blackshades | 24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91

Analysis

max time kernel
119s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe
Size

3.1MB
MD5

71f261fe0ab0cca422bc60d71e18fdaf
SHA1

f37118da5d843ff34beef2870f6cfd9965f7d50e
SHA256

24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91
SHA512

eabc35e19b96c6655d76703e8a9fb469508c26d124acec99fee819e449b7c55a5c8025f9c1a215f06977eece8b8e6843039a1dae24a81904e21dcd32ec0695e6
SSDEEP

24576:yKGLlxj3f/tXkbAivCy+u2QXQJLWw/GBQyVQVz81:y//tXvuKW7QV2

Score

10^/10

blackshades defense_evasion discovery persistence rat trojan upx

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 11 IoCs

resource	yara_rule
behavioral2/memory/4912-57-0x0000000000400000-0x0000000000459000-memory.dmp	family_blackshades
behavioral2/memory/4912-55-0x0000000000400000-0x0000000000459000-memory.dmp	family_blackshades
behavioral2/memory/4912-69-0x0000000000400000-0x0000000000459000-memory.dmp	family_blackshades
behavioral2/memory/4912-71-0x0000000000400000-0x0000000000459000-memory.dmp	family_blackshades
behavioral2/memory/4912-74-0x0000000000400000-0x0000000000459000-memory.dmp	family_blackshades
behavioral2/memory/4912-76-0x0000000000400000-0x0000000000459000-memory.dmp	family_blackshades
behavioral2/memory/4912-81-0x0000000000400000-0x0000000000459000-memory.dmp	family_blackshades
behavioral2/memory/4912-83-0x0000000000400000-0x0000000000459000-memory.dmp	family_blackshades
behavioral2/memory/4912-85-0x0000000000400000-0x0000000000459000-memory.dmp	family_blackshades
behavioral2/memory/4912-88-0x0000000000400000-0x0000000000459000-memory.dmp	family_blackshades
behavioral2/memory/4912-92-0x0000000000400000-0x0000000000459000-memory.dmp	family_blackshades

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe, C:\\Windows\\msconfig32\\msconfig32.exe"	reg.exe

Modifies firewall policy service 3 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\msconfig32\msconfig32.exe = "C:\\Windows\\msconfig32\\msconfig32.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\lsoss32.exe = "C:\\Users\\Admin\\AppData\\Roaming\\lsoss32.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	msconfig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\winupdt32 = "C:\\Users\\Admin\\AppData\\Roaming\\lsoss32.exe"	msconfig32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe

Executes dropped EXE 3 IoCs

pid	Process
4356	msconfig32.exe
4912	msconfig32.exe
2648	msconfig32.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msconfig32 = "C:\\Windows\\msconfig32\\msconfig32.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winupdt32 = "C:\\Users\\Admin\\AppData\\Roaming\\lsoss32.exe"	msconfig32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdt32 = "C:\\Users\\Admin\\AppData\\Roaming\\lsoss32.exe"	msconfig32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msconfig32 = "C:\\Windows\\msconfig32\\msconfig32.exe"	reg.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msconfig32.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4356 set thread context of 4912	4356	msconfig32.exe	98
PID 4356 set thread context of 2648	4356	msconfig32.exe	99

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2648-60-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/2648-64-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/2648-63-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/2648-70-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\msconfig32\msconfig32.txt	24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe
File opened for modification	C:\Windows\msconfig32\msconfig32.txt	24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe
File created	C:\Windows\msconfig32\msconfig32.exe	24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe
File opened for modification	C:\Windows\msconfig32\msconfig32.exe	msconfig32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msconfig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msconfig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msconfig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
2336	reg.exe
2112	reg.exe
1780	reg.exe
1796	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: 1	4912	msconfig32.exe
Token: SeCreateTokenPrivilege	4912	msconfig32.exe
Token: SeAssignPrimaryTokenPrivilege	4912	msconfig32.exe
Token: SeLockMemoryPrivilege	4912	msconfig32.exe
Token: SeIncreaseQuotaPrivilege	4912	msconfig32.exe
Token: SeMachineAccountPrivilege	4912	msconfig32.exe
Token: SeTcbPrivilege	4912	msconfig32.exe
Token: SeSecurityPrivilege	4912	msconfig32.exe
Token: SeTakeOwnershipPrivilege	4912	msconfig32.exe
Token: SeLoadDriverPrivilege	4912	msconfig32.exe
Token: SeSystemProfilePrivilege	4912	msconfig32.exe
Token: SeSystemtimePrivilege	4912	msconfig32.exe
Token: SeProfSingleProcessPrivilege	4912	msconfig32.exe
Token: SeIncBasePriorityPrivilege	4912	msconfig32.exe
Token: SeCreatePagefilePrivilege	4912	msconfig32.exe
Token: SeCreatePermanentPrivilege	4912	msconfig32.exe
Token: SeBackupPrivilege	4912	msconfig32.exe
Token: SeRestorePrivilege	4912	msconfig32.exe
Token: SeShutdownPrivilege	4912	msconfig32.exe
Token: SeDebugPrivilege	4912	msconfig32.exe
Token: SeAuditPrivilege	4912	msconfig32.exe
Token: SeSystemEnvironmentPrivilege	4912	msconfig32.exe
Token: SeChangeNotifyPrivilege	4912	msconfig32.exe
Token: SeRemoteShutdownPrivilege	4912	msconfig32.exe
Token: SeUndockPrivilege	4912	msconfig32.exe
Token: SeSyncAgentPrivilege	4912	msconfig32.exe
Token: SeEnableDelegationPrivilege	4912	msconfig32.exe
Token: SeManageVolumePrivilege	4912	msconfig32.exe
Token: SeImpersonatePrivilege	4912	msconfig32.exe
Token: SeCreateGlobalPrivilege	4912	msconfig32.exe
Token: 31	4912	msconfig32.exe
Token: 32	4912	msconfig32.exe
Token: 33	4912	msconfig32.exe
Token: 34	4912	msconfig32.exe
Token: 35	4912	msconfig32.exe
Token: SeDebugPrivilege	2648	msconfig32.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4768	24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe
4356	msconfig32.exe
4356	msconfig32.exe
4912	msconfig32.exe
4912	msconfig32.exe
4912	msconfig32.exe
2648	msconfig32.exe
2648	msconfig32.exe
4912	msconfig32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 3680	4768	24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe	83
PID 4768 wrote to memory of 3680	4768	24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe	83
PID 4768 wrote to memory of 3680	4768	24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe	83
PID 3680 wrote to memory of 1416	3680	cmd.exe	86
PID 3680 wrote to memory of 1416	3680	cmd.exe	86
PID 3680 wrote to memory of 1416	3680	cmd.exe	86
PID 3680 wrote to memory of 1860	3680	cmd.exe	87
PID 3680 wrote to memory of 1860	3680	cmd.exe	87
PID 3680 wrote to memory of 1860	3680	cmd.exe	87
PID 4768 wrote to memory of 912	4768	24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe	88
PID 4768 wrote to memory of 912	4768	24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe	88
PID 4768 wrote to memory of 912	4768	24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe	88
PID 912 wrote to memory of 2608	912	cmd.exe	90
PID 912 wrote to memory of 2608	912	cmd.exe	90
PID 912 wrote to memory of 2608	912	cmd.exe	90
PID 4768 wrote to memory of 2260	4768	24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe	91
PID 4768 wrote to memory of 2260	4768	24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe	91
PID 4768 wrote to memory of 2260	4768	24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe	91
PID 2260 wrote to memory of 4696	2260	cmd.exe	93
PID 2260 wrote to memory of 4696	2260	cmd.exe	93
PID 2260 wrote to memory of 4696	2260	cmd.exe	93
PID 4768 wrote to memory of 2328	4768	24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe	94
PID 4768 wrote to memory of 2328	4768	24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe	94
PID 4768 wrote to memory of 2328	4768	24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe	94
PID 2328 wrote to memory of 5084	2328	cmd.exe	96
PID 2328 wrote to memory of 5084	2328	cmd.exe	96
PID 2328 wrote to memory of 5084	2328	cmd.exe	96
PID 4768 wrote to memory of 4356	4768	24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe	97
PID 4768 wrote to memory of 4356	4768	24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe	97
PID 4768 wrote to memory of 4356	4768	24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe	97
PID 4356 wrote to memory of 4912	4356	msconfig32.exe	98
PID 4356 wrote to memory of 4912	4356	msconfig32.exe	98
PID 4356 wrote to memory of 4912	4356	msconfig32.exe	98
PID 4356 wrote to memory of 4912	4356	msconfig32.exe	98
PID 4356 wrote to memory of 4912	4356	msconfig32.exe	98
PID 4356 wrote to memory of 4912	4356	msconfig32.exe	98
PID 4356 wrote to memory of 4912	4356	msconfig32.exe	98
PID 4356 wrote to memory of 4912	4356	msconfig32.exe	98
PID 4356 wrote to memory of 2648	4356	msconfig32.exe	99
PID 4356 wrote to memory of 2648	4356	msconfig32.exe	99
PID 4356 wrote to memory of 2648	4356	msconfig32.exe	99
PID 4356 wrote to memory of 2648	4356	msconfig32.exe	99
PID 4356 wrote to memory of 2648	4356	msconfig32.exe	99
PID 4356 wrote to memory of 2648	4356	msconfig32.exe	99
PID 4356 wrote to memory of 2648	4356	msconfig32.exe	99
PID 4356 wrote to memory of 2648	4356	msconfig32.exe	99
PID 4912 wrote to memory of 3272	4912	msconfig32.exe	100
PID 4912 wrote to memory of 3272	4912	msconfig32.exe	100
PID 4912 wrote to memory of 3272	4912	msconfig32.exe	100
PID 4912 wrote to memory of 2880	4912	msconfig32.exe	101
PID 4912 wrote to memory of 2880	4912	msconfig32.exe	101
PID 4912 wrote to memory of 2880	4912	msconfig32.exe	101
PID 4912 wrote to memory of 2920	4912	msconfig32.exe	103
PID 4912 wrote to memory of 2920	4912	msconfig32.exe	103
PID 4912 wrote to memory of 2920	4912	msconfig32.exe	103
PID 4912 wrote to memory of 4208	4912	msconfig32.exe	104
PID 4912 wrote to memory of 4208	4912	msconfig32.exe	104
PID 4912 wrote to memory of 4208	4912	msconfig32.exe	104
PID 2880 wrote to memory of 1796	2880	cmd.exe	108
PID 2880 wrote to memory of 1796	2880	cmd.exe	108
PID 2880 wrote to memory of 1796	2880	cmd.exe	108
PID 2920 wrote to memory of 1780	2920	cmd.exe	109
PID 2920 wrote to memory of 1780	2920	cmd.exe	109
PID 2920 wrote to memory of 1780	2920	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe
"C:\Users\Admin\AppData\Local\Temp\24217d63742343a17b813350bfdcc0dccd91be2ed9a65d9ca0e0415065fe8d91.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZOPLXA.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center /v UACDisableNotify /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1416
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - System Location Discovery: System Language Discovery
    PID:1860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gTSnr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "msconfig32" /t REG_SZ /d "C:\Windows\msconfig32\msconfig32.exe" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BAxhZ.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "msconfig32" /t REG_SZ /d "C:\Windows\msconfig32\msconfig32.exe" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\leHdB.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "Explorer.exe, C:\Windows\msconfig32\msconfig32.exe" /f
    3⤵
    - Modifies WinLogon for persistence
    - System Location Discovery: System Language Discovery
    PID:5084
- C:\Windows\msconfig32\msconfig32.exe
  "C:\Windows\msconfig32\msconfig32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\msconfig32\msconfig32.exe
    C:\Windows\msconfig32\msconfig32.exe
    3⤵
    - Adds policy Run key to start application
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3272
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2336
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\msconfig32\msconfig32.exe" /t REG_SZ /d "C:\Windows\msconfig32\msconfig32.exe:*:Enabled:Windows Messanger" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2880
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\msconfig32\msconfig32.exe" /t REG_SZ /d "C:\Windows\msconfig32\msconfig32.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1796
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2920
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1780
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\lsoss32.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\lsoss32.exe:*:Enabled:Windows Messanger" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4208
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\lsoss32.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\lsoss32.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2112
- - C:\Windows\msconfig32\msconfig32.exe
    C:\Windows\msconfig32\msconfig32.exe
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BAxhZ.bat

Filesize
133B

MD5
5c5f6bd3f5ab15437a8d5a452f236cc7

SHA1
43dc4c4bcee42f7975f0027e2734c57115e5d7ce

SHA256
8f96e1c2750dc729faf255eb4df3f1e501d3394d8043f69dc56036a03b9ed947

SHA512
eed35f38654e1c5b4c1ea010f93d6be03250b77bd0e6f79ce12aaaa7333b9346afbd328f4de21e3fa6948d252cb9203a8bd103e0058c129d3130e7399e18b08f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZOPLXA.txt

Filesize
255B

MD5
180e420d8578c4341546b0f2676f52c5

SHA1
3683c541fe1ad96c37fcfa91f3d819f2c43ccf84

SHA256
27bad6b003d19c5063cfc49ee5828c5ebb82659ee5c89ed2df20ae1c4917ba28

SHA512
5bbcdd40178a399dd4e879e39328824c47edc39a040b7d1eed90368bbdab0d51d9cb187357cc3a223ed22086ff650c10f3841fc9bb50469eb9a72ca343c77ed9

Download Submit
C:\Users\Admin\AppData\Local\Temp\gTSnr.bat

Filesize
133B

MD5
4e99d945ca61ed0b261a73d985f5420e

SHA1
ce08b5c3939572703ae753bfa72c0224400d7bb2

SHA256
ddcc7514a0ca6c4c261d55a5c818136cb6035676d1a56dbb224734c5db1a3064

SHA512
988b5bab81311ca5efd773fdd8c872173b42bebce79467615c7ad5ffdb3a0f670300b1d39ab86f62b2a6bea2aa140abfaca211b2c868c4a412a6d5a4c4a8fb8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\leHdB.bat

Filesize
164B

MD5
0af5f35091719d8ee61893a158b66625

SHA1
1f81728601f8714bfa7e2ca92f9d6a8f6aa89700

SHA256
ceac3aee5e97d760c72b18d62c3dfc7d73904366e230c2362c49e8ed700d46f9

SHA512
f01c7ecbb9682c2469628f7d1c7e38891b1b9352a27eed50e3597b281fc136f18a6deb4ca04843f632cce295dd8f194ff8c37d31d7167a7a25734d0789bf9baa

Download Submit
C:\Windows\msconfig32\msconfig32.txt

Filesize
3.1MB

MD5
d7a03d5cfe207d957a0e0cdb7d7f5eca

SHA1
7f9bbbe09544241131e7bcd233bc5fb60e508c83

SHA256
7c262ae85c7be87a4345427fa2d9717737b63165003501bf98bc490b866a429f

SHA512
ce2676358c4dc39f0d86e020bb4287ef5cf5302c14f3cb94accbc2ef83e06ed102d02f65c3f4a1d8c1b731a79909759178ae2f9489815636669265a67f201053

Download Submit
memory/2648-63-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2648-70-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2648-64-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2648-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4768-0-0x0000000000400000-0x0000000000723000-memory.dmp

Filesize
3.1MB

Download
memory/4912-55-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4912-69-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4912-57-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4912-71-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4912-74-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4912-76-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4912-81-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4912-83-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4912-85-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4912-88-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4912-92-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads