Analysis
-
max time kernel
99s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2025, 13:28
Behavioral task
behavioral1
Sample
1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe
Resource
win10v2004-20241007-en
General
-
Target
1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe
-
Size
1.2MB
-
MD5
c2248fa5fffaf5f6b205d2d3eab810e0
-
SHA1
44be568fea7f80f646882d84d65e94b0b19cebf5
-
SHA256
1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48
-
SHA512
9eabfc3535a952e7d48924e933ab6d8aff0d148ed2c5954ceb171bfab5bd36070dec6b91189f72adaeb5588c8424e63b0785f0024e15e5ba780dfe089f9ef517
-
SSDEEP
3072:gRRHyoBg8zJRAxuU+N6ET/d9ArfCS3VT62FQwiDefNbaSBVpMQRQ8imgCQIqi/cK:gRhoxrn/vmrqaTh2uMnuPea4g/GcY
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 12 IoCs
resource yara_rule behavioral2/memory/3100-63-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/3100-76-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/3100-78-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/3100-81-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/3100-83-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/3100-85-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/3100-88-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/3100-90-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/3100-92-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/3100-94-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/3100-97-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/3100-99-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\javaruntime.exe = "C:\\Windows\\javaruntime.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\winprocess.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winprocess.exe:*:Enabled:Windows Messanger" reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe -
Executes dropped EXE 3 IoCs
pid Process 3104 javaruntime.exe 948 javaruntime.exe 3100 javaruntime.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\javaruntime = "C:\\Windows\\javaruntime.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 1320 set thread context of 4396 1320 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 84 PID 1320 set thread context of 2592 1320 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 89 PID 3104 set thread context of 4940 3104 javaruntime.exe 101 PID 3104 set thread context of 948 3104 javaruntime.exe 102 PID 3104 set thread context of 3100 3104 javaruntime.exe 104 -
resource yara_rule behavioral2/memory/1320-0-0x0000000000400000-0x000000000052E000-memory.dmp upx behavioral2/memory/2592-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2592-14-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1320-13-0x0000000000400000-0x000000000052E000-memory.dmp upx behavioral2/memory/2592-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1320-17-0x0000000000400000-0x000000000052E000-memory.dmp upx behavioral2/files/0x000a000000023bbc-31.dat upx behavioral2/memory/3104-41-0x0000000000400000-0x000000000052E000-memory.dmp upx behavioral2/memory/3104-42-0x0000000000400000-0x000000000052E000-memory.dmp upx behavioral2/memory/3104-51-0x0000000000400000-0x000000000052E000-memory.dmp upx behavioral2/memory/2592-49-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3100-59-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/3100-61-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/3100-63-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/3104-66-0x0000000000400000-0x000000000052E000-memory.dmp upx behavioral2/memory/2592-70-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/948-73-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3100-76-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/3100-78-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/3100-81-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/3100-83-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/3100-85-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/3100-88-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/3100-90-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/3100-92-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/3100-94-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/3100-97-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/3100-99-0x0000000000400000-0x000000000047B000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\javaruntime.exe 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe File opened for modification C:\Windows\javaruntime.exe 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4292 4396 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaruntime.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaruntime.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaruntime.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 1220 reg.exe 4644 reg.exe 3200 reg.exe 2736 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe 4940 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 1 3100 javaruntime.exe Token: SeCreateTokenPrivilege 3100 javaruntime.exe Token: SeAssignPrimaryTokenPrivilege 3100 javaruntime.exe Token: SeLockMemoryPrivilege 3100 javaruntime.exe Token: SeIncreaseQuotaPrivilege 3100 javaruntime.exe Token: SeMachineAccountPrivilege 3100 javaruntime.exe Token: SeTcbPrivilege 3100 javaruntime.exe Token: SeSecurityPrivilege 3100 javaruntime.exe Token: SeTakeOwnershipPrivilege 3100 javaruntime.exe Token: SeLoadDriverPrivilege 3100 javaruntime.exe Token: SeSystemProfilePrivilege 3100 javaruntime.exe Token: SeSystemtimePrivilege 3100 javaruntime.exe Token: SeProfSingleProcessPrivilege 3100 javaruntime.exe Token: SeIncBasePriorityPrivilege 3100 javaruntime.exe Token: SeCreatePagefilePrivilege 3100 javaruntime.exe Token: SeCreatePermanentPrivilege 3100 javaruntime.exe Token: SeBackupPrivilege 3100 javaruntime.exe Token: SeRestorePrivilege 3100 javaruntime.exe Token: SeShutdownPrivilege 3100 javaruntime.exe Token: SeDebugPrivilege 3100 javaruntime.exe Token: SeAuditPrivilege 3100 javaruntime.exe Token: SeSystemEnvironmentPrivilege 3100 javaruntime.exe Token: SeChangeNotifyPrivilege 3100 javaruntime.exe Token: SeRemoteShutdownPrivilege 3100 javaruntime.exe Token: SeUndockPrivilege 3100 javaruntime.exe Token: SeSyncAgentPrivilege 3100 javaruntime.exe Token: SeEnableDelegationPrivilege 3100 javaruntime.exe Token: SeManageVolumePrivilege 3100 javaruntime.exe Token: SeImpersonatePrivilege 3100 javaruntime.exe Token: SeCreateGlobalPrivilege 3100 javaruntime.exe Token: 31 3100 javaruntime.exe Token: 32 3100 javaruntime.exe Token: 33 3100 javaruntime.exe Token: 34 3100 javaruntime.exe Token: 35 3100 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe Token: SeDebugPrivilege 948 javaruntime.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1320 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 2592 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 3104 javaruntime.exe 3104 javaruntime.exe 4940 svchost.exe 948 javaruntime.exe 3100 javaruntime.exe 3100 javaruntime.exe 3100 javaruntime.exe 3100 javaruntime.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1320 wrote to memory of 4396 1320 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 84 PID 1320 wrote to memory of 4396 1320 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 84 PID 1320 wrote to memory of 4396 1320 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 84 PID 1320 wrote to memory of 4396 1320 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 84 PID 1320 wrote to memory of 4396 1320 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 84 PID 1320 wrote to memory of 4396 1320 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 84 PID 1320 wrote to memory of 4396 1320 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 84 PID 1320 wrote to memory of 4396 1320 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 84 PID 1320 wrote to memory of 4396 1320 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 84 PID 1320 wrote to memory of 2592 1320 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 89 PID 1320 wrote to memory of 2592 1320 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 89 PID 1320 wrote to memory of 2592 1320 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 89 PID 1320 wrote to memory of 2592 1320 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 89 PID 1320 wrote to memory of 2592 1320 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 89 PID 1320 wrote to memory of 2592 1320 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 89 PID 1320 wrote to memory of 2592 1320 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 89 PID 1320 wrote to memory of 2592 1320 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 89 PID 2592 wrote to memory of 764 2592 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 92 PID 2592 wrote to memory of 764 2592 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 92 PID 2592 wrote to memory of 764 2592 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 92 PID 764 wrote to memory of 3084 764 cmd.exe 96 PID 764 wrote to memory of 3084 764 cmd.exe 96 PID 764 wrote to memory of 3084 764 cmd.exe 96 PID 2592 wrote to memory of 3104 2592 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 97 PID 2592 wrote to memory of 3104 2592 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 97 PID 2592 wrote to memory of 3104 2592 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe 97 PID 3104 wrote to memory of 4940 3104 javaruntime.exe 101 PID 3104 wrote to memory of 4940 3104 javaruntime.exe 101 PID 3104 wrote to memory of 4940 3104 javaruntime.exe 101 PID 3104 wrote to memory of 4940 3104 javaruntime.exe 101 PID 3104 wrote to memory of 4940 3104 javaruntime.exe 101 PID 3104 wrote to memory of 4940 3104 javaruntime.exe 101 PID 3104 wrote to memory of 4940 3104 javaruntime.exe 101 PID 3104 wrote to memory of 4940 3104 javaruntime.exe 101 PID 3104 wrote to memory of 4940 3104 javaruntime.exe 101 PID 3104 wrote to memory of 948 3104 javaruntime.exe 102 PID 3104 wrote to memory of 948 3104 javaruntime.exe 102 PID 3104 wrote to memory of 948 3104 javaruntime.exe 102 PID 3104 wrote to memory of 948 3104 javaruntime.exe 102 PID 3104 wrote to memory of 948 3104 javaruntime.exe 102 PID 3104 wrote to memory of 948 3104 javaruntime.exe 102 PID 3104 wrote to memory of 948 3104 javaruntime.exe 102 PID 3104 wrote to memory of 948 3104 javaruntime.exe 102 PID 3104 wrote to memory of 3100 3104 javaruntime.exe 104 PID 3104 wrote to memory of 3100 3104 javaruntime.exe 104 PID 3104 wrote to memory of 3100 3104 javaruntime.exe 104 PID 3104 wrote to memory of 3100 3104 javaruntime.exe 104 PID 3104 wrote to memory of 3100 3104 javaruntime.exe 104 PID 3104 wrote to memory of 3100 3104 javaruntime.exe 104 PID 3104 wrote to memory of 3100 3104 javaruntime.exe 104 PID 3104 wrote to memory of 3100 3104 javaruntime.exe 104 PID 3100 wrote to memory of 4044 3100 javaruntime.exe 105 PID 3100 wrote to memory of 4044 3100 javaruntime.exe 105 PID 3100 wrote to memory of 4044 3100 javaruntime.exe 105 PID 3100 wrote to memory of 5088 3100 javaruntime.exe 106 PID 3100 wrote to memory of 5088 3100 javaruntime.exe 106 PID 3100 wrote to memory of 5088 3100 javaruntime.exe 106 PID 3100 wrote to memory of 2644 3100 javaruntime.exe 107 PID 3100 wrote to memory of 2644 3100 javaruntime.exe 107 PID 3100 wrote to memory of 2644 3100 javaruntime.exe 107 PID 3100 wrote to memory of 4380 3100 javaruntime.exe 108 PID 3100 wrote to memory of 4380 3100 javaruntime.exe 108 PID 3100 wrote to memory of 4380 3100 javaruntime.exe 108 PID 2644 wrote to memory of 4644 2644 cmd.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe"C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵PID:4396
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 1563⤵
- Program crash
PID:4292
-
-
-
C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe"C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe"2⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BMROC.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaruntime" /t REG_SZ /d "C:\Windows\javaruntime.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3084
-
-
-
C:\Windows\javaruntime.exe"C:\Windows\javaruntime.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4940
-
-
C:\Windows\javaruntime.exe"C:\Windows\javaruntime.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:948
-
-
C:\Windows\javaruntime.exe"C:\Windows\javaruntime.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- System Location Discovery: System Language Discovery
PID:4044 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3200
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f5⤵
- System Location Discovery: System Language Discovery
PID:5088 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f6⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1220
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4644
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f5⤵
- System Location Discovery: System Language Discovery
PID:4380 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f6⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2736
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4396 -ip 43961⤵PID:4836
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124B
MD5163f8e838efe1d166ffff7408b814e28
SHA152fa0ccba649587e7d24d21d182657078fa6d028
SHA256dc60287c419225759aa9e1ea0423be4106337dad71aaa0cdc9d55d2b1af3edb7
SHA512b6685390029555f7d812f0d1a9f138c619555712add3e79c1c90a1a5a0c544e4a86768a626d25c6af3cec09afc0bbaf7f398114e849831bdc5666fc443a1f68d
-
Filesize
1.2MB
MD521c87036df3d518b4eb70507ba37d309
SHA1a9a99135f73a5bc18b7752811e16c03497623d7a
SHA2564372ab61658aa6241a62aae29ace95a645827ccce49689c8824a1eb4d5a97af0
SHA51246f26b72be46a2a97ba514b7d954e1a4b2ceddff5482188f2e991b8c1a10ebff75d498b917261213349be80ab5c239cb24edcc5179cba315ac66d605fefa21ec