Analysis
-
max time kernel
152s -
max time network
172s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 06:03
Static task
static1
Behavioral task
behavioral1
Sample
85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe
Resource
win10v2004-20221111-en
General
-
Target
85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe
-
Size
408KB
-
MD5
d44012f6a2b41e815ee4ed8022c05cc7
-
SHA1
56cdad1716f5ae4855cd80e4e13566d37488dc11
-
SHA256
85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f
-
SHA512
f331f9abf60c581936b6382606cd4d2f0cd56fd74eb125111911f9df315a5cd3793ae4ea17f73f9f0026bb090b46715bc439402c0ec84201cbf172b22aad81ae
-
SSDEEP
12288:R7M3m1Fo3ZMtTErzAwkFtCg3RTEwLxgKGsPTK2xu8ol6sZzyUiCcvy40cShj5cIf:q3AYZIwuUi1vyvcbG
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 8 IoCs
Processes:
reg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
Processes:
resource yara_rule behavioral1/memory/636-69-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/636-71-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/636-72-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/636-75-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/636-76-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/636-80-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/636-83-0x0000000000400000-0x0000000000473000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exedescription ioc process File opened for modification \??\PhysicalDrive0 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exedescription pid process target process PID 960 set thread context of 576 960 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 576 set thread context of 636 576 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe -
Modifies registry key 1 TTPs 4 IoCs
Processes:
reg.exereg.exereg.exereg.exepid process 1064 reg.exe 1544 reg.exe 432 reg.exe 1592 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exedescription pid process Token: 1 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeCreateTokenPrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeAssignPrimaryTokenPrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeLockMemoryPrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeIncreaseQuotaPrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeMachineAccountPrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeTcbPrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeSecurityPrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeTakeOwnershipPrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeLoadDriverPrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeSystemProfilePrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeSystemtimePrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeProfSingleProcessPrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeIncBasePriorityPrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeCreatePagefilePrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeCreatePermanentPrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeBackupPrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeRestorePrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeShutdownPrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeDebugPrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeAuditPrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeSystemEnvironmentPrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeChangeNotifyPrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeRemoteShutdownPrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeUndockPrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeSyncAgentPrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeEnableDelegationPrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeManageVolumePrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeImpersonatePrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeCreateGlobalPrivilege 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: 31 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: 32 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: 33 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: 34 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: 35 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exepid process 960 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 576 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.execmd.execmd.execmd.execmd.exedescription pid process target process PID 960 wrote to memory of 576 960 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 960 wrote to memory of 576 960 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 960 wrote to memory of 576 960 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 960 wrote to memory of 576 960 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 960 wrote to memory of 576 960 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 960 wrote to memory of 576 960 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 960 wrote to memory of 576 960 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 960 wrote to memory of 576 960 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 960 wrote to memory of 576 960 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 576 wrote to memory of 636 576 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 576 wrote to memory of 636 576 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 576 wrote to memory of 636 576 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 576 wrote to memory of 636 576 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 576 wrote to memory of 636 576 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 576 wrote to memory of 636 576 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 576 wrote to memory of 636 576 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 576 wrote to memory of 636 576 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 636 wrote to memory of 1032 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 636 wrote to memory of 1032 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 636 wrote to memory of 1032 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 636 wrote to memory of 1032 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 636 wrote to memory of 1640 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 636 wrote to memory of 1640 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 636 wrote to memory of 1640 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 636 wrote to memory of 1640 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 636 wrote to memory of 1588 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 636 wrote to memory of 1588 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 636 wrote to memory of 1588 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 636 wrote to memory of 1588 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 636 wrote to memory of 1076 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 636 wrote to memory of 1076 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 636 wrote to memory of 1076 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 636 wrote to memory of 1076 636 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 1032 wrote to memory of 1544 1032 cmd.exe reg.exe PID 1032 wrote to memory of 1544 1032 cmd.exe reg.exe PID 1032 wrote to memory of 1544 1032 cmd.exe reg.exe PID 1032 wrote to memory of 1544 1032 cmd.exe reg.exe PID 1640 wrote to memory of 432 1640 cmd.exe reg.exe PID 1640 wrote to memory of 432 1640 cmd.exe reg.exe PID 1640 wrote to memory of 432 1640 cmd.exe reg.exe PID 1640 wrote to memory of 432 1640 cmd.exe reg.exe PID 1076 wrote to memory of 1064 1076 cmd.exe reg.exe PID 1076 wrote to memory of 1064 1076 cmd.exe reg.exe PID 1076 wrote to memory of 1064 1076 cmd.exe reg.exe PID 1076 wrote to memory of 1064 1076 cmd.exe reg.exe PID 1588 wrote to memory of 1592 1588 cmd.exe reg.exe PID 1588 wrote to memory of 1592 1588 cmd.exe reg.exe PID 1588 wrote to memory of 1592 1588 cmd.exe reg.exe PID 1588 wrote to memory of 1592 1588 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe"C:\Users\Admin\AppData\Local\Temp\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe"C:\Users\Admin\AppData\Local\Temp\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe"2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe"C:\Users\Admin\AppData\Local\Temp\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe:*:Enabled:Windows Messanger" /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/432-89-0x0000000000000000-mapping.dmp
-
memory/576-56-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/576-57-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/576-59-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/576-62-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/576-63-0x0000000000401844-mapping.dmp
-
memory/576-67-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/576-81-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/636-76-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/636-68-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/636-72-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/636-75-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/636-71-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/636-80-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/636-69-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/636-82-0x0000000075F21000-0x0000000075F23000-memory.dmpFilesize
8KB
-
memory/636-83-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/636-73-0x00000000004710E0-mapping.dmp
-
memory/1032-84-0x0000000000000000-mapping.dmp
-
memory/1064-90-0x0000000000000000-mapping.dmp
-
memory/1076-87-0x0000000000000000-mapping.dmp
-
memory/1544-88-0x0000000000000000-mapping.dmp
-
memory/1588-86-0x0000000000000000-mapping.dmp
-
memory/1592-91-0x0000000000000000-mapping.dmp
-
memory/1640-85-0x0000000000000000-mapping.dmp