Malware Analysis Report

2025-05-06 00:16

Sample ID 250124-g4rvratrfw
Target JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862
SHA256 38f9dc7d43224d245fa5c1405fb3f624e2659f28655a59fc5737973b84cc282f
Tags
blackshades defense_evasion discovery persistence rat upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

38f9dc7d43224d245fa5c1405fb3f624e2659f28655a59fc5737973b84cc282f

Threat Level: Known bad

The file JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862 was found to be: Known bad.

Malicious Activity Summary

blackshades defense_evasion discovery persistence rat upx

Blackshades family

Blackshades payload

Blackshades

Modifies firewall policy service

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

AutoIT Executable

UPX packed file

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Modifies registry key

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-24 06:21

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-24 06:21

Reported

2025-01-24 06:24

Platform

win7-20241010-en

Max time kernel

150s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\D3Sept.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D3Sept.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\audiadg.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2860 set thread context of 2700 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3064 set thread context of 2248 N/A C:\Users\Admin\AppData\Local\Temp\bcdprov.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bcdprov.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
Token: 1 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 31 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 32 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bcdprov.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2316 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe C:\Users\Admin\AppData\Local\Temp\Software\sarkoth.exe
PID 2316 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe C:\Users\Admin\AppData\Local\Temp\Software\sarkoth.exe
PID 2316 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe C:\Users\Admin\AppData\Local\Temp\Software\sarkoth.exe
PID 2316 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe C:\Users\Admin\AppData\Local\Temp\Software\sarkoth.exe
PID 2316 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe C:\Users\Admin\AppData\Local\Temp\Software\D3.exe
PID 2316 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe C:\Users\Admin\AppData\Local\Temp\Software\D3.exe
PID 2316 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe C:\Users\Admin\AppData\Local\Temp\Software\D3.exe
PID 2316 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe C:\Users\Admin\AppData\Local\Temp\Software\D3.exe
PID 2860 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2860 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2860 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2860 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2860 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2860 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2860 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2860 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2860 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2860 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2860 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2700 wrote to memory of 2688 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2688 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2688 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2688 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2688 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2688 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2688 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2696 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2696 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2696 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2696 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2696 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2696 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2696 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2752 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2752 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2752 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2752 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2752 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2752 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2752 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2012 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2012 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2012 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2012 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2012 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2012 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2700 wrote to memory of 2012 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2860 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe
PID 2860 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe
PID 2860 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe
PID 2860 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe
PID 2688 wrote to memory of 784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2688 wrote to memory of 784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2688 wrote to memory of 784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2688 wrote to memory of 784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2688 wrote to memory of 784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2688 wrote to memory of 784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2688 wrote to memory of 784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2752 wrote to memory of 1568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2752 wrote to memory of 1568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2752 wrote to memory of 1568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2752 wrote to memory of 1568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2752 wrote to memory of 1568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2752 wrote to memory of 1568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe"

C:\Users\Admin\AppData\Local\Temp\Software\sarkoth.exe

"C:\Users\Admin\AppData\Local\Temp\Software\sarkoth.exe"

C:\Users\Admin\AppData\Local\Temp\Software\D3.exe

"C:\Users\Admin\AppData\Local\Temp\Software\D3.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\D3Sept.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\D3Sept.exe:*:Enabled:Windows Messanger" /f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\D3Sept.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\D3Sept.exe:*:Enabled:Windows Messanger" /f

C:\Users\Admin\AppData\Local\Temp\bcdprov.exe

"C:\Users\Admin\AppData\Local\Temp\bcdprov.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 godin.no-ip.org udp
US 8.8.8.8:53 1godin.no-ip.org udp
US 8.8.8.8:53 2godin.no-ip.org udp
ID 212.117.50.228:3344 2godin.no-ip.org tcp
US 8.8.8.8:53 3godin.no-ip.org udp
US 8.8.8.8:53 4godin.no-ip.org udp
US 8.8.8.8:53 5godin.no-ip.org udp
US 8.8.8.8:53 6godin.no-ip.org udp

Files

memory/2316-0-0x0000000074A01000-0x0000000074A02000-memory.dmp

memory/2316-1-0x0000000074A00000-0x0000000074FAB000-memory.dmp

memory/2316-2-0x0000000074A00000-0x0000000074FAB000-memory.dmp

\Users\Admin\AppData\Local\Temp\Software\sarkoth.exe

MD5 953d441e4dbbce93ffb02fe1bb203e34
SHA1 77917fb53535e770137fb6915f8db37ae5464ea4
SHA256 66da1f6e8952366700054e3bf9c1ca20a58fa1df58d8783c1389f358bdf3513d
SHA512 77b37d091c55cc8f7f8b455c26e9e47898e83795d6890316f529715fdd3981aac50917ab6677170b705731c40d49b0646d234fe38e6cbb3c334c7a4c7aa257dd

\Users\Admin\AppData\Local\Temp\Software\D3.exe

MD5 486fdb3d60c7811dee22742cca9f93dc
SHA1 d59ae0af20b78abfd351482cb1c93f62f4cf469f
SHA256 eacf7057eff4e24be433c7437053d5dc34b1c32e9373d723281780cbd8144c68
SHA512 61f8eaf774678b82a494865f96c799ae1aa2ca00fd5e75b3cc28e4d802cc7343b02a7e44c8bd1d9c31f7b93441f2c5d4793eb4689458f3c81bcd5b2ae28b56f0

memory/2316-17-0x0000000074A00000-0x0000000074FAB000-memory.dmp

memory/2700-22-0x0000000000400000-0x000000000047B000-memory.dmp

memory/2700-23-0x0000000000400000-0x000000000047B000-memory.dmp

memory/2700-28-0x0000000000400000-0x000000000047B000-memory.dmp

memory/2700-32-0x0000000000400000-0x000000000047B000-memory.dmp

memory/2700-30-0x0000000000400000-0x000000000047B000-memory.dmp

memory/2700-31-0x0000000000400000-0x000000000047B000-memory.dmp

memory/2700-26-0x0000000000400000-0x000000000047B000-memory.dmp

memory/2700-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2700-24-0x0000000000400000-0x000000000047B000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe

MD5 9b3848f7bd575120a33fb480774b5b6b
SHA1 9a7ef7a9b4f946f4ddbe2fadb3c52f1fd6991045
SHA256 271f73350c0e95d765fe1ccbf4b1fae1f7b62b62a723472a65f562ceab22d791
SHA512 02a7364ff655f0a4345b7428f577396a8ec7347f2d8466f4d957b7dd3909baf6b7b403135450b3f142ea275452fbfb418f64f075fba11f808640479d726a73b3

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-24 06:21

Reported

2025-01-24 06:24

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\D3Sept.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D3Sept.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\audiadg.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2108 set thread context of 1116 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 864 set thread context of 420 N/A C:\Users\Admin\AppData\Local\Temp\bcdprov.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bcdprov.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe N/A
Token: 1 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 31 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 32 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\bcdprov.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4880 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe C:\Users\Admin\AppData\Local\Temp\Software\sarkoth.exe
PID 4880 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe C:\Users\Admin\AppData\Local\Temp\Software\sarkoth.exe
PID 4880 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe C:\Users\Admin\AppData\Local\Temp\Software\D3.exe
PID 4880 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe C:\Users\Admin\AppData\Local\Temp\Software\D3.exe
PID 4880 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe C:\Users\Admin\AppData\Local\Temp\Software\D3.exe
PID 2108 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2108 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2108 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2108 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2108 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2108 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2108 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2108 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 1116 wrote to memory of 748 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 748 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 748 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 1556 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 1556 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 1556 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 2804 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 2804 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 2804 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 3180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 3180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 3180 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2804 wrote to memory of 3636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2804 wrote to memory of 3636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2804 wrote to memory of 3636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 748 wrote to memory of 4108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 748 wrote to memory of 4108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 748 wrote to memory of 4108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3180 wrote to memory of 1316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3180 wrote to memory of 1316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3180 wrote to memory of 1316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1556 wrote to memory of 2104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1556 wrote to memory of 2104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1556 wrote to memory of 2104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2108 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe
PID 2108 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe
PID 2108 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\Software\D3.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe
PID 3580 wrote to memory of 864 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe C:\Users\Admin\AppData\Local\Temp\bcdprov.exe
PID 3580 wrote to memory of 864 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe C:\Users\Admin\AppData\Local\Temp\bcdprov.exe
PID 3580 wrote to memory of 864 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe C:\Users\Admin\AppData\Local\Temp\bcdprov.exe
PID 864 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\bcdprov.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 864 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\bcdprov.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 864 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\bcdprov.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 864 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\bcdprov.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 864 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\bcdprov.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 864 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\bcdprov.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 864 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\bcdprov.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 864 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\bcdprov.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb9eea740e4165eb9ae5dcee0d72862.exe"

C:\Users\Admin\AppData\Local\Temp\Software\sarkoth.exe

"C:\Users\Admin\AppData\Local\Temp\Software\sarkoth.exe"

C:\Users\Admin\AppData\Local\Temp\Software\D3.exe

"C:\Users\Admin\AppData\Local\Temp\Software\D3.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\D3Sept.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\D3Sept.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\D3Sept.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\D3Sept.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe"

C:\Users\Admin\AppData\Local\Temp\bcdprov.exe

"C:\Users\Admin\AppData\Local\Temp\bcdprov.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 7.98.51.23.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 godin.no-ip.org udp
US 8.8.8.8:53 201.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 godin.no-ip.org udp
US 8.8.8.8:53 1godin.no-ip.org udp
US 8.8.8.8:53 71.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 2godin.no-ip.org udp
ID 212.117.50.228:3344 2godin.no-ip.org tcp
US 8.8.8.8:53 3godin.no-ip.org udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 4godin.no-ip.org udp
US 8.8.8.8:53 5godin.no-ip.org udp
US 8.8.8.8:53 6godin.no-ip.org udp

Files

memory/4880-0-0x0000000074D02000-0x0000000074D03000-memory.dmp

memory/4880-1-0x0000000074D00000-0x00000000752B1000-memory.dmp

memory/4880-2-0x0000000074D00000-0x00000000752B1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Software\sarkoth.exe

MD5 953d441e4dbbce93ffb02fe1bb203e34
SHA1 77917fb53535e770137fb6915f8db37ae5464ea4
SHA256 66da1f6e8952366700054e3bf9c1ca20a58fa1df58d8783c1389f358bdf3513d
SHA512 77b37d091c55cc8f7f8b455c26e9e47898e83795d6890316f529715fdd3981aac50917ab6677170b705731c40d49b0646d234fe38e6cbb3c334c7a4c7aa257dd

C:\Users\Admin\AppData\Local\Temp\Software\D3.exe

MD5 486fdb3d60c7811dee22742cca9f93dc
SHA1 d59ae0af20b78abfd351482cb1c93f62f4cf469f
SHA256 eacf7057eff4e24be433c7437053d5dc34b1c32e9373d723281780cbd8144c68
SHA512 61f8eaf774678b82a494865f96c799ae1aa2ca00fd5e75b3cc28e4d802cc7343b02a7e44c8bd1d9c31f7b93441f2c5d4793eb4689458f3c81bcd5b2ae28b56f0

memory/2108-25-0x0000000074D00000-0x00000000752B1000-memory.dmp

memory/4880-28-0x0000000074D00000-0x00000000752B1000-memory.dmp

memory/2108-27-0x0000000074D00000-0x00000000752B1000-memory.dmp

memory/2108-33-0x0000000074D00000-0x00000000752B1000-memory.dmp

memory/2108-34-0x0000000074D00000-0x00000000752B1000-memory.dmp

memory/1116-35-0x0000000000400000-0x000000000047B000-memory.dmp

memory/1116-37-0x0000000000400000-0x000000000047B000-memory.dmp

memory/1116-39-0x0000000000400000-0x000000000047B000-memory.dmp

memory/1116-38-0x0000000000400000-0x000000000047B000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\audiadg.exe

MD5 9b3848f7bd575120a33fb480774b5b6b
SHA1 9a7ef7a9b4f946f4ddbe2fadb3c52f1fd6991045
SHA256 271f73350c0e95d765fe1ccbf4b1fae1f7b62b62a723472a65f562ceab22d791
SHA512 02a7364ff655f0a4345b7428f577396a8ec7347f2d8466f4d957b7dd3909baf6b7b403135450b3f142ea275452fbfb418f64f075fba11f808640479d726a73b3