Malware Analysis Report

2025-08-11 08:18

Sample ID 241112-n2219sscjk
Target de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe
SHA256 b39c68c4aa6780541048d2449d3013f1477a5e946539766927bbe5d0c47e86d9
Tags
upx discovery evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b39c68c4aa6780541048d2449d3013f1477a5e946539766927bbe5d0c47e86d9

Threat Level: Known bad

The file de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe was found to be: Known bad.

Malicious Activity Summary

upx discovery evasion persistence

Modifies firewall policy service

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

UPX packed file

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Modifies registry key

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-12 11:54

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-12 11:54

Reported

2024-11-12 11:56

Platform

win7-20240903-en

Max time kernel

120s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Java\uninstall.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Java\\uninstall.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Falaheye.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Falaheye.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java(TM) Platform SE Auto Updator 2.1 = "C:\\Users\\Admin\\AppData\\Roaming\\Java\\uninstall.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2848 set thread context of 2816 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 set thread context of 2788 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1232 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe C:\Windows\SysWOW64\cmd.exe
PID 1232 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe C:\Windows\SysWOW64\cmd.exe
PID 1232 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe C:\Windows\SysWOW64\cmd.exe
PID 1232 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe C:\Windows\SysWOW64\cmd.exe
PID 1872 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1872 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1872 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1872 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1232 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 1232 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 1232 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 1232 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 1232 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 1232 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 1232 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2848 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2816 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe

"C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\HdVsA.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java(TM) Platform SE Auto Updator 2.1" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /f

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

"C:\Users\Admin\AppData\Roaming\Java\uninstall.exe"

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Falaheye.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Falaheye.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Falaheye.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Falaheye.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 lolitsbroward.no-ip.org udp

Files

memory/1232-2-0x0000000000400000-0x000000000065F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HdVsA.bat

MD5 0f9512ff58185a551abc4fa80ffde3b5
SHA1 eb2df1adbb3504236d2857d8a9c297121c97a95d
SHA256 79747cbd0b884c6870d0ab8b90e4b64af598f1c1c97b2eb31c1fc1a1d6128189
SHA512 1f7216ce7cd2e1ae6e30c7d6d0f84b3a7a637c6cfe9568a10ffa802b99a832b3e4f45c7bd02cbbe70665e79ea917e7e9ac9a38ceaf469836fb207a47ef52ff3e

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

MD5 472f521003985afc99b507335d6065e7
SHA1 cb504021d57cc2a82eb61ebe5a258dfdaefc740e
SHA256 f66c9486ea61c56ee2eb1fac2d2a03e259c17b8c7634d988e12f0aef52a2a34c
SHA512 d5c94d85e8b311f149dca30658744457b5f3c00d067d5c1652312215d141ac5f8a17fb2907e34e9d3e1be7b4ef7724c28cc5d61438393a9eed03d7729069a61d

memory/1232-39-0x0000000003230000-0x000000000348F000-memory.dmp

memory/1232-46-0x0000000000400000-0x000000000065F000-memory.dmp

memory/2848-45-0x0000000000400000-0x000000000065F000-memory.dmp

memory/2788-61-0x00000000008E0000-0x0000000000B3F000-memory.dmp

memory/2816-68-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-74-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-79-0x0000000000C10000-0x0000000000E6F000-memory.dmp

memory/2816-78-0x0000000000C10000-0x0000000000E6F000-memory.dmp

memory/2816-77-0x0000000000C10000-0x0000000000E6F000-memory.dmp

memory/2816-73-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-69-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2848-64-0x0000000000400000-0x000000000065F000-memory.dmp

memory/2788-63-0x00000000008E0000-0x0000000000B3F000-memory.dmp

memory/2788-62-0x00000000008E0000-0x0000000000B3F000-memory.dmp

memory/2788-60-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2816-50-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2788-58-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2788-54-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2788-52-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2788-83-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2788-84-0x00000000008E0000-0x0000000000B3F000-memory.dmp

memory/2816-85-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-86-0x0000000000C10000-0x0000000000E6F000-memory.dmp

memory/2816-87-0x0000000000C10000-0x0000000000E6F000-memory.dmp

memory/2816-88-0x0000000000C10000-0x0000000000E6F000-memory.dmp

memory/2816-89-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-91-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-93-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-96-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-98-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-100-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-103-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-105-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-107-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-110-0x0000000000400000-0x000000000045C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-12 11:54

Reported

2024-11-12 11:56

Platform

win10v2004-20241007-en

Max time kernel

118s

Max time network

112s

Command Line

"C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Falaheye.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Falaheye.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Java\uninstall.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Java\\uninstall.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java(TM) Platform SE Auto Updator 2.1 = "C:\\Users\\Admin\\AppData\\Roaming\\Java\\uninstall.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2452 set thread context of 2964 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2452 set thread context of 3248 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4776 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe C:\Windows\SysWOW64\cmd.exe
PID 4776 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe C:\Windows\SysWOW64\cmd.exe
PID 4776 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe C:\Windows\SysWOW64\cmd.exe
PID 688 wrote to memory of 3832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 688 wrote to memory of 3832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 688 wrote to memory of 3832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4776 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 4776 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 4776 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2452 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2452 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2452 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2452 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2452 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2452 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2452 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2452 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2452 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2452 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2452 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2452 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2452 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2452 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2452 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2452 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2964 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2636 wrote to memory of 2220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2636 wrote to memory of 2220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2636 wrote to memory of 2220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3888 wrote to memory of 1808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3888 wrote to memory of 1808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3888 wrote to memory of 1808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3980 wrote to memory of 1888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3980 wrote to memory of 1888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3980 wrote to memory of 1888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4916 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4916 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4916 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe

"C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eGBPq.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java(TM) Platform SE Auto Updator 2.1" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /f

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

"C:\Users\Admin\AppData\Roaming\Java\uninstall.exe"

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Falaheye.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Falaheye.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Falaheye.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Falaheye.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp

Files

memory/4776-0-0x0000000000400000-0x000000000065F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\eGBPq.txt

MD5 0f9512ff58185a551abc4fa80ffde3b5
SHA1 eb2df1adbb3504236d2857d8a9c297121c97a95d
SHA256 79747cbd0b884c6870d0ab8b90e4b64af598f1c1c97b2eb31c1fc1a1d6128189
SHA512 1f7216ce7cd2e1ae6e30c7d6d0f84b3a7a637c6cfe9568a10ffa802b99a832b3e4f45c7bd02cbbe70665e79ea917e7e9ac9a38ceaf469836fb207a47ef52ff3e

C:\Users\Admin\AppData\Roaming\Java\uninstall.txt

MD5 68435491317e24a75700acb4c6cc5fd4
SHA1 79e71acc610ca385157321280adf3ed19214e2d2
SHA256 682392829cbe1e7fc28bff8ace8b97a5980eca1ed7650ad02757d10ee17fade0
SHA512 3ec337341cc3c1fa52ce3cc807a9abedf583dc9eac34e38003a594c9fb14d48d5862a898c2d7b9781d6d1b458f52c2e37910a04e44ea56089623273929085ad8

memory/4776-28-0x0000000000400000-0x000000000065F000-memory.dmp

memory/2964-31-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2964-34-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2964-36-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3248-43-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2452-48-0x0000000000400000-0x000000000065F000-memory.dmp

memory/3248-45-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3248-40-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2964-51-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3248-52-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2964-53-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2964-55-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2964-58-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2964-60-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2964-62-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2964-65-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2964-67-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2964-72-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2964-74-0x0000000000400000-0x000000000045C000-memory.dmp