bypass v5.10.228257.2253 (dll malware, QQ pass)

[a256886572008]

@EricJH post:20

MSUPdates.exe is not trusted as it gets sandboxed. Or did you sandbox if manually for testing or instruction purposes?

I add it to the list, “always sandbox”

[languy99]

go to the firewall tab, firewall behavior settings and turn off “Do not show popup alerts” does it still have access while in the sandbox?

[a256886572008]

@languy99 post:22

go to the firewall tab, firewall behavior settings and turn off “Do not show popup alerts” does it still have access while in the sandbox?

1. The configuration was “CIS”

2.The firewall was in “safe mode”

3.So, there were no firewall alerts

[languy99]

that is not what I asked you to check.

[a256886572008]

test the malware with DW:

1.DW trusts this file

“photo.exe”

2.DW untrusts another file

“MSDTCTM.dll”

3.The user double clicks on the photo.exe

4.result: DW untrusts the photo.exe