Malware Analysis Report

2025-05-06 00:16

Sample ID 250124-gab77stnbq
Target f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe
SHA256 f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96
Tags
blackshades defense_evasion discovery persistence rat upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96

Threat Level: Known bad

The file f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe was found to be: Known bad.

Malicious Activity Summary

blackshades defense_evasion discovery persistence rat upx

Blackshades payload

Blackshades

Blackshades family

Modifies firewall policy service

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

UPX packed file

Suspicious use of SetThreadContext

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Modifies registry key

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-24 05:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-24 05:35

Reported

2025-01-24 05:37

Platform

win7-20240729-en

Max time kernel

119s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\WindowsDef.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\IDungProV5.exe = "C:\\Users\\Admin\\AppData\\Roaming\\IDungProV5.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDef = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\WindowsDef.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2584 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe C:\Windows\SysWOW64\cmd.exe
PID 2400 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2400 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2400 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2400 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2584 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2584 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2584 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2584 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2860 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2860 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2860 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2860 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2860 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2860 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2860 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2860 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2860 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2860 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2860 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2860 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2860 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2884 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 2780 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2780 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2780 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2780 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2860 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2860 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2860 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2860 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 2860 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 1900 wrote to memory of 2348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1900 wrote to memory of 2348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1900 wrote to memory of 2348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1900 wrote to memory of 2348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2788 wrote to memory of 1640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2788 wrote to memory of 1640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2788 wrote to memory of 1640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2788 wrote to memory of 1640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2836 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2836 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2836 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2836 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe

"C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\PycKq.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDef" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe" /f

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe

"C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe"

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\IDungProV5.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDungProV5.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\IDungProV5.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDungProV5.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 spyroiscool.no-ip.biz udp

Files

memory/2876-64-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2876-60-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2876-63-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe

MD5 7e68041a11f22ed557b1a05033f2428d
SHA1 59f5d04867d237334a3442834ac07551b570ad89
SHA256 25164e236ef5b56d1059ad5df567f1ca9f7f2c3d0970f3f82757814ac625f42d
SHA512 13056540cdea683b87601cbaa3eee8e44fa4b8b047d5f14aa8817e9d3445537a0af835507d394a8f47ccd7feb75f29e2a0f2845ee76396843770952d3cb48214

memory/2884-54-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2884-51-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2884-48-0x0000000000400000-0x000000000045C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\PycKq.bat

MD5 12506b1a3ef0e7dcef2babaaecfb81e8
SHA1 9564f2c31b336dab739e74cceedb5e4d07c2a563
SHA256 3922b88903f6e7a4cd1e9cee92f9a0de6f0cd28a4a6db73114e320fa7cbf8c8a
SHA512 cbf0ade56c9961edcf8018f8e1654446e17c863e8df98a78b781b4b91ca87a9ab3b1532376f245c678f6f9e00771d74dba99e0fee237ebf3f4a69473d57f0dec

memory/2584-0-0x0000000000400000-0x00000000005F7000-memory.dmp

memory/2884-67-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2876-69-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2884-70-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2884-72-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2884-75-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2884-77-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2884-79-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2884-84-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2884-89-0x0000000000400000-0x000000000045C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-24 05:35

Reported

2025-01-24 05:37

Platform

win10v2004-20241007-en

Max time kernel

119s

Max time network

108s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\IDungProV5.exe = "C:\\Users\\Admin\\AppData\\Roaming\\IDungProV5.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\WindowsDef.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDef = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\WindowsDef.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3316 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe C:\Windows\SysWOW64\cmd.exe
PID 3316 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe C:\Windows\SysWOW64\cmd.exe
PID 3316 wrote to memory of 3376 N/A C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe C:\Windows\SysWOW64\cmd.exe
PID 3376 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3376 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3376 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3316 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 3316 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 3316 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 4512 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 4512 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 4512 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 4512 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 4512 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 4512 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 4512 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 4512 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 4512 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 4512 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 4512 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 4512 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 4512 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 4512 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 4512 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 4512 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe
PID 1696 wrote to memory of 428 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 1696 wrote to memory of 428 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 1696 wrote to memory of 428 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 1696 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 1696 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 1696 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 1696 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 1696 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 1696 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 1696 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 1696 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 1696 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe C:\Windows\SysWOW64\cmd.exe
PID 428 wrote to memory of 4636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 428 wrote to memory of 4636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 428 wrote to memory of 4636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2264 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2264 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2264 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3456 wrote to memory of 2016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3456 wrote to memory of 2016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3456 wrote to memory of 2016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2260 wrote to memory of 4492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2260 wrote to memory of 4492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2260 wrote to memory of 4492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe

"C:\Users\Admin\AppData\Local\Temp\f5356d6c796405774d19fa81d405c30e8370170b58b152e842b559790a54ad96N.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZTSnl.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDef" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe" /f

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe

"C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe"

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\IDungProV5.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDungProV5.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\IDungProV5.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IDungProV5.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 21.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 5.114.82.104.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 spyroiscool.no-ip.biz udp

Files

memory/3316-0-0x0000000000400000-0x00000000005F7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ZTSnl.txt

MD5 12506b1a3ef0e7dcef2babaaecfb81e8
SHA1 9564f2c31b336dab739e74cceedb5e4d07c2a563
SHA256 3922b88903f6e7a4cd1e9cee92f9a0de6f0cd28a4a6db73114e320fa7cbf8c8a
SHA512 cbf0ade56c9961edcf8018f8e1654446e17c863e8df98a78b781b4b91ca87a9ab3b1532376f245c678f6f9e00771d74dba99e0fee237ebf3f4a69473d57f0dec

C:\Users\Admin\AppData\Roaming\Directory\WindowsDef.txt

MD5 961ad0927901c72bfab5b7be378df88f
SHA1 a7291238e8c4b39c4cbcfb2c7240f3201be4f0c1
SHA256 966c936b44a9e7cd43c7eaa18be65b4cf813ef63caaeb8f412d894349e257bf0
SHA512 175e30df354c6bbdf5fa330aed40ee5cd8d49a48bcd8f3f80e0f6aad4436547dd9fb3b15f494989ee0149d6c805a5e1db5408b2fcc7774aa457fd266e437b8f9

memory/1696-31-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1696-34-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1696-36-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1700-44-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1700-40-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1700-46-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1696-51-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1696-52-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1700-53-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1696-56-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1696-59-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1696-61-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1696-63-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1696-66-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1696-68-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1696-73-0x0000000000400000-0x000000000045C000-memory.dmp