Malware Analysis Report

2025-05-06 00:16

Sample ID 250124-j174nsylfv
Target 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe
SHA256 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971
Tags
blackshades defense_evasion discovery persistence rat upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971

Threat Level: Known bad

The file 72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe was found to be: Known bad.

Malicious Activity Summary

blackshades defense_evasion discovery persistence rat upx

Blackshades payload

Blackshades

Blackshades family

Modifies firewall policy service

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

UPX packed file

Suspicious use of SetThreadContext

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies registry key

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-24 08:09

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-24 08:09

Reported

2025-01-24 08:11

Platform

win7-20240903-en

Max time kernel

120s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe = "C:\\Users\\Admin\\AppData\\Roaming\\darkeye-nosttingspersistent.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Firefox.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java Updater 3 = "C:\\Users\\Admin\\AppData\\Roaming\\Firefox.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2020 set thread context of 2388 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2020 set thread context of 2872 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2772 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe C:\Windows\SysWOW64\cmd.exe
PID 2668 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2668 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2668 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2668 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2772 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2772 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2772 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2772 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2020 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2020 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2020 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2020 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2020 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2020 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2020 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2020 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2020 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2020 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2020 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2020 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2020 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2020 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2020 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2020 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2020 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2020 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 2388 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 2388 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 2388 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 2388 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 2388 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 2388 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 2388 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 2388 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 2388 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 2388 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 2388 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 2388 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 2388 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 2388 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 2388 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 2388 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 2184 wrote to memory of 2888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2184 wrote to memory of 2888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2184 wrote to memory of 2888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2184 wrote to memory of 2888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2044 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2044 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2044 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2044 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2396 wrote to memory of 2860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2396 wrote to memory of 2860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2396 wrote to memory of 2860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2396 wrote to memory of 2860 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1840 wrote to memory of 692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1840 wrote to memory of 692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1840 wrote to memory of 692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1840 wrote to memory of 692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe

"C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\hIYgD.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java Updater 3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Firefox.exe" /f

C:\Users\Admin\AppData\Roaming\Firefox.exe

"C:\Users\Admin\AppData\Roaming\Firefox.exe"

C:\Users\Admin\AppData\Roaming\Firefox.exe

C:\Users\Admin\AppData\Roaming\Firefox.exe

C:\Users\Admin\AppData\Roaming\Firefox.exe

C:\Users\Admin\AppData\Roaming\Firefox.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Firefox.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Firefox.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Firefox.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Firefox.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 soukchayt2.no-ip.org udp

Files

memory/2772-0-0x0000000000400000-0x00000000005CF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\hIYgD.bat

MD5 962bc493b87f298696ad6e3eed7c7937
SHA1 985cc0c7e37e2465c4349abd528e120663ebd205
SHA256 c167e2faa5307ac291ff833b8a1f5f802eaa028d1aba8d1ad342ca84c07bdb01
SHA512 9dd2b755a404b74206b713ab17d2ddedacc48910e942dab71cf7e98d8d25322c24e32648f0881136e5425134aaccfbfd9bdc52ceb4519bd07e97c5564116f173

C:\Users\Admin\AppData\Roaming\Firefox.exe

MD5 a51d5beec038b8fa4f03a66a29e3123a
SHA1 48b6460532877476160c4a3f9b08a8f1e27e4252
SHA256 ee1eeb331a91b17f8f66cda516f32740a3d7d9ebf93f3f5f911885697fdb86b8
SHA512 704bf033c66632c1510ce3c66d6d0bf3a3cc13987e4a0b46f30a8b9ab1567d8af49f666dbad8c77a8c56d71f1c593189af2e47416b1eb585436b208835295fc9

memory/2388-48-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2872-61-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2872-58-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2388-54-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2388-51-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2872-63-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2872-66-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2872-62-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2388-69-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2872-70-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2388-71-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2388-73-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2388-76-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2388-78-0x0000000000400000-0x000000000045D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-24 08:09

Reported

2025-01-24 08:11

Platform

win10v2004-20241007-en

Max time kernel

119s

Max time network

108s

Command Line

"C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe = "C:\\Users\\Admin\\AppData\\Roaming\\darkeye-nosttingspersistent.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Firefox.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Updater 3 = "C:\\Users\\Admin\\AppData\\Roaming\\Firefox.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3424 set thread context of 4524 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 3424 set thread context of 2772 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Firefox.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4760 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe C:\Windows\SysWOW64\cmd.exe
PID 4760 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe C:\Windows\SysWOW64\cmd.exe
PID 4760 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe C:\Windows\SysWOW64\cmd.exe
PID 1120 wrote to memory of 5000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1120 wrote to memory of 5000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1120 wrote to memory of 5000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4760 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 4760 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 4760 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 3424 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 3424 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 3424 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 3424 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 3424 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 3424 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 3424 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 3424 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 3424 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 3424 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 3424 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 3424 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 3424 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 3424 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 3424 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 3424 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Users\Admin\AppData\Roaming\Firefox.exe
PID 4524 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 4524 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 4524 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 4524 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 4524 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 4524 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 4524 wrote to memory of 684 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 4524 wrote to memory of 684 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 4524 wrote to memory of 684 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 4524 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 4524 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 4524 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Roaming\Firefox.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 3888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2460 wrote to memory of 3888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2460 wrote to memory of 3888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 684 wrote to memory of 2968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 684 wrote to memory of 2968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 684 wrote to memory of 2968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1112 wrote to memory of 3056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1112 wrote to memory of 3056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1112 wrote to memory of 3056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2028 wrote to memory of 4128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2028 wrote to memory of 4128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2028 wrote to memory of 4128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe

"C:\Users\Admin\AppData\Local\Temp\72263eaacd57cd4ce54e72f35515f421ba21264f44c4225d5ac1f86e02fea971.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Mkdsu.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java Updater 3" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Firefox.exe" /f

C:\Users\Admin\AppData\Roaming\Firefox.exe

"C:\Users\Admin\AppData\Roaming\Firefox.exe"

C:\Users\Admin\AppData\Roaming\Firefox.exe

C:\Users\Admin\AppData\Roaming\Firefox.exe

C:\Users\Admin\AppData\Roaming\Firefox.exe

C:\Users\Admin\AppData\Roaming\Firefox.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Firefox.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Firefox.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Firefox.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Firefox.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 167.173.78.104.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 136.50.22.2.in-addr.arpa udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 178.153.247.72.in-addr.arpa udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp

Files

memory/4760-0-0x0000000000400000-0x00000000005CF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Mkdsu.txt

MD5 962bc493b87f298696ad6e3eed7c7937
SHA1 985cc0c7e37e2465c4349abd528e120663ebd205
SHA256 c167e2faa5307ac291ff833b8a1f5f802eaa028d1aba8d1ad342ca84c07bdb01
SHA512 9dd2b755a404b74206b713ab17d2ddedacc48910e942dab71cf7e98d8d25322c24e32648f0881136e5425134aaccfbfd9bdc52ceb4519bd07e97c5564116f173

C:\Users\Admin\AppData\Roaming\Firefox.txt

MD5 cbfa13fc592d091e803ec16a51ad32fc
SHA1 dac8f4f3fcd4b11570bfc472aa7386699fad6ed5
SHA256 923a79db974983f16a99ed664ec4853e604508fbc2f2f5976d4eb588b5b4f344
SHA512 aeac78c3b3b6595f414a8934b857f5cd8c4f2b3d090c6ffc5d739e57beb9648b4275306ac2ad2029903cb10ebd5b83a591a0a075bc3ca14c057c61b1997b48ff

memory/4524-31-0x0000000000400000-0x000000000045D000-memory.dmp

memory/4524-34-0x0000000000400000-0x000000000045D000-memory.dmp

memory/4524-36-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2772-38-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2772-42-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2772-45-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4524-50-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2772-51-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4524-52-0x0000000000400000-0x000000000045D000-memory.dmp

memory/4524-54-0x0000000000400000-0x000000000045D000-memory.dmp

memory/4524-57-0x0000000000400000-0x000000000045D000-memory.dmp

memory/4524-59-0x0000000000400000-0x000000000045D000-memory.dmp

memory/4524-75-0x0000000000400000-0x000000000045D000-memory.dmp