Analysis
-
max time kernel
152s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-10-2022 23:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe
Resource
win7-20220812-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe
-
Size
908KB
-
MD5
5034e0f2a1fd479fd77190f6185657e0
-
SHA1
450973616ffb8e3a0c90e76defc374b5ae31ce05
-
SHA256
0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96
-
SHA512
dc9a52dfd878ffaef14b18381a0fb21441e3589d9cedf0070b9593db0a5b485e7f667ab297ab4cd44daeb7e707015e6b0a8b879119f62998d89b6cdb5075c2b8
-
SSDEEP
12288:VhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aboHdGEKRKGI/CxquTOrLf:jRmJkcoQricOIQxiZY1iaboHX/qqusb
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\BlackShades.exe = "C:\\Users\\Admin\\AppData\\Roaming\\BlackShades.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\windows = "C:\\Users\\Admin\\AppData\\Roaming\\BlackShades.exe" 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A5CF59D9-CEAB-DBBA-EDEE-7CBEE8E56C39}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\BlackShades.exe" 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{A5CF59D9-CEAB-DBBA-EDEE-7CBEE8E56C39} 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Active Setup\Installed Components\{A5CF59D9-CEAB-DBBA-EDEE-7CBEE8E56C39}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\BlackShades.exe" 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{A5CF59D9-CEAB-DBBA-EDEE-7CBEE8E56C39} 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe -
resource yara_rule behavioral1/memory/1488-56-0x0000000000400000-0x000000000047D000-memory.dmp upx behavioral1/memory/1488-58-0x0000000000400000-0x000000000047D000-memory.dmp upx behavioral1/memory/1488-59-0x0000000000400000-0x000000000047D000-memory.dmp upx behavioral1/memory/1488-62-0x0000000000400000-0x000000000047D000-memory.dmp upx behavioral1/memory/1488-63-0x0000000000400000-0x000000000047D000-memory.dmp upx behavioral1/memory/1488-76-0x0000000000400000-0x000000000047D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\windows = "C:\\Users\\Admin\\AppData\\Roaming\\BlackShades.exe" 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\windows = "C:\\Users\\Admin\\AppData\\Roaming\\BlackShades.exe" 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1492 set thread context of 1488 1492 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 28 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 4 IoCs
pid Process 888 reg.exe 564 reg.exe 1948 reg.exe 2036 reg.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeCreateTokenPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeAssignPrimaryTokenPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeLockMemoryPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeIncreaseQuotaPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeMachineAccountPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeTcbPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeSecurityPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeTakeOwnershipPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeLoadDriverPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeSystemProfilePrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeSystemtimePrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeProfSingleProcessPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeIncBasePriorityPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeCreatePagefilePrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeCreatePermanentPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeBackupPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeRestorePrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeShutdownPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeDebugPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeAuditPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeSystemEnvironmentPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeChangeNotifyPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeRemoteShutdownPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeUndockPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeSyncAgentPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeEnableDelegationPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeManageVolumePrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeImpersonatePrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeCreateGlobalPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: 31 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: 32 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: 33 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: 34 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: 35 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe Token: SeDebugPrivilege 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1492 wrote to memory of 1488 1492 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 28 PID 1492 wrote to memory of 1488 1492 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 28 PID 1492 wrote to memory of 1488 1492 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 28 PID 1492 wrote to memory of 1488 1492 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 28 PID 1492 wrote to memory of 1488 1492 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 28 PID 1492 wrote to memory of 1488 1492 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 28 PID 1492 wrote to memory of 1488 1492 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 28 PID 1492 wrote to memory of 1488 1492 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 28 PID 1488 wrote to memory of 1704 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 29 PID 1488 wrote to memory of 1704 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 29 PID 1488 wrote to memory of 1704 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 29 PID 1488 wrote to memory of 1704 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 29 PID 1488 wrote to memory of 1956 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 33 PID 1488 wrote to memory of 1956 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 33 PID 1488 wrote to memory of 1956 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 33 PID 1488 wrote to memory of 1956 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 33 PID 1488 wrote to memory of 1720 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 31 PID 1488 wrote to memory of 1720 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 31 PID 1488 wrote to memory of 1720 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 31 PID 1488 wrote to memory of 1720 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 31 PID 1488 wrote to memory of 1092 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 35 PID 1488 wrote to memory of 1092 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 35 PID 1488 wrote to memory of 1092 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 35 PID 1488 wrote to memory of 1092 1488 0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe 35 PID 1704 wrote to memory of 888 1704 cmd.exe 36 PID 1704 wrote to memory of 888 1704 cmd.exe 36 PID 1704 wrote to memory of 888 1704 cmd.exe 36 PID 1704 wrote to memory of 888 1704 cmd.exe 36 PID 1956 wrote to memory of 564 1956 cmd.exe 38 PID 1956 wrote to memory of 564 1956 cmd.exe 38 PID 1956 wrote to memory of 564 1956 cmd.exe 38 PID 1956 wrote to memory of 564 1956 cmd.exe 38 PID 1720 wrote to memory of 1948 1720 cmd.exe 39 PID 1720 wrote to memory of 1948 1720 cmd.exe 39 PID 1720 wrote to memory of 1948 1720 cmd.exe 39 PID 1720 wrote to memory of 1948 1720 cmd.exe 39 PID 1092 wrote to memory of 2036 1092 cmd.exe 40 PID 1092 wrote to memory of 2036 1092 cmd.exe 40 PID 1092 wrote to memory of 2036 1092 cmd.exe 40 PID 1092 wrote to memory of 2036 1092 cmd.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe"C:\Users\Admin\AppData\Local\Temp\0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe"C:\Users\Admin\AppData\Local\Temp\0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe"2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:888
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1948
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\0aaaa0cd21310532c43f226e45f5590a7b1581c3376f2f654afe2d9681b4ed96.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:564
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\BlackShades.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\BlackShades.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\BlackShades.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\BlackShades.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:2036
-
-
-