Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 02:13
Behavioral task
behavioral1
Sample
14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe
Resource
win7-20220901-en
General
-
Target
14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe
-
Size
2.0MB
-
MD5
5fb342fdbf39fabbdfe0c56ab4b46ea7
-
SHA1
8b23f6343442a0e5c23ee81d5351880f04111033
-
SHA256
14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9
-
SHA512
71a7c7077e67eb867d576b3481737383a42c4e499d33b4914c459391f4e897e2e95cd868f9484b21526a5f5d80a57553ed7243e1b0b276008c45c8f1bbc8fea6
-
SSDEEP
49152:1vouOPLi0mkdlj7t8HHZ41RyDdLpUR5TW6OneqYBAf:hEW099BOHe1RCdLS5oeqiAf
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\upadter.exe = "C:\\Users\\Admin\\AppData\\Roaming\\upadter.exe:*:Enabled:Windows Messanger" reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\windows = "C:\\Users\\Admin\\AppData\\Roaming\\upadter.exe" 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BE0DAC4D-EBEA-D8C7-0EEC-EEEE983BEACF} 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BE0DAC4D-EBEA-D8C7-0EEC-EEEE983BEACF}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\upadter.exe" 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{BE0DAC4D-EBEA-D8C7-0EEC-EEEE983BEACF} 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Active Setup\Installed Components\{BE0DAC4D-EBEA-D8C7-0EEC-EEEE983BEACF}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\upadter.exe" 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe -
resource yara_rule behavioral1/memory/596-60-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/596-62-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/596-63-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/596-66-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/596-67-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/596-82-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/596-83-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/596-86-0x0000000000400000-0x0000000000473000-memory.dmp upx -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Wine 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe -
resource yara_rule behavioral1/memory/1204-55-0x0000000000400000-0x00000000007B2000-memory.dmp themida behavioral1/memory/1204-80-0x0000000000400000-0x00000000007B2000-memory.dmp themida behavioral1/memory/1204-84-0x0000000000400000-0x00000000007B2000-memory.dmp themida behavioral1/memory/1204-85-0x0000000000400000-0x00000000007B2000-memory.dmp themida -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\windows = "C:\\Users\\Admin\\AppData\\Roaming\\upadter.exe" 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\windows = "C:\\Users\\Admin\\AppData\\Roaming\\upadter.exe" 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1204 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1204 set thread context of 596 1204 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 27 -
Modifies registry key 1 TTPs 4 IoCs
pid Process 932 reg.exe 2020 reg.exe 772 reg.exe 1256 reg.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1204 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeCreateTokenPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeAssignPrimaryTokenPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeLockMemoryPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeIncreaseQuotaPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeMachineAccountPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeTcbPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeSecurityPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeTakeOwnershipPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeLoadDriverPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeSystemProfilePrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeSystemtimePrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeProfSingleProcessPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeIncBasePriorityPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeCreatePagefilePrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeCreatePermanentPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeBackupPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeRestorePrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeShutdownPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeDebugPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeAuditPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeSystemEnvironmentPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeChangeNotifyPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeRemoteShutdownPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeUndockPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeSyncAgentPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeEnableDelegationPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeManageVolumePrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeImpersonatePrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeCreateGlobalPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: 31 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: 32 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: 33 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: 34 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: 35 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe Token: SeDebugPrivilege 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1204 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1204 wrote to memory of 596 1204 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 27 PID 1204 wrote to memory of 596 1204 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 27 PID 1204 wrote to memory of 596 1204 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 27 PID 1204 wrote to memory of 596 1204 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 27 PID 1204 wrote to memory of 596 1204 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 27 PID 1204 wrote to memory of 596 1204 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 27 PID 1204 wrote to memory of 596 1204 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 27 PID 1204 wrote to memory of 596 1204 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 27 PID 596 wrote to memory of 1780 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 28 PID 596 wrote to memory of 1780 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 28 PID 596 wrote to memory of 1780 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 28 PID 596 wrote to memory of 1780 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 28 PID 596 wrote to memory of 1336 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 29 PID 596 wrote to memory of 1336 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 29 PID 596 wrote to memory of 1336 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 29 PID 596 wrote to memory of 1336 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 29 PID 596 wrote to memory of 1672 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 32 PID 596 wrote to memory of 1672 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 32 PID 596 wrote to memory of 1672 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 32 PID 596 wrote to memory of 1672 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 32 PID 596 wrote to memory of 1848 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 35 PID 596 wrote to memory of 1848 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 35 PID 596 wrote to memory of 1848 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 35 PID 596 wrote to memory of 1848 596 14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe 35 PID 1780 wrote to memory of 1256 1780 cmd.exe 33 PID 1780 wrote to memory of 1256 1780 cmd.exe 33 PID 1780 wrote to memory of 1256 1780 cmd.exe 33 PID 1780 wrote to memory of 1256 1780 cmd.exe 33 PID 1672 wrote to memory of 932 1672 cmd.exe 37 PID 1672 wrote to memory of 932 1672 cmd.exe 37 PID 1672 wrote to memory of 932 1672 cmd.exe 37 PID 1672 wrote to memory of 932 1672 cmd.exe 37 PID 1336 wrote to memory of 2020 1336 cmd.exe 38 PID 1336 wrote to memory of 2020 1336 cmd.exe 38 PID 1336 wrote to memory of 2020 1336 cmd.exe 38 PID 1336 wrote to memory of 2020 1336 cmd.exe 38 PID 1848 wrote to memory of 772 1848 cmd.exe 39 PID 1848 wrote to memory of 772 1848 cmd.exe 39 PID 1848 wrote to memory of 772 1848 cmd.exe 39 PID 1848 wrote to memory of 772 1848 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe"C:\Users\Admin\AppData\Local\Temp\14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe"1⤵
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1256
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:2020
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:932
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\upadter.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\upadter.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\upadter.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\upadter.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:772
-
-
-