Malware Analysis Report

2025-05-06 00:09

Sample ID 250124-qq5dcszqgs
Target 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe
SHA256 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48
Tags
upx blackshades defense_evasion discovery persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48

Threat Level: Known bad

The file 1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe was found to be: Known bad.

Malicious Activity Summary

upx blackshades defense_evasion discovery persistence rat trojan

Blackshades

Modifies firewall policy service

Blackshades payload

Blackshades family

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Checks whether UAC is enabled

UPX packed file

Suspicious use of SetThreadContext

Drops file in Windows directory

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Program crash

Unsigned PE

Modifies registry key

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-24 13:28

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-24 13:28

Reported

2025-01-24 13:30

Platform

win7-20240903-en

Max time kernel

11s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\javaruntime.exe = "C:\\Windows\\javaruntime.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\winprocess.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winprocess.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\javaruntime.exe N/A
N/A N/A C:\Windows\javaruntime.exe N/A
N/A N/A C:\Windows\javaruntime.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\javaruntime = "C:\\Windows\\javaruntime.exe" C:\Windows\SysWOW64\reg.exe N/A

Checks whether UAC is enabled

defense_evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\javaruntime.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\javaruntime.exe C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe N/A
File opened for modification C:\Windows\javaruntime.exe C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\javaruntime.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\javaruntime.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\javaruntime.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Windows\javaruntime.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: 31 N/A C:\Windows\javaruntime.exe N/A
Token: 32 N/A C:\Windows\javaruntime.exe N/A
Token: 33 N/A C:\Windows\javaruntime.exe N/A
Token: 34 N/A C:\Windows\javaruntime.exe N/A
Token: 35 N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1620 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\svchost.exe
PID 1620 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\svchost.exe
PID 1620 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\svchost.exe
PID 1620 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\svchost.exe
PID 1620 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\svchost.exe
PID 1620 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\svchost.exe
PID 1620 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\svchost.exe
PID 1620 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\svchost.exe
PID 1620 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\svchost.exe
PID 1620 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\svchost.exe
PID 1620 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe
PID 1620 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe
PID 1620 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe
PID 1620 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe
PID 1620 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe
PID 1620 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe
PID 1620 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe
PID 1620 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe
PID 1620 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe
PID 1620 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe
PID 1620 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe
PID 1396 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\cmd.exe
PID 1396 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\cmd.exe
PID 1396 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\cmd.exe
PID 1396 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\cmd.exe
PID 1708 wrote to memory of 1332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1708 wrote to memory of 1332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1708 wrote to memory of 1332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1708 wrote to memory of 1332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1396 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\javaruntime.exe
PID 1396 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\javaruntime.exe
PID 1396 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\javaruntime.exe
PID 1396 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\javaruntime.exe
PID 1396 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\javaruntime.exe
PID 1396 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\javaruntime.exe
PID 1396 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\javaruntime.exe
PID 1852 wrote to memory of 1688 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 1852 wrote to memory of 1688 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 1852 wrote to memory of 1688 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 1852 wrote to memory of 1688 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 1852 wrote to memory of 1688 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 1852 wrote to memory of 1688 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 1852 wrote to memory of 1688 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 1852 wrote to memory of 1688 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 1852 wrote to memory of 1688 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 1852 wrote to memory of 1688 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 1852 wrote to memory of 2104 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 1852 wrote to memory of 2104 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 1852 wrote to memory of 2104 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 1852 wrote to memory of 2104 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 1852 wrote to memory of 2104 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 1852 wrote to memory of 2104 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 1852 wrote to memory of 2104 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 1852 wrote to memory of 2104 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 1852 wrote to memory of 2104 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 1852 wrote to memory of 2104 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 1852 wrote to memory of 2104 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 1852 wrote to memory of 1668 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 1852 wrote to memory of 1668 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 1852 wrote to memory of 1668 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 1852 wrote to memory of 1668 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 1852 wrote to memory of 1668 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 1852 wrote to memory of 1668 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 1852 wrote to memory of 1668 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe

"C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe

"C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\TLAUR.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaruntime" /t REG_SZ /d "C:\Windows\javaruntime.exe" /f

C:\Windows\javaruntime.exe

"C:\Windows\javaruntime.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\javaruntime.exe

"C:\Windows\javaruntime.exe"

C:\Windows\javaruntime.exe

"C:\Windows\javaruntime.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 jadedcolossal.pointto.us udp

Files

memory/1620-0-0x0000000000400000-0x000000000052E000-memory.dmp

memory/1620-3-0x0000000000250000-0x0000000000251000-memory.dmp

memory/1620-25-0x0000000000404000-0x0000000000405000-memory.dmp

memory/1620-15-0x0000000000270000-0x0000000000271000-memory.dmp

memory/1620-5-0x0000000000250000-0x0000000000251000-memory.dmp

memory/1620-28-0x0000000000310000-0x0000000000311000-memory.dmp

memory/1620-40-0x0000000000330000-0x0000000000331000-memory.dmp

memory/1620-60-0x00000000003C0000-0x00000000003C1000-memory.dmp

memory/1620-70-0x00000000003E0000-0x00000000003E1000-memory.dmp

memory/1620-78-0x0000000000530000-0x0000000000532000-memory.dmp

memory/1620-99-0x0000000000400000-0x000000000052E000-memory.dmp

memory/1620-89-0x0000000000560000-0x0000000000561000-memory.dmp

memory/1620-80-0x0000000000400000-0x000000000052E000-memory.dmp

memory/2616-118-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2616-116-0x0000000000400000-0x000000000040C000-memory.dmp

memory/1620-129-0x0000000000400000-0x000000000052E000-memory.dmp

memory/2616-124-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2616-123-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2616-119-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2616-114-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2616-112-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2616-110-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2616-108-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2616-106-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2616-104-0x0000000000400000-0x000000000040C000-memory.dmp

memory/1396-145-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1620-144-0x0000000000400000-0x000000000052E000-memory.dmp

memory/1396-136-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1396-134-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TLAUR.bat

MD5 163f8e838efe1d166ffff7408b814e28
SHA1 52fa0ccba649587e7d24d21d182657078fa6d028
SHA256 dc60287c419225759aa9e1ea0423be4106337dad71aaa0cdc9d55d2b1af3edb7
SHA512 b6685390029555f7d812f0d1a9f138c619555712add3e79c1c90a1a5a0c544e4a86768a626d25c6af3cec09afc0bbaf7f398114e849831bdc5666fc443a1f68d

memory/1396-178-0x0000000003860000-0x000000000398E000-memory.dmp

memory/1396-172-0x0000000003860000-0x000000000398E000-memory.dmp

C:\Windows\javaruntime.exe

MD5 d67986946355c3740ad9e032475594cb
SHA1 6e95136c86dcc683f323e9c020cb7d85a030fda9
SHA256 2e519969d2683217c425d5da89c8005ff9d729e43ec1542fe9a98f7a9eb0aba5
SHA512 75b236183efbfab3e91dfdd9db274624872d765edbbda9c49aa6775f9cf19e87155ac7ac8d82f33b818c809f3a1e209ccfa21229c42584bb1693a413e7b7c00f

memory/1396-180-0x0000000003860000-0x000000000398E000-memory.dmp

memory/1396-179-0x0000000003860000-0x000000000398E000-memory.dmp

memory/2616-182-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2616-185-0x0000000000400000-0x000000000040C000-memory.dmp

memory/1852-291-0x0000000002AF0000-0x0000000002C1E000-memory.dmp

memory/1396-290-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1396-317-0x0000000003860000-0x000000000398E000-memory.dmp

memory/1668-316-0x0000000000400000-0x000000000047B000-memory.dmp

memory/1852-313-0x0000000003250000-0x000000000337E000-memory.dmp

memory/1852-318-0x0000000000400000-0x000000000052E000-memory.dmp

memory/1396-321-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2104-322-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1668-324-0x0000000000400000-0x000000000047B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-24 13:28

Reported

2025-01-24 13:30

Platform

win10v2004-20241007-en

Max time kernel

99s

Max time network

117s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\javaruntime.exe = "C:\\Windows\\javaruntime.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\winprocess.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winprocess.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\javaruntime.exe N/A
N/A N/A C:\Windows\javaruntime.exe N/A
N/A N/A C:\Windows\javaruntime.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\javaruntime = "C:\\Windows\\javaruntime.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\javaruntime.exe C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe N/A
File opened for modification C:\Windows\javaruntime.exe C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\svchost.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\javaruntime.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\javaruntime.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\javaruntime.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Windows\javaruntime.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: 31 N/A C:\Windows\javaruntime.exe N/A
Token: 32 N/A C:\Windows\javaruntime.exe N/A
Token: 33 N/A C:\Windows\javaruntime.exe N/A
Token: 34 N/A C:\Windows\javaruntime.exe N/A
Token: 35 N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1320 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\svchost.exe
PID 1320 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\svchost.exe
PID 1320 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\svchost.exe
PID 1320 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\svchost.exe
PID 1320 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\svchost.exe
PID 1320 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\svchost.exe
PID 1320 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\svchost.exe
PID 1320 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\svchost.exe
PID 1320 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\svchost.exe
PID 1320 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe
PID 1320 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe
PID 1320 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe
PID 1320 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe
PID 1320 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe
PID 1320 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe
PID 1320 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe
PID 1320 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe
PID 2592 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\SysWOW64\cmd.exe
PID 764 wrote to memory of 3084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 764 wrote to memory of 3084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 764 wrote to memory of 3084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2592 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\javaruntime.exe
PID 2592 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\javaruntime.exe
PID 2592 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe C:\Windows\javaruntime.exe
PID 3104 wrote to memory of 4940 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 3104 wrote to memory of 4940 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 3104 wrote to memory of 4940 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 3104 wrote to memory of 4940 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 3104 wrote to memory of 4940 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 3104 wrote to memory of 4940 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 3104 wrote to memory of 4940 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 3104 wrote to memory of 4940 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 3104 wrote to memory of 4940 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 3104 wrote to memory of 948 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3104 wrote to memory of 948 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3104 wrote to memory of 948 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3104 wrote to memory of 948 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3104 wrote to memory of 948 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3104 wrote to memory of 948 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3104 wrote to memory of 948 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3104 wrote to memory of 948 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3104 wrote to memory of 3100 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3104 wrote to memory of 3100 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3104 wrote to memory of 3100 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3104 wrote to memory of 3100 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3104 wrote to memory of 3100 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3104 wrote to memory of 3100 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3104 wrote to memory of 3100 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3104 wrote to memory of 3100 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3100 wrote to memory of 4044 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 3100 wrote to memory of 4044 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 3100 wrote to memory of 4044 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 3100 wrote to memory of 5088 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 3100 wrote to memory of 5088 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 3100 wrote to memory of 5088 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 3100 wrote to memory of 2644 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 3100 wrote to memory of 2644 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 3100 wrote to memory of 2644 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 3100 wrote to memory of 4380 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 3100 wrote to memory of 4380 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 3100 wrote to memory of 4380 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 2644 wrote to memory of 4644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe

"C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4396 -ip 4396

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 156

C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe

"C:\Users\Admin\AppData\Local\Temp\1453106533c9aee57ffcdfaf9bef166ec92786183e7f155af2ab918225e37f48N.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BMROC.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaruntime" /t REG_SZ /d "C:\Windows\javaruntime.exe" /f

C:\Windows\javaruntime.exe

"C:\Windows\javaruntime.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\javaruntime.exe

"C:\Windows\javaruntime.exe"

C:\Windows\javaruntime.exe

"C:\Windows\javaruntime.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 167.173.78.104.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp
US 8.8.8.8:53 9.125.209.23.in-addr.arpa udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp
US 8.8.8.8:53 86.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp

Files

memory/1320-0-0x0000000000400000-0x000000000052E000-memory.dmp

memory/1320-3-0x00000000023E0000-0x00000000023E2000-memory.dmp

memory/1320-4-0x00000000023F0000-0x00000000023F2000-memory.dmp

memory/1320-5-0x0000000002430000-0x0000000002432000-memory.dmp

memory/4396-6-0x0000000000400000-0x000000000040C000-memory.dmp

memory/1320-7-0x0000000002BF0000-0x0000000002BF2000-memory.dmp

memory/1320-8-0x0000000002C10000-0x0000000002C12000-memory.dmp

memory/2592-9-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2592-14-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1320-13-0x0000000000400000-0x000000000052E000-memory.dmp

memory/2592-11-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1320-17-0x0000000000400000-0x000000000052E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BMROC.txt

MD5 163f8e838efe1d166ffff7408b814e28
SHA1 52fa0ccba649587e7d24d21d182657078fa6d028
SHA256 dc60287c419225759aa9e1ea0423be4106337dad71aaa0cdc9d55d2b1af3edb7
SHA512 b6685390029555f7d812f0d1a9f138c619555712add3e79c1c90a1a5a0c544e4a86768a626d25c6af3cec09afc0bbaf7f398114e849831bdc5666fc443a1f68d

C:\Windows\javaruntime.exe

MD5 21c87036df3d518b4eb70507ba37d309
SHA1 a9a99135f73a5bc18b7752811e16c03497623d7a
SHA256 4372ab61658aa6241a62aae29ace95a645827ccce49689c8824a1eb4d5a97af0
SHA512 46f26b72be46a2a97ba514b7d954e1a4b2ceddff5482188f2e991b8c1a10ebff75d498b917261213349be80ab5c239cb24edcc5179cba315ac66d605fefa21ec

memory/3104-41-0x0000000000400000-0x000000000052E000-memory.dmp

memory/3104-42-0x0000000000400000-0x000000000052E000-memory.dmp

memory/4940-43-0x0000000000400000-0x000000000040C000-memory.dmp

memory/4940-46-0x0000000000400000-0x000000000040C000-memory.dmp

memory/4940-50-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3104-51-0x0000000000400000-0x000000000052E000-memory.dmp

memory/2592-49-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4940-45-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3100-59-0x0000000000400000-0x000000000047B000-memory.dmp

memory/3100-61-0x0000000000400000-0x000000000047B000-memory.dmp

memory/3100-63-0x0000000000400000-0x000000000047B000-memory.dmp

memory/3104-66-0x0000000000400000-0x000000000052E000-memory.dmp

memory/2592-70-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4940-72-0x0000000000400000-0x000000000040C000-memory.dmp

memory/948-73-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3100-76-0x0000000000400000-0x000000000047B000-memory.dmp

memory/3100-78-0x0000000000400000-0x000000000047B000-memory.dmp

memory/3100-81-0x0000000000400000-0x000000000047B000-memory.dmp

memory/3100-83-0x0000000000400000-0x000000000047B000-memory.dmp

memory/3100-85-0x0000000000400000-0x000000000047B000-memory.dmp

memory/3100-88-0x0000000000400000-0x000000000047B000-memory.dmp

memory/3100-90-0x0000000000400000-0x000000000047B000-memory.dmp

memory/3100-92-0x0000000000400000-0x000000000047B000-memory.dmp

memory/3100-94-0x0000000000400000-0x000000000047B000-memory.dmp

memory/3100-97-0x0000000000400000-0x000000000047B000-memory.dmp

memory/3100-99-0x0000000000400000-0x000000000047B000-memory.dmp