Analysis
-
max time kernel
150s -
max time network
189s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 15:05
Static task
static1
Behavioral task
behavioral1
Sample
6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe
Resource
win7-20221111-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe
-
Size
1.1MB
-
MD5
4aaba39ea7385b77d10258502e99a6c4
-
SHA1
26e1f02da82c82ac33ef4fc4c804c45d0c32ab55
-
SHA256
6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1
-
SHA512
ae311678a0db228728114b7cd7fad4372e701dd759a2f3e0c33b095583da616bd4748513113c137b5c99e0287669a9f6d4bdb6d3e9a0a5d0a96059bde96ed86a
-
SSDEEP
24576:zAHGv5Slb/otvtOQDNMpunxB+dU8RXti/2Lni3YCvBIGDmUnkbWVtZ:zAmhSlEfOQpMgxBGVRXtiqgT+O3
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Explorer\explorer.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Explorer\\explorer.exe:*:Enabled:Windows Messanger" reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Explorer = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Explorer\\explorer.exe" 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C9CD4989-B7EC-238C-8EFC-0EDBFB0C767F} 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C9CD4989-B7EC-238C-8EFC-0EDBFB0C767F}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Explorer\\explorer.exe" 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9CD4989-B7EC-238C-8EFC-0EDBFB0C767F} 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Active Setup\Installed Components\{C9CD4989-B7EC-238C-8EFC-0EDBFB0C767F}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Explorer\\explorer.exe" 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Explorer = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Explorer\\explorer.exe" 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Explorer = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Explorer\\explorer.exe" 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2016 set thread context of 2008 2016 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 27 PID 2008 set thread context of 904 2008 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 28 -
Modifies registry key 1 TTPs 4 IoCs
pid Process 1388 reg.exe 604 reg.exe 924 reg.exe 1560 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeCreateTokenPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeAssignPrimaryTokenPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeLockMemoryPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeIncreaseQuotaPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeMachineAccountPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeTcbPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeSecurityPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeTakeOwnershipPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeLoadDriverPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeSystemProfilePrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeSystemtimePrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeProfSingleProcessPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeIncBasePriorityPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeCreatePagefilePrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeCreatePermanentPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeBackupPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeRestorePrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeShutdownPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeDebugPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeAuditPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeSystemEnvironmentPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeChangeNotifyPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeRemoteShutdownPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeUndockPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeSyncAgentPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeEnableDelegationPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeManageVolumePrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeImpersonatePrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeCreateGlobalPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: 31 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: 32 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: 33 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: 34 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: 35 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe Token: SeDebugPrivilege 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 2016 wrote to memory of 2008 2016 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 27 PID 2016 wrote to memory of 2008 2016 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 27 PID 2016 wrote to memory of 2008 2016 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 27 PID 2016 wrote to memory of 2008 2016 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 27 PID 2016 wrote to memory of 2008 2016 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 27 PID 2016 wrote to memory of 2008 2016 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 27 PID 2016 wrote to memory of 2008 2016 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 27 PID 2016 wrote to memory of 2008 2016 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 27 PID 2016 wrote to memory of 2008 2016 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 27 PID 2016 wrote to memory of 2008 2016 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 27 PID 2016 wrote to memory of 2008 2016 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 27 PID 2008 wrote to memory of 904 2008 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 28 PID 2008 wrote to memory of 904 2008 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 28 PID 2008 wrote to memory of 904 2008 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 28 PID 2008 wrote to memory of 904 2008 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 28 PID 2008 wrote to memory of 904 2008 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 28 PID 2008 wrote to memory of 904 2008 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 28 PID 2008 wrote to memory of 904 2008 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 28 PID 2008 wrote to memory of 904 2008 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 28 PID 904 wrote to memory of 1396 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 29 PID 904 wrote to memory of 1396 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 29 PID 904 wrote to memory of 1396 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 29 PID 904 wrote to memory of 1396 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 29 PID 904 wrote to memory of 1076 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 31 PID 904 wrote to memory of 1076 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 31 PID 904 wrote to memory of 1076 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 31 PID 904 wrote to memory of 1076 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 31 PID 904 wrote to memory of 328 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 32 PID 904 wrote to memory of 328 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 32 PID 904 wrote to memory of 328 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 32 PID 904 wrote to memory of 328 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 32 PID 904 wrote to memory of 1172 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 34 PID 904 wrote to memory of 1172 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 34 PID 904 wrote to memory of 1172 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 34 PID 904 wrote to memory of 1172 904 6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe 34 PID 1396 wrote to memory of 1388 1396 cmd.exe 36 PID 1396 wrote to memory of 1388 1396 cmd.exe 36 PID 1396 wrote to memory of 1388 1396 cmd.exe 36 PID 1396 wrote to memory of 1388 1396 cmd.exe 36 PID 1076 wrote to memory of 604 1076 cmd.exe 38 PID 1076 wrote to memory of 604 1076 cmd.exe 38 PID 1076 wrote to memory of 604 1076 cmd.exe 38 PID 1076 wrote to memory of 604 1076 cmd.exe 38 PID 328 wrote to memory of 924 328 cmd.exe 39 PID 328 wrote to memory of 924 328 cmd.exe 39 PID 328 wrote to memory of 924 328 cmd.exe 39 PID 328 wrote to memory of 924 328 cmd.exe 39 PID 1172 wrote to memory of 1560 1172 cmd.exe 40 PID 1172 wrote to memory of 1560 1172 cmd.exe 40 PID 1172 wrote to memory of 1560 1172 cmd.exe 40 PID 1172 wrote to memory of 1560 1172 cmd.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe"C:\Users\Admin\AppData\Local\Temp\6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe"C:\Users\Admin\AppData\Local\Temp\6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe"C:\Users\Admin\AppData\Local\Temp\6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe"3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- Modifies registry key
PID:1388
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe:*:Enabled:Windows Messanger" /f4⤵
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\6f3ee1accd5eaff01776a95e812b531510f52fa5facfc89bd7b295577921dcb1.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- Modifies registry key
PID:604
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- Modifies registry key
PID:924
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Explorer\explorer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Explorer\explorer.exe:*:Enabled:Windows Messanger" /f4⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Explorer\explorer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Explorer\explorer.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- Modifies registry key
PID:1560
-
-
-
-