Summary
Files detected as Sus/Behav-168 exhibit suspicious behaviour.
Detailed analysis
Example behaviours of Sus/Behav-168 follow:
Example 1
Runtime Analysis
Copies Itself To
- C:\WINDOWS\system32\mdm.exe
Registry Keys Created
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- Microsoft Office
- C:\WINDOWS\system32\mdm.exe
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- Microsoft Office
- C:\WINDOWS\system32\mdm.exe
Registry Keys Modified
- HKLM\SYSTEM\CurrentControlSet\Control\Lsa
- restrictanonymous
- 0x00000001
- HKLM\SOFTWARE\Microsoft\Ole
- EnableDCOM
- N
Processes Created
- c:\windows\system32\mdm.exe
DNS Requests
Example 2
Runtime Analysis
Copies Itself To
- C:\WINDOWS\system32\mdm.exe
Registry Keys Created
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- Microsoft Office
- C:\WINDOWS\system32\mdm.exe
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- Microsoft Office
- C:\WINDOWS\system32\mdm.exe
Registry Keys Modified
- HKLM\SOFTWARE\Microsoft\Ole
- EnableDCOM
- N
- HKLM\SYSTEM\CurrentControlSet\Control\Lsa
- restrictanonymous
- 0x00000001
Processes Created
- c:\windows\system32\mdm.exe
DNS Requests
Example 3
Runtime Analysis
Copies Itself To
- C:\WINDOWS\system32\mdm.exe
Registry Keys Created
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- Microsoft Office
- C:\WINDOWS\system32\mdm.exe
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- Microsoft Office
- C:\WINDOWS\system32\mdm.exe
Registry Keys Modified
- HKLM\SYSTEM\CurrentControlSet\Control\Lsa
- restrictanonymous
- 0x00000001
- HKLM\SOFTWARE\Microsoft\Ole
- EnableDCOM
- N
Processes Created
- c:\windows\system32\mdm.exe
DNS Requests