Analysis
-
max time kernel
151s -
max time network
66s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 18:48
Static task
static1
Behavioral task
behavioral1
Sample
8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe
Resource
win10v2004-20220901-en
General
-
Target
8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe
-
Size
126KB
-
MD5
35304fe4bee661a3e581427a2e151bec
-
SHA1
31066624f86f34982caf1526cfa6853506c3db33
-
SHA256
8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d
-
SHA512
588d8df6c3e7d98a8eda4746215ea193c84eb96bd7283233a1e50575fa8c0e8b05ef9262fa20ccd9bd64f9154a50053f6635fbf272a253975e62aa3697e2fac8
-
SSDEEP
3072:IHtNQ6ESw2gIoZnJT6+CNYnl2aVAB1Jy7SVtPRtZl:16ESw5dnJ8Ln47u1RtD
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 8 IoCs
Processes:
reg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\UWIWOFZDP4.exe = "C:\\Users\\Admin\\AppData\\Roaming\\UWIWOFZDP4.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\UWIWOFZDP4.exe" 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Active Setup\Installed Components\{3EA3B3B3-21CC-0EF2-3F8B-DAABFCCBB8AC}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\UWIWOFZDP4.exe" 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3EA3B3B3-21CC-0EF2-3F8B-DAABFCCBB8AC} 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3EA3B3B3-21CC-0EF2-3F8B-DAABFCCBB8AC}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\UWIWOFZDP4.exe" 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{3EA3B3B3-21CC-0EF2-3F8B-DAABFCCBB8AC} 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe -
Processes:
resource yara_rule behavioral1/memory/2016-99-0x0000000000340000-0x0000000000360000-memory.dmp upx behavioral1/memory/2016-102-0x0000000000340000-0x0000000000360000-memory.dmp upx behavioral1/memory/2016-106-0x0000000000340000-0x0000000000360000-memory.dmp upx behavioral1/memory/2016-110-0x0000000000340000-0x0000000000360000-memory.dmp upx behavioral1/memory/2016-109-0x0000000000340000-0x0000000000360000-memory.dmp upx behavioral1/memory/2016-108-0x0000000000340000-0x0000000000360000-memory.dmp upx behavioral1/memory/2016-107-0x0000000000340000-0x0000000000360000-memory.dmp upx behavioral1/memory/2016-105-0x0000000000340000-0x0000000000360000-memory.dmp upx behavioral1/memory/2016-104-0x0000000000340000-0x0000000000360000-memory.dmp upx behavioral1/memory/2016-103-0x0000000000340000-0x0000000000360000-memory.dmp upx behavioral1/memory/2016-101-0x0000000000340000-0x0000000000360000-memory.dmp upx behavioral1/memory/2016-100-0x0000000000340000-0x0000000000360000-memory.dmp upx behavioral1/memory/2016-98-0x0000000000340000-0x0000000000360000-memory.dmp upx behavioral1/memory/1804-13046-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/1804-13047-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/1804-13056-0x0000000000400000-0x000000000045D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\UWIWOFZDP4.exe" 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\UWIWOFZDP4.exe" 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exedescription pid process target process PID 2016 set thread context of 1804 2016 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe -
Modifies registry key 1 TTPs 4 IoCs
Processes:
reg.exereg.exereg.exereg.exepid process 1264 reg.exe 1124 reg.exe 316 reg.exe 1580 reg.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exepid process 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exedescription pid process Token: 1 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeCreateTokenPrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeAssignPrimaryTokenPrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeLockMemoryPrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeIncreaseQuotaPrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeMachineAccountPrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeTcbPrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeSecurityPrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeTakeOwnershipPrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeLoadDriverPrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeSystemProfilePrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeSystemtimePrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeProfSingleProcessPrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeIncBasePriorityPrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeCreatePagefilePrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeCreatePermanentPrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeBackupPrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeRestorePrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeShutdownPrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeDebugPrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeAuditPrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeSystemEnvironmentPrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeChangeNotifyPrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeRemoteShutdownPrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeUndockPrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeSyncAgentPrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeEnableDelegationPrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeManageVolumePrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeImpersonatePrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: SeCreateGlobalPrivilege 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: 31 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: 32 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: 33 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: 34 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe Token: 35 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exepid process 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2016 wrote to memory of 1804 2016 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe PID 2016 wrote to memory of 1804 2016 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe PID 2016 wrote to memory of 1804 2016 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe PID 2016 wrote to memory of 1804 2016 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe PID 2016 wrote to memory of 1804 2016 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe PID 2016 wrote to memory of 1804 2016 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe PID 2016 wrote to memory of 1804 2016 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe PID 2016 wrote to memory of 1804 2016 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe PID 1804 wrote to memory of 2036 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe cmd.exe PID 1804 wrote to memory of 2036 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe cmd.exe PID 1804 wrote to memory of 2036 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe cmd.exe PID 1804 wrote to memory of 2036 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe cmd.exe PID 1804 wrote to memory of 1508 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe cmd.exe PID 1804 wrote to memory of 1508 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe cmd.exe PID 1804 wrote to memory of 1508 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe cmd.exe PID 1804 wrote to memory of 1508 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe cmd.exe PID 1804 wrote to memory of 1784 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe cmd.exe PID 1804 wrote to memory of 1784 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe cmd.exe PID 1804 wrote to memory of 1784 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe cmd.exe PID 1804 wrote to memory of 1784 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe cmd.exe PID 1804 wrote to memory of 1948 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe cmd.exe PID 1804 wrote to memory of 1948 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe cmd.exe PID 1804 wrote to memory of 1948 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe cmd.exe PID 1804 wrote to memory of 1948 1804 8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe cmd.exe PID 2036 wrote to memory of 1264 2036 cmd.exe reg.exe PID 2036 wrote to memory of 1264 2036 cmd.exe reg.exe PID 2036 wrote to memory of 1264 2036 cmd.exe reg.exe PID 2036 wrote to memory of 1264 2036 cmd.exe reg.exe PID 1508 wrote to memory of 1124 1508 cmd.exe reg.exe PID 1508 wrote to memory of 1124 1508 cmd.exe reg.exe PID 1508 wrote to memory of 1124 1508 cmd.exe reg.exe PID 1508 wrote to memory of 1124 1508 cmd.exe reg.exe PID 1784 wrote to memory of 316 1784 cmd.exe reg.exe PID 1784 wrote to memory of 316 1784 cmd.exe reg.exe PID 1784 wrote to memory of 316 1784 cmd.exe reg.exe PID 1784 wrote to memory of 316 1784 cmd.exe reg.exe PID 1948 wrote to memory of 1580 1948 cmd.exe reg.exe PID 1948 wrote to memory of 1580 1948 cmd.exe reg.exe PID 1948 wrote to memory of 1580 1948 cmd.exe reg.exe PID 1948 wrote to memory of 1580 1948 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe"C:\Users\Admin\AppData\Local\Temp\8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe"C:\Users\Admin\AppData\Local\Temp\8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe"2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\UWIWOFZDP4.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\UWIWOFZDP4.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\UWIWOFZDP4.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\UWIWOFZDP4.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\8d0105f4a676c04fd4870d71a24e310c00eaa40ccd3c00a88494ac28e819164d.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/316-13054-0x0000000000000000-mapping.dmp
-
memory/1124-13053-0x0000000000000000-mapping.dmp
-
memory/1264-13052-0x0000000000000000-mapping.dmp
-
memory/1508-13049-0x0000000000000000-mapping.dmp
-
memory/1580-13055-0x0000000000000000-mapping.dmp
-
memory/1784-13050-0x0000000000000000-mapping.dmp
-
memory/1804-13038-0x000000000045BD00-mapping.dmp
-
memory/1804-13046-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/1804-13047-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/1804-13056-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/1948-13051-0x0000000000000000-mapping.dmp
-
memory/2016-107-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-98-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-68-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-70-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-75-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-78-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-82-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-85-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-87-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-99-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-102-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-106-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-110-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-109-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-108-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-63-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-105-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-104-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-103-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-101-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-100-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-64-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-86-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-84-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-83-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-80-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-81-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-79-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-77-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-76-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-74-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-73-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-69-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-67-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-66-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-62-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-61-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-56-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-57-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-55-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-54-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2016-65-0x0000000000340000-0x0000000000360000-memory.dmpFilesize
128KB
-
memory/2036-13048-0x0000000000000000-mapping.dmp