Malware Analysis Report

2025-05-06 00:16

Sample ID 250124-bke4ystpcj
Target 11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe
SHA256 11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac
Tags
upx blackshades defense_evasion discovery persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac

Threat Level: Known bad

The file 11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe was found to be: Known bad.

Malicious Activity Summary

upx blackshades defense_evasion discovery persistence rat

Blackshades

Blackshades family

Modifies firewall policy service

Blackshades payload

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

UPX packed file

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Modifies registry key

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-24 01:11

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-24 01:11

Reported

2025-01-24 01:13

Platform

win7-20240903-en

Max time kernel

119s

Max time network

117s

Command Line

"C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Java\uninstall.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Java\\uninstall.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Falaheye.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Falaheye.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java(TM) Platform SE Auto Updator 2.1 = "C:\\Users\\Admin\\AppData\\Roaming\\Java\\uninstall.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2116 set thread context of 3028 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 set thread context of 1732 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2244 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2796 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2796 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2796 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2244 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2244 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2244 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2244 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2244 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2244 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2244 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2116 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 3028 wrote to memory of 620 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 620 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 620 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 620 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 620 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 620 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 620 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 484 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 484 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 484 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 484 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe

"C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\DoCSi.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java(TM) Platform SE Auto Updator 2.1" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /f

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

"C:\Users\Admin\AppData\Roaming\Java\uninstall.exe"

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Falaheye.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Falaheye.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Falaheye.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Falaheye.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 lolitsbroward.no-ip.org udp

Files

memory/2244-0-0x0000000000400000-0x000000000065F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DoCSi.bat

MD5 0f9512ff58185a551abc4fa80ffde3b5
SHA1 eb2df1adbb3504236d2857d8a9c297121c97a95d
SHA256 79747cbd0b884c6870d0ab8b90e4b64af598f1c1c97b2eb31c1fc1a1d6128189
SHA512 1f7216ce7cd2e1ae6e30c7d6d0f84b3a7a637c6cfe9568a10ffa802b99a832b3e4f45c7bd02cbbe70665e79ea917e7e9ac9a38ceaf469836fb207a47ef52ff3e

\Users\Admin\AppData\Roaming\Java\uninstall.exe

MD5 5b2d9f309d28d7adc3a423cded20a83b
SHA1 50bd100b52df5cde9483b32b7295c554dbac68e1
SHA256 16075912e5af40a7d76a3047f32535fe7ffcdc7f8e1781f6b8ecb69e7fe25078
SHA512 7880c5b45aa5d450f23a859de0482069412a2f977237366e205fd30a0e9e1426f0955a8828eba7c73e08746d2b191fcbecdccd120142fd0a4137c3efa158e822

memory/2244-39-0x0000000003350000-0x00000000035AF000-memory.dmp

memory/2244-42-0x0000000000400000-0x000000000065F000-memory.dmp

memory/2116-43-0x0000000000400000-0x000000000065F000-memory.dmp

memory/2116-47-0x0000000000BA0000-0x0000000000DFF000-memory.dmp

memory/1732-65-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3028-51-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1732-61-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3028-59-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1732-55-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3028-54-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1732-72-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1732-71-0x0000000000980000-0x0000000000BDF000-memory.dmp

memory/1732-70-0x0000000000980000-0x0000000000BDF000-memory.dmp

memory/1732-69-0x0000000000980000-0x0000000000BDF000-memory.dmp

memory/3028-68-0x0000000000A60000-0x0000000000CBF000-memory.dmp

memory/3028-67-0x0000000000A60000-0x0000000000CBF000-memory.dmp

memory/3028-66-0x0000000000A60000-0x0000000000CBF000-memory.dmp

memory/2116-75-0x0000000000400000-0x000000000065F000-memory.dmp

memory/3028-76-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3028-82-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1732-83-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3028-84-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3028-86-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3028-89-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3028-91-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3028-93-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3028-96-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3028-98-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3028-103-0x0000000000400000-0x000000000045C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-24 01:11

Reported

2025-01-24 01:14

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

109s

Command Line

"C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Falaheye.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Falaheye.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Java\uninstall.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Java\\uninstall.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java(TM) Platform SE Auto Updator 2.1 = "C:\\Users\\Admin\\AppData\\Roaming\\Java\\uninstall.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2620 set thread context of 2368 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2620 set thread context of 3792 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4664 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe C:\Windows\SysWOW64\cmd.exe
PID 4664 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe C:\Windows\SysWOW64\cmd.exe
PID 4664 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe C:\Windows\SysWOW64\cmd.exe
PID 1036 wrote to memory of 4100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1036 wrote to memory of 4100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1036 wrote to memory of 4100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4664 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 4664 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 4664 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2620 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2620 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2620 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2620 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2620 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2620 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2620 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2620 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2620 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2620 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2620 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2620 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2620 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2620 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2620 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2620 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2368 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2068 wrote to memory of 4184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2068 wrote to memory of 4184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2068 wrote to memory of 4184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4644 wrote to memory of 4012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4644 wrote to memory of 4012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4644 wrote to memory of 4012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2220 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2220 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2220 wrote to memory of 2564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4684 wrote to memory of 3472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4684 wrote to memory of 3472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4684 wrote to memory of 3472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe

"C:\Users\Admin\AppData\Local\Temp\11c1bf8de85073826d91a31ab7e0f12b116c19ecd8fd38913fc29cc80ed49fac.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kdsux.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java(TM) Platform SE Auto Updator 2.1" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /f

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

"C:\Users\Admin\AppData\Roaming\Java\uninstall.exe"

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Falaheye.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Falaheye.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Falaheye.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Falaheye.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 218.158.40.23.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 22.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp

Files

memory/4664-0-0x0000000000400000-0x000000000065F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\kdsux.txt

MD5 0f9512ff58185a551abc4fa80ffde3b5
SHA1 eb2df1adbb3504236d2857d8a9c297121c97a95d
SHA256 79747cbd0b884c6870d0ab8b90e4b64af598f1c1c97b2eb31c1fc1a1d6128189
SHA512 1f7216ce7cd2e1ae6e30c7d6d0f84b3a7a637c6cfe9568a10ffa802b99a832b3e4f45c7bd02cbbe70665e79ea917e7e9ac9a38ceaf469836fb207a47ef52ff3e

C:\Users\Admin\AppData\Roaming\Java\uninstall.txt

MD5 8fc714049247456382a6560f7e731482
SHA1 78a87227102f1c64acb31fc9299bfe65a9013293
SHA256 da7590dae8aa63d2675f7ec2fc9f37781911441439c795f0e76dab290be43ef9
SHA512 a4c9d5b707352b05cb53b0fd59e8a478acb3428418ddd543b3a2328db7ea13fe1f7a3941edc73e4d17bd53483144a5f3e25c1316afb51c2079b3fc7ea3aa8dc5

memory/4664-28-0x0000000000400000-0x000000000065F000-memory.dmp

memory/2368-35-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3792-42-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3792-46-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2620-49-0x0000000000400000-0x000000000065F000-memory.dmp

memory/3792-39-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2368-34-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2368-31-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2368-50-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3792-51-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2368-52-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2368-54-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2368-57-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2368-59-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2368-61-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2368-64-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2368-66-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2368-73-0x0000000000400000-0x000000000045C000-memory.dmp