Analysis
-
max time kernel
169s -
max time network
203s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 06:03
Static task
static1
Behavioral task
behavioral1
Sample
85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe
Resource
win10v2004-20221111-en
General
-
Target
85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe
-
Size
408KB
-
MD5
d44012f6a2b41e815ee4ed8022c05cc7
-
SHA1
56cdad1716f5ae4855cd80e4e13566d37488dc11
-
SHA256
85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f
-
SHA512
f331f9abf60c581936b6382606cd4d2f0cd56fd74eb125111911f9df315a5cd3793ae4ea17f73f9f0026bb090b46715bc439402c0ec84201cbf172b22aad81ae
-
SSDEEP
12288:R7M3m1Fo3ZMtTErzAwkFtCg3RTEwLxgKGsPTK2xu8ol6sZzyUiCcvy40cShj5cIf:q3AYZIwuUi1vyvcbG
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 10 IoCs
Processes:
reg.exereg.exereg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
Processes:
resource yara_rule behavioral2/memory/4556-140-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/4556-142-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/4556-143-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/4556-155-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/4556-157-0x0000000000400000-0x0000000000473000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exedescription ioc process File opened for modification \??\PhysicalDrive0 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exedescription pid process target process PID 1328 set thread context of 3452 1328 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 3452 set thread context of 4556 3452 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe -
Modifies registry key 1 TTPs 4 IoCs
Processes:
reg.exereg.exereg.exereg.exepid process 3472 reg.exe 4852 reg.exe 4132 reg.exe 1860 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exedescription pid process Token: 1 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeCreateTokenPrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeAssignPrimaryTokenPrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeLockMemoryPrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeIncreaseQuotaPrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeMachineAccountPrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeTcbPrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeSecurityPrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeTakeOwnershipPrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeLoadDriverPrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeSystemProfilePrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeSystemtimePrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeProfSingleProcessPrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeIncBasePriorityPrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeCreatePagefilePrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeCreatePermanentPrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeBackupPrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeRestorePrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeShutdownPrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeDebugPrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeAuditPrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeSystemEnvironmentPrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeChangeNotifyPrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeRemoteShutdownPrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeUndockPrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeSyncAgentPrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeEnableDelegationPrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeManageVolumePrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeImpersonatePrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: SeCreateGlobalPrivilege 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: 31 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: 32 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: 33 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: 34 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe Token: 35 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exepid process 1328 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 3452 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1328 wrote to memory of 3452 1328 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 1328 wrote to memory of 3452 1328 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 1328 wrote to memory of 3452 1328 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 1328 wrote to memory of 3452 1328 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 1328 wrote to memory of 3452 1328 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 1328 wrote to memory of 3452 1328 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 1328 wrote to memory of 3452 1328 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 1328 wrote to memory of 3452 1328 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 3452 wrote to memory of 4556 3452 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 3452 wrote to memory of 4556 3452 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 3452 wrote to memory of 4556 3452 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 3452 wrote to memory of 4556 3452 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 3452 wrote to memory of 4556 3452 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 3452 wrote to memory of 4556 3452 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 3452 wrote to memory of 4556 3452 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 3452 wrote to memory of 4556 3452 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe PID 4556 wrote to memory of 3552 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 4556 wrote to memory of 3552 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 4556 wrote to memory of 3552 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 4556 wrote to memory of 308 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 4556 wrote to memory of 308 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 4556 wrote to memory of 308 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 4556 wrote to memory of 1692 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 4556 wrote to memory of 1692 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 4556 wrote to memory of 1692 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 4556 wrote to memory of 1880 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 4556 wrote to memory of 1880 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 4556 wrote to memory of 1880 4556 85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe cmd.exe PID 308 wrote to memory of 3472 308 cmd.exe reg.exe PID 308 wrote to memory of 3472 308 cmd.exe reg.exe PID 308 wrote to memory of 3472 308 cmd.exe reg.exe PID 1692 wrote to memory of 4132 1692 cmd.exe reg.exe PID 1692 wrote to memory of 4132 1692 cmd.exe reg.exe PID 1692 wrote to memory of 4132 1692 cmd.exe reg.exe PID 1880 wrote to memory of 4852 1880 cmd.exe reg.exe PID 1880 wrote to memory of 4852 1880 cmd.exe reg.exe PID 1880 wrote to memory of 4852 1880 cmd.exe reg.exe PID 3552 wrote to memory of 1860 3552 cmd.exe reg.exe PID 3552 wrote to memory of 1860 3552 cmd.exe reg.exe PID 3552 wrote to memory of 1860 3552 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe"C:\Users\Admin\AppData\Local\Temp\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe"C:\Users\Admin\AppData\Local\Temp\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe"2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe"C:\Users\Admin\AppData\Local\Temp\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe:*:Enabled:Windows Messanger" /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\85e8304712a15bdd776c25cdf30672e7be37b3a96ce3e7b8f9c8df104b81804f.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/308-149-0x0000000000000000-mapping.dmp
-
memory/1692-150-0x0000000000000000-mapping.dmp
-
memory/1860-156-0x0000000000000000-mapping.dmp
-
memory/1880-151-0x0000000000000000-mapping.dmp
-
memory/3452-135-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/3452-134-0x0000000000000000-mapping.dmp
-
memory/3452-146-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/3472-152-0x0000000000000000-mapping.dmp
-
memory/3552-148-0x0000000000000000-mapping.dmp
-
memory/4132-153-0x0000000000000000-mapping.dmp
-
memory/4556-142-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/4556-143-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/4556-140-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/4556-155-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/4556-139-0x0000000000000000-mapping.dmp
-
memory/4556-157-0x0000000000400000-0x0000000000473000-memory.dmpFilesize
460KB
-
memory/4852-154-0x0000000000000000-mapping.dmp