532 wrote to memory of 476 1532 XISE 菜刀管理7.9.exe 1 PID 1532 wrote to memory of 476 1532 XISE 菜刀管理7.9.exe 1 PID 1532 wrote to memory of 476 1532 XISE 菜刀管理7.9.exe 1 PID 1532 wrote to memory of 476 1532 XISE 菜刀管理7.9.exe 1 PID 1532 wrote to memory of 484 1532 XISE 菜刀管理7.9.exe 8 PID 1532 wrote to memory of 484 1532 XISE 菜刀管理7.9.exe 8 PID 1532 wrote to memory of 484 1532 XISE 菜刀管理7.9.exe 8 PID 1532 wrote to memory of 484 1532 XISE 菜刀管理7.9.exe 8 PID 1532 wrote to memory of 484 1532 XISE 菜刀管理7.9.exe 8 PID 1532 wrote to memory of 484 1532 XISE 菜刀管理7.9.exe 8 PID 1532 wrote to memory of 484 1532 XISE 菜刀管理7.9.exe 8 PID 1532 wrote to memory of 576 1532 XISE 菜刀管理7.9.exe 25 PID 1532 wrote to memory of 576 1532 XISE 菜刀管理7.9.exe 25 PID 1532 wrote to memory of 576 1532 XISE 菜刀管理7.9.exe 25 PID 1532 wrote to memory of 576 1532 XISE 菜刀管理7.9.exe 25 PID 1532 wrote to memory of 576 1532 XISE 菜刀管理7.9.exe 25 PID 1532 wrote to memory of 576 1532 XISE 菜刀管理7.9.exe 25 PID 1532 wrote to memory of 576 1532 XISE 菜刀管理7.9.exe 25 PID 1532 wrote to memory of 652 1532 XISE 菜刀管理7.9.exe 24 PID 1532 wrote to memory of 652 1532 XISE 菜刀管理7.9.exe 24 PID 1532 wrote to memory of 652 1532 XISE 菜刀管理7.9.exe 24 PID 1532 wrote to memory of 652 1532 XISE 菜刀管理7.9.exe 24 PID 1532 wrote to memory of 652 1532 XISE 菜刀管理7.9.exe 24 PID 1532 wrote to memory of 652 1532 XISE 菜刀管理7.9.exe 24 PID 1532 wrote to memory of 652 1532 XISE 菜刀管理7.9.exe 24 PID 1532 wrote to memory of 740 1532 XISE 菜刀管理7.9.exe 9 PID 1532 wrote to memory of 740 1532 XISE 菜刀管理7.9.exe 9 PID 1532 wrote to memory of 740 1532 XISE 菜刀管理7.9.exe 9 PID 1532 wrote to memory of 740 1532 XISE 菜刀管理7.9.exe 9 PID 1532 wrote to memory of 740 1532 XISE 菜刀管理7.9.exe 9 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" XISE 菜刀管理7.9.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:476
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:460
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:740
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:868
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R3⤵PID:1660
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:592
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:1584
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:1544
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1244
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:1008
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:296
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:824
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:796
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:652
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:576
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:416
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:376
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:368
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:484
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\xise\XISE 菜刀管理7.9.exe"C:\Users\Admin\AppData\Local\Temp\xise\XISE 菜刀管理7.9.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1532
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1348