Analysis
-
max time kernel
147s -
max time network
22s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-01-2025 12:11
Behavioral task
behavioral1
Sample
JaffaCakes118_35605a727be74718ca88a28676b9aced.exe
Resource
win7-20241010-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_35605a727be74718ca88a28676b9aced.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
JaffaCakes118_35605a727be74718ca88a28676b9aced.exe
-
Size
858KB
-
MD5
35605a727be74718ca88a28676b9aced
-
SHA1
2efb3f52ab0643e6d45b577bff49de7dceb9b8a1
-
SHA256
6393c1c5c6c00ffb8f5c51249341f20bdd2b40d447be2617f94c1dd0a3964574
-
SHA512
6e58ddc5d2efbbecea7202f4d54e3685d202ac3bf473161bcfc12d686e8e8841a0b8921a5f42818929f15ea39cfdd6bc5e3a01222d53e38c055e8c75f4610484
-
SSDEEP
12288:EeIhb5ArM/nuCET+I7SbxD1T6s7Owx77jWxPK+8ybfplDEYzoS:ybdwwZjj+8ybfplD
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 16 IoCs
resource yara_rule behavioral1/memory/2852-16-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2852-22-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2852-21-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2852-15-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2852-26-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2852-27-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2852-28-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2852-29-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2852-30-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2852-32-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2852-33-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2852-34-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2852-36-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2852-38-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2852-44-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2852-45-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_35605a727be74718ca88a28676b9aced.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_35605a727be74718ca88a28676b9aced.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\winuser.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winuser.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows Updater = "C:\\Users\\Admin\\AppData\\Roaming\\winuser.exe" JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run JaffaCakes118_35605a727be74718ca88a28676b9aced.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BDDA0CD0-F4FF-47F5-DAC7-E57F8FAE2DDF} JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BDDA0CD0-F4FF-47F5-DAC7-E57F8FAE2DDF}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\winuser.exe" JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{BDDA0CD0-F4FF-47F5-DAC7-E57F8FAE2DDF} JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Active Setup\Installed Components\{BDDA0CD0-F4FF-47F5-DAC7-E57F8FAE2DDF}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\winuser.exe" JaffaCakes118_35605a727be74718ca88a28676b9aced.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Updater = "C:\\Users\\Admin\\AppData\\Roaming\\winuser.exe" JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Updater = "C:\\Users\\Admin\\AppData\\Roaming\\winuser.exe" JaffaCakes118_35605a727be74718ca88a28676b9aced.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2660 set thread context of 2852 2660 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 29 -
resource yara_rule behavioral1/memory/2660-0-0x0000000000400000-0x00000000004D8000-memory.dmp upx behavioral1/memory/2660-3-0x0000000000400000-0x00000000004D8000-memory.dmp upx behavioral1/memory/2852-7-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2852-16-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2852-22-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2852-21-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2852-15-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2852-14-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2852-12-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2852-9-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2660-17-0x0000000000400000-0x00000000004D8000-memory.dmp upx behavioral1/memory/2852-26-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2852-27-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2852-28-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2852-29-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2852-30-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2852-32-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2852-33-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2852-34-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2852-36-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2852-38-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2852-44-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2852-45-0x0000000000400000-0x0000000000473000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2716 reg.exe 2724 reg.exe 2744 reg.exe 2788 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeCreateTokenPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeAssignPrimaryTokenPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeLockMemoryPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeIncreaseQuotaPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeMachineAccountPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeTcbPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeSecurityPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeTakeOwnershipPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeLoadDriverPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeSystemProfilePrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeSystemtimePrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeProfSingleProcessPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeIncBasePriorityPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeCreatePagefilePrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeCreatePermanentPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeBackupPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeRestorePrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeShutdownPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeDebugPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeAuditPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeSystemEnvironmentPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeChangeNotifyPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeRemoteShutdownPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeUndockPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeSyncAgentPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeEnableDelegationPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeManageVolumePrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeImpersonatePrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeCreateGlobalPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: 31 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: 32 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: 33 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: 34 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: 35 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe Token: SeDebugPrivilege 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2660 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2660 wrote to memory of 2852 2660 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 29 PID 2660 wrote to memory of 2852 2660 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 29 PID 2660 wrote to memory of 2852 2660 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 29 PID 2660 wrote to memory of 2852 2660 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 29 PID 2660 wrote to memory of 2852 2660 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 29 PID 2660 wrote to memory of 2852 2660 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 29 PID 2660 wrote to memory of 2852 2660 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 29 PID 2660 wrote to memory of 2852 2660 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 29 PID 2852 wrote to memory of 2872 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 30 PID 2852 wrote to memory of 2872 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 30 PID 2852 wrote to memory of 2872 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 30 PID 2852 wrote to memory of 2872 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 30 PID 2852 wrote to memory of 2928 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 31 PID 2852 wrote to memory of 2928 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 31 PID 2852 wrote to memory of 2928 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 31 PID 2852 wrote to memory of 2928 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 31 PID 2852 wrote to memory of 2748 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 32 PID 2852 wrote to memory of 2748 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 32 PID 2852 wrote to memory of 2748 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 32 PID 2852 wrote to memory of 2748 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 32 PID 2852 wrote to memory of 2740 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 34 PID 2852 wrote to memory of 2740 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 34 PID 2852 wrote to memory of 2740 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 34 PID 2852 wrote to memory of 2740 2852 JaffaCakes118_35605a727be74718ca88a28676b9aced.exe 34 PID 2872 wrote to memory of 2716 2872 cmd.exe 38 PID 2872 wrote to memory of 2716 2872 cmd.exe 38 PID 2872 wrote to memory of 2716 2872 cmd.exe 38 PID 2872 wrote to memory of 2716 2872 cmd.exe 38 PID 2740 wrote to memory of 2724 2740 cmd.exe 39 PID 2740 wrote to memory of 2724 2740 cmd.exe 39 PID 2740 wrote to memory of 2724 2740 cmd.exe 39 PID 2740 wrote to memory of 2724 2740 cmd.exe 39 PID 2748 wrote to memory of 2744 2748 cmd.exe 40 PID 2748 wrote to memory of 2744 2748 cmd.exe 40 PID 2748 wrote to memory of 2744 2748 cmd.exe 40 PID 2748 wrote to memory of 2744 2748 cmd.exe 40 PID 2928 wrote to memory of 2788 2928 cmd.exe 41 PID 2928 wrote to memory of 2788 2928 cmd.exe 41 PID 2928 wrote to memory of 2788 2928 cmd.exe 41 PID 2928 wrote to memory of 2788 2928 cmd.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_35605a727be74718ca88a28676b9aced.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_35605a727be74718ca88a28676b9aced.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_35605a727be74718ca88a28676b9aced.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_35605a727be74718ca88a28676b9aced.exe2⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2716
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_35605a727be74718ca88a28676b9aced.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_35605a727be74718ca88a28676b9aced.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_35605a727be74718ca88a28676b9aced.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_35605a727be74718ca88a28676b9aced.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2788
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2744
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winuser.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winuser.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winuser.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winuser.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2724
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1