Analysis
-
max time kernel
162s -
max time network
192s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 15:33
Static task
static1
Behavioral task
behavioral1
Sample
bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe
Resource
win10v2004-20221111-en
General
-
Target
bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe
-
Size
500KB
-
MD5
683ba16fc97a52c41c0c407a6b379fee
-
SHA1
797a88f51a8fc6b3f4fc1ee0a0fa1d8f691f088f
-
SHA256
bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b
-
SHA512
02686f40f85aac6efc1489d2e181a213dee2bbbb76a574f75c796e5a35b26f6b805bed3c91208c73327a0409866843f06cf6868359553273b779ad5974e2541d
-
SSDEEP
12288:XKBLWoD1fKBLWoD1anB9+LEh/TyiAgTwLTtkeVcEE9zSwZfTyQcj4Ihz6lvdKw3J:XKFD1fKFD1anB9+LEh/TyiAgTwLTtke8
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 8 IoCs
Processes:
reg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Microsoft\Audiolog.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Audiolog.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Audiolog = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Audiolog.exe" bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe -
Processes:
resource yara_rule behavioral1/memory/1256-57-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/1256-59-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/1256-60-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/1256-63-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/1256-64-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/1256-69-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/1256-78-0x0000000000400000-0x000000000047B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Audiolog = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Audiolog.exe" bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Audiolog = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Audiolog.exe" bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exedescription pid process target process PID 1648 set thread context of 1256 1648 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe -
Modifies registry key 1 TTPs 4 IoCs
Processes:
reg.exereg.exereg.exereg.exepid process 1884 reg.exe 916 reg.exe 452 reg.exe 1116 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
Processes:
bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exedescription pid process Token: 1 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeCreateTokenPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeAssignPrimaryTokenPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeLockMemoryPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeIncreaseQuotaPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeMachineAccountPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeTcbPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeSecurityPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeTakeOwnershipPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeLoadDriverPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeSystemProfilePrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeSystemtimePrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeProfSingleProcessPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeIncBasePriorityPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeCreatePagefilePrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeCreatePermanentPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeBackupPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeRestorePrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeShutdownPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeDebugPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeAuditPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeSystemEnvironmentPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeChangeNotifyPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeRemoteShutdownPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeUndockPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeSyncAgentPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeEnableDelegationPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeManageVolumePrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeImpersonatePrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeCreateGlobalPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: 31 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: 32 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: 33 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: 34 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: 35 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe Token: SeDebugPrivilege 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exebcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exepid process 1648 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exebcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1648 wrote to memory of 1256 1648 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe PID 1648 wrote to memory of 1256 1648 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe PID 1648 wrote to memory of 1256 1648 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe PID 1648 wrote to memory of 1256 1648 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe PID 1648 wrote to memory of 1256 1648 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe PID 1648 wrote to memory of 1256 1648 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe PID 1648 wrote to memory of 1256 1648 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe PID 1648 wrote to memory of 1256 1648 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe PID 1256 wrote to memory of 268 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe cmd.exe PID 1256 wrote to memory of 268 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe cmd.exe PID 1256 wrote to memory of 268 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe cmd.exe PID 1256 wrote to memory of 268 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe cmd.exe PID 1256 wrote to memory of 468 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe cmd.exe PID 1256 wrote to memory of 468 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe cmd.exe PID 1256 wrote to memory of 468 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe cmd.exe PID 1256 wrote to memory of 468 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe cmd.exe PID 1256 wrote to memory of 1348 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe cmd.exe PID 1256 wrote to memory of 1348 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe cmd.exe PID 1256 wrote to memory of 1348 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe cmd.exe PID 1256 wrote to memory of 1348 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe cmd.exe PID 1256 wrote to memory of 1640 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe cmd.exe PID 1256 wrote to memory of 1640 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe cmd.exe PID 1256 wrote to memory of 1640 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe cmd.exe PID 1256 wrote to memory of 1640 1256 bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe cmd.exe PID 1640 wrote to memory of 1116 1640 cmd.exe reg.exe PID 1640 wrote to memory of 1116 1640 cmd.exe reg.exe PID 1640 wrote to memory of 1116 1640 cmd.exe reg.exe PID 1640 wrote to memory of 1116 1640 cmd.exe reg.exe PID 268 wrote to memory of 452 268 cmd.exe reg.exe PID 268 wrote to memory of 452 268 cmd.exe reg.exe PID 268 wrote to memory of 452 268 cmd.exe reg.exe PID 268 wrote to memory of 452 268 cmd.exe reg.exe PID 468 wrote to memory of 916 468 cmd.exe reg.exe PID 468 wrote to memory of 916 468 cmd.exe reg.exe PID 468 wrote to memory of 916 468 cmd.exe reg.exe PID 468 wrote to memory of 916 468 cmd.exe reg.exe PID 1348 wrote to memory of 1884 1348 cmd.exe reg.exe PID 1348 wrote to memory of 1884 1348 cmd.exe reg.exe PID 1348 wrote to memory of 1884 1348 cmd.exe reg.exe PID 1348 wrote to memory of 1884 1348 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe"C:\Users\Admin\AppData\Local\Temp\bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe"C:\Users\Admin\AppData\Local\Temp\bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\bcb72ffc7af798ea42e0ef8dc9617b736433a5667f9e88f96cfea5b24b796b0b.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Microsoft\Audiolog.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Audiolog.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Microsoft\Audiolog.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Audiolog.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/268-70-0x0000000000000000-mapping.dmp
-
memory/452-75-0x0000000000000000-mapping.dmp
-
memory/468-71-0x0000000000000000-mapping.dmp
-
memory/916-76-0x0000000000000000-mapping.dmp
-
memory/1116-74-0x0000000000000000-mapping.dmp
-
memory/1256-69-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1256-64-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1256-68-0x0000000075BE1000-0x0000000075BE3000-memory.dmpFilesize
8KB
-
memory/1256-56-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1256-63-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1256-61-0x0000000000479280-mapping.dmp
-
memory/1256-60-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1256-59-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1256-57-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1256-78-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1348-72-0x0000000000000000-mapping.dmp
-
memory/1640-73-0x0000000000000000-mapping.dmp
-
memory/1884-77-0x0000000000000000-mapping.dmp