Analysis
-
max time kernel
145s -
max time network
173s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 05:04
Behavioral task
behavioral1
Sample
ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe
Resource
win7-20221111-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe
-
Size
546KB
-
MD5
55c839a0f4d8df8143af4008311fb6f1
-
SHA1
ab73754ed5b86ac1579a552a349d839862d0b250
-
SHA256
ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0
-
SHA512
71ad9e18216f7fb82e00dc90fc89737d5f49527589c0dc9aac4e122145a6097875c312025ae6902ba8e43c5592a012053c940175f10bbee179e453770720b91b
-
SSDEEP
12288:eWukz+Lu35Pt/GAGNNxmlX8vVrT2/BO6AZ8Fbqk:eozWu355vGPEB8vVrToLjFbqk
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\update.exe = "C:\\Users\\Admin\\AppData\\Roaming\\update.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Update = "C:\\Users\\Admin\\AppData\\Roaming\\update.exe" ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DBADFFDD-4147-B01C-CEEE-9E1C938CB030} ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DBADFFDD-4147-B01C-CEEE-9E1C938CB030}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\update.exe" ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{DBADFFDD-4147-B01C-CEEE-9E1C938CB030} ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Active Setup\Installed Components\{DBADFFDD-4147-B01C-CEEE-9E1C938CB030}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\update.exe" ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe -
resource yara_rule behavioral1/memory/296-56-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/296-58-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/296-59-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/1276-61-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/296-63-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/296-64-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/296-76-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/296-77-0x0000000000400000-0x000000000045A000-memory.dmp upx -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "C:\\Users\\Admin\\AppData\\Roaming\\update.exe" ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Explorer = "C:\\Windows\\Explorer32DLL.exe" ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Explorer = "C:\\Windows\\Explorer32DLL.exe" ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Update = "C:\\Users\\Admin\\AppData\\Roaming\\update.exe" ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1276-61-0x0000000000400000-0x00000000004B9000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1276 set thread context of 296 1276 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 28 -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Explorer32DLL.exe ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe File created C:\Windows\Explorer32DLL.exe ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 4 IoCs
pid Process 1496 reg.exe 1532 reg.exe 1788 reg.exe 1116 reg.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeCreateTokenPrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeAssignPrimaryTokenPrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeLockMemoryPrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeIncreaseQuotaPrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeMachineAccountPrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeTcbPrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeSecurityPrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeTakeOwnershipPrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeLoadDriverPrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeSystemProfilePrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeSystemtimePrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeProfSingleProcessPrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeIncBasePriorityPrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeCreatePagefilePrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeCreatePermanentPrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeBackupPrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeRestorePrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeShutdownPrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeDebugPrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeAuditPrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeSystemEnvironmentPrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeChangeNotifyPrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeRemoteShutdownPrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeUndockPrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeSyncAgentPrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeEnableDelegationPrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeManageVolumePrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeImpersonatePrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: SeCreateGlobalPrivilege 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: 31 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: 32 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: 33 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: 34 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe Token: 35 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 1276 wrote to memory of 296 1276 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 28 PID 1276 wrote to memory of 296 1276 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 28 PID 1276 wrote to memory of 296 1276 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 28 PID 1276 wrote to memory of 296 1276 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 28 PID 1276 wrote to memory of 296 1276 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 28 PID 1276 wrote to memory of 296 1276 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 28 PID 1276 wrote to memory of 296 1276 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 28 PID 296 wrote to memory of 2028 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 29 PID 296 wrote to memory of 2028 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 29 PID 296 wrote to memory of 2028 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 29 PID 296 wrote to memory of 2028 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 29 PID 296 wrote to memory of 2016 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 31 PID 296 wrote to memory of 2016 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 31 PID 296 wrote to memory of 2016 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 31 PID 296 wrote to memory of 2016 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 31 PID 296 wrote to memory of 1908 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 32 PID 296 wrote to memory of 1908 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 32 PID 296 wrote to memory of 1908 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 32 PID 296 wrote to memory of 1908 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 32 PID 296 wrote to memory of 1700 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 34 PID 296 wrote to memory of 1700 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 34 PID 296 wrote to memory of 1700 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 34 PID 296 wrote to memory of 1700 296 ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe 34 PID 2028 wrote to memory of 1116 2028 cmd.exe 40 PID 2028 wrote to memory of 1116 2028 cmd.exe 40 PID 2028 wrote to memory of 1116 2028 cmd.exe 40 PID 2028 wrote to memory of 1116 2028 cmd.exe 40 PID 1908 wrote to memory of 1532 1908 cmd.exe 38 PID 1908 wrote to memory of 1532 1908 cmd.exe 38 PID 1908 wrote to memory of 1532 1908 cmd.exe 38 PID 1908 wrote to memory of 1532 1908 cmd.exe 38 PID 2016 wrote to memory of 1788 2016 cmd.exe 39 PID 2016 wrote to memory of 1788 2016 cmd.exe 39 PID 2016 wrote to memory of 1788 2016 cmd.exe 39 PID 2016 wrote to memory of 1788 2016 cmd.exe 39 PID 1700 wrote to memory of 1496 1700 cmd.exe 37 PID 1700 wrote to memory of 1496 1700 cmd.exe 37 PID 1700 wrote to memory of 1496 1700 cmd.exe 37 PID 1700 wrote to memory of 1496 1700 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe"C:\Users\Admin\AppData\Local\Temp\ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe"C:\Users\Admin\AppData\Local\Temp\ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe"2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1116
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ab850bf1539bb95bf30effa3d14290fd0b3dc8de9bd1e6b761029807ed3dcba0.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1788
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1532
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\update.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\update.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\update.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\update.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1496
-
-
-