blackshades | 22a7ae8d819204ec2cd27a5e53f5e267c7829776eb3064b95bc6f253e72a1157

Analysis

max time kernel
150s
max time network
141s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
26-01-2025 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_31c0d45df9c966ad7e11ab233078607e.exe
Size

233KB
MD5

31c0d45df9c966ad7e11ab233078607e
SHA1

ead2ce24fbf87bebad55500604557bf9ac4d2ddf
SHA256

22a7ae8d819204ec2cd27a5e53f5e267c7829776eb3064b95bc6f253e72a1157
SHA512

bd99241deae5815117fd8725b105006238a6980d65a3f1115d1d107ff66fa5abf6ef122db3fc65910e47087b4b0c21b51fc9bcf35c5a8de12fbc1cfb3b0f0df8
SSDEEP

6144:OTu5OUFQPwNcHEOHA6ekznVuf5e9LoZgYuyY:EuzmO2hA6pncOoZgv

Score

10^/10

blackshades hawkeye defense_evasion discovery keylogger persistence rat spyware stealer trojan upx

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 3 IoCs

resource	yara_rule
behavioral1/memory/2892-37-0x0000000000400000-0x0000000000473000-memory.dmp	family_blackshades
behavioral1/memory/2892-36-0x0000000000400000-0x0000000000473000-memory.dmp	family_blackshades
behavioral1/memory/2892-72-0x0000000000400000-0x0000000000473000-memory.dmp	family_blackshades

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Hawkeye family
hawkeye

Modifies firewall policy service 3 TTPs 8 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\U5P8P5076W.exe = "C:\\Users\\Admin\\AppData\\Roaming\\U5P8P5076W.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe

Deletes itself 1 IoCs

pid	Process
1712	explorer.exe

Executes dropped EXE 3 IoCs

pid	Process
1712	explorer.exe
2224	nvxdsinc.exe
1692	nwtray.exe

Loads dropped DLL 6 IoCs

pid	Process
2592	JaffaCakes118_31c0d45df9c966ad7e11ab233078607e.exe
2592	JaffaCakes118_31c0d45df9c966ad7e11ab233078607e.exe
1712	explorer.exe
1712	explorer.exe
2224	nvxdsinc.exe
2224	nvxdsinc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\nvxdsinc.exe"	nvxdsinc.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1712 set thread context of 2892	1712	explorer.exe	31
PID 1692 set thread context of 576	1692	nwtray.exe	46

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2892-31-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2892-33-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2892-27-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2892-25-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2892-37-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2892-36-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2892-35-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/2892-72-0x0000000000400000-0x0000000000473000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nwtray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_31c0d45df9c966ad7e11ab233078607e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nvxdsinc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
2332	reg.exe
2264	reg.exe
2728	reg.exe
572	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1712	explorer.exe
2224	nvxdsinc.exe
1692	nwtray.exe
1712	explorer.exe
2224	nvxdsinc.exe
1692	nwtray.exe
1712	explorer.exe
2224	nvxdsinc.exe
1692	nwtray.exe
1712	explorer.exe
2224	nvxdsinc.exe
1692	nwtray.exe
1712	explorer.exe
2224	nvxdsinc.exe
1692	nwtray.exe
1712	explorer.exe
2224	nvxdsinc.exe
1692	nwtray.exe
1712	explorer.exe
2224	nvxdsinc.exe
1692	nwtray.exe
1712	explorer.exe
2224	nvxdsinc.exe
1692	nwtray.exe
1712	explorer.exe
2224	nvxdsinc.exe
1692	nwtray.exe
1712	explorer.exe
2224	nvxdsinc.exe
1692	nwtray.exe
1712	explorer.exe
2224	nvxdsinc.exe
1692	nwtray.exe
1712	explorer.exe
2224	nvxdsinc.exe
1692	nwtray.exe
1712	explorer.exe
2224	nvxdsinc.exe
1692	nwtray.exe
1712	explorer.exe
2224	nvxdsinc.exe
1692	nwtray.exe
1712	explorer.exe
2224	nvxdsinc.exe
1692	nwtray.exe
1712	explorer.exe
2224	nvxdsinc.exe
1692	nwtray.exe
1712	explorer.exe
2224	nvxdsinc.exe
1692	nwtray.exe
1712	explorer.exe
2224	nvxdsinc.exe
1692	nwtray.exe
1712	explorer.exe
2224	nvxdsinc.exe
1692	nwtray.exe
1712	explorer.exe
2224	nvxdsinc.exe
1692	nwtray.exe
1712	explorer.exe
2224	nvxdsinc.exe
1692	nwtray.exe
1712	explorer.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeDebugPrivilege	2592	JaffaCakes118_31c0d45df9c966ad7e11ab233078607e.exe
Token: SeDebugPrivilege	1712	explorer.exe
Token: 1	2892	AppLaunch.exe
Token: SeCreateTokenPrivilege	2892	AppLaunch.exe
Token: SeAssignPrimaryTokenPrivilege	2892	AppLaunch.exe
Token: SeLockMemoryPrivilege	2892	AppLaunch.exe
Token: SeIncreaseQuotaPrivilege	2892	AppLaunch.exe
Token: SeMachineAccountPrivilege	2892	AppLaunch.exe
Token: SeTcbPrivilege	2892	AppLaunch.exe
Token: SeSecurityPrivilege	2892	AppLaunch.exe
Token: SeTakeOwnershipPrivilege	2892	AppLaunch.exe
Token: SeLoadDriverPrivilege	2892	AppLaunch.exe
Token: SeSystemProfilePrivilege	2892	AppLaunch.exe
Token: SeSystemtimePrivilege	2892	AppLaunch.exe
Token: SeProfSingleProcessPrivilege	2892	AppLaunch.exe
Token: SeIncBasePriorityPrivilege	2892	AppLaunch.exe
Token: SeCreatePagefilePrivilege	2892	AppLaunch.exe
Token: SeCreatePermanentPrivilege	2892	AppLaunch.exe
Token: SeBackupPrivilege	2892	AppLaunch.exe
Token: SeRestorePrivilege	2892	AppLaunch.exe
Token: SeShutdownPrivilege	2892	AppLaunch.exe
Token: SeDebugPrivilege	2892	AppLaunch.exe
Token: SeAuditPrivilege	2892	AppLaunch.exe
Token: SeSystemEnvironmentPrivilege	2892	AppLaunch.exe
Token: SeChangeNotifyPrivilege	2892	AppLaunch.exe
Token: SeRemoteShutdownPrivilege	2892	AppLaunch.exe
Token: SeUndockPrivilege	2892	AppLaunch.exe
Token: SeSyncAgentPrivilege	2892	AppLaunch.exe
Token: SeEnableDelegationPrivilege	2892	AppLaunch.exe
Token: SeManageVolumePrivilege	2892	AppLaunch.exe
Token: SeImpersonatePrivilege	2892	AppLaunch.exe
Token: SeCreateGlobalPrivilege	2892	AppLaunch.exe
Token: 31	2892	AppLaunch.exe
Token: 32	2892	AppLaunch.exe
Token: 33	2892	AppLaunch.exe
Token: 34	2892	AppLaunch.exe
Token: 35	2892	AppLaunch.exe
Token: SeDebugPrivilege	2224	nvxdsinc.exe
Token: SeDebugPrivilege	1692	nwtray.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2892	AppLaunch.exe
2892	AppLaunch.exe
2892	AppLaunch.exe
576	AppLaunch.exe
576	AppLaunch.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 1712	2592	JaffaCakes118_31c0d45df9c966ad7e11ab233078607e.exe	30
PID 2592 wrote to memory of 1712	2592	JaffaCakes118_31c0d45df9c966ad7e11ab233078607e.exe	30
PID 2592 wrote to memory of 1712	2592	JaffaCakes118_31c0d45df9c966ad7e11ab233078607e.exe	30
PID 2592 wrote to memory of 1712	2592	JaffaCakes118_31c0d45df9c966ad7e11ab233078607e.exe	30
PID 1712 wrote to memory of 2892	1712	explorer.exe	31
PID 1712 wrote to memory of 2892	1712	explorer.exe	31
PID 1712 wrote to memory of 2892	1712	explorer.exe	31
PID 1712 wrote to memory of 2892	1712	explorer.exe	31
PID 1712 wrote to memory of 2892	1712	explorer.exe	31
PID 1712 wrote to memory of 2892	1712	explorer.exe	31
PID 1712 wrote to memory of 2892	1712	explorer.exe	31
PID 1712 wrote to memory of 2892	1712	explorer.exe	31
PID 1712 wrote to memory of 2892	1712	explorer.exe	31
PID 1712 wrote to memory of 2892	1712	explorer.exe	31
PID 1712 wrote to memory of 2892	1712	explorer.exe	31
PID 2892 wrote to memory of 3028	2892	AppLaunch.exe	32
PID 2892 wrote to memory of 3028	2892	AppLaunch.exe	32
PID 2892 wrote to memory of 3028	2892	AppLaunch.exe	32
PID 2892 wrote to memory of 3028	2892	AppLaunch.exe	32
PID 2892 wrote to memory of 3028	2892	AppLaunch.exe	32
PID 2892 wrote to memory of 3028	2892	AppLaunch.exe	32
PID 2892 wrote to memory of 3028	2892	AppLaunch.exe	32
PID 2892 wrote to memory of 2840	2892	AppLaunch.exe	33
PID 2892 wrote to memory of 2840	2892	AppLaunch.exe	33
PID 2892 wrote to memory of 2840	2892	AppLaunch.exe	33
PID 2892 wrote to memory of 2840	2892	AppLaunch.exe	33
PID 2892 wrote to memory of 2840	2892	AppLaunch.exe	33
PID 2892 wrote to memory of 2840	2892	AppLaunch.exe	33
PID 2892 wrote to memory of 2840	2892	AppLaunch.exe	33
PID 2892 wrote to memory of 2228	2892	AppLaunch.exe	34
PID 2892 wrote to memory of 2228	2892	AppLaunch.exe	34
PID 2892 wrote to memory of 2228	2892	AppLaunch.exe	34
PID 2892 wrote to memory of 2228	2892	AppLaunch.exe	34
PID 2892 wrote to memory of 2228	2892	AppLaunch.exe	34
PID 2892 wrote to memory of 2228	2892	AppLaunch.exe	34
PID 2892 wrote to memory of 2228	2892	AppLaunch.exe	34
PID 2892 wrote to memory of 2704	2892	AppLaunch.exe	36
PID 2892 wrote to memory of 2704	2892	AppLaunch.exe	36
PID 2892 wrote to memory of 2704	2892	AppLaunch.exe	36
PID 2892 wrote to memory of 2704	2892	AppLaunch.exe	36
PID 2892 wrote to memory of 2704	2892	AppLaunch.exe	36
PID 2892 wrote to memory of 2704	2892	AppLaunch.exe	36
PID 2892 wrote to memory of 2704	2892	AppLaunch.exe	36
PID 1712 wrote to memory of 2224	1712	explorer.exe	40
PID 1712 wrote to memory of 2224	1712	explorer.exe	40
PID 1712 wrote to memory of 2224	1712	explorer.exe	40
PID 1712 wrote to memory of 2224	1712	explorer.exe	40
PID 3028 wrote to memory of 2332	3028	cmd.exe	41
PID 3028 wrote to memory of 2332	3028	cmd.exe	41
PID 3028 wrote to memory of 2332	3028	cmd.exe	41
PID 3028 wrote to memory of 2332	3028	cmd.exe	41
PID 3028 wrote to memory of 2332	3028	cmd.exe	41
PID 3028 wrote to memory of 2332	3028	cmd.exe	41
PID 3028 wrote to memory of 2332	3028	cmd.exe	41
PID 2704 wrote to memory of 2264	2704	cmd.exe	42
PID 2704 wrote to memory of 2264	2704	cmd.exe	42
PID 2704 wrote to memory of 2264	2704	cmd.exe	42
PID 2704 wrote to memory of 2264	2704	cmd.exe	42
PID 2704 wrote to memory of 2264	2704	cmd.exe	42
PID 2704 wrote to memory of 2264	2704	cmd.exe	42
PID 2704 wrote to memory of 2264	2704	cmd.exe	42
PID 2840 wrote to memory of 2728	2840	cmd.exe	43
PID 2840 wrote to memory of 2728	2840	cmd.exe	43
PID 2840 wrote to memory of 2728	2840	cmd.exe	43

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_31c0d45df9c966ad7e11ab233078607e.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_31c0d45df9c966ad7e11ab233078607e.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3028
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2332
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2840
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2728
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2228
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:572
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\U5P8P5076W.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\U5P8P5076W.exe:*:Enabled:Windows Messanger" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2704
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\U5P8P5076W.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\U5P8P5076W.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2264
- - C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe
    "C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe
      "C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1692
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

Filesize
84B

MD5
e9d43484dd9b784bfec3ac8c969db42d

SHA1
91f5794b278468ea0c8f3c7fe11479d475f65885

SHA256
720f381f48449cbc9252be7992f7574d201801ea8d559eb30525357a2850f7d6

SHA512
521376a633c764eac1ffcdf10b5746ac75f72d6ae0305842681be73917852197c2640bcda32f619a9d0a0a706b3d3dbf06513fff4bc49306a801eee09bae2f35

Download Submit
\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe

Filesize
39KB

MD5
38abcaec6ee62213f90b1717d830a1bb

SHA1
d8f5849d0d3f4ccc0dfb66a9a4a0442ac66a31b9

SHA256
6fee9a2c70b2cc48b0812f7cb2e09497c9c90941976f430a8f8279ad3c787768

SHA512
77eaabcbc6f7a3835b6220d72c4b1cae82d2125ea971907e33b15ceeede7e4da0741c6e63e988bd782ed6eb72ad3cbcba10ea83919eafd9b95d612c43a735274

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

Filesize
233KB

MD5
31c0d45df9c966ad7e11ab233078607e

SHA1
ead2ce24fbf87bebad55500604557bf9ac4d2ddf

SHA256
22a7ae8d819204ec2cd27a5e53f5e267c7829776eb3064b95bc6f253e72a1157

SHA512
bd99241deae5815117fd8725b105006238a6980d65a3f1115d1d107ff66fa5abf6ef122db3fc65910e47087b4b0c21b51fc9bcf35c5a8de12fbc1cfb3b0f0df8

Download Submit
memory/1712-17-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/1712-16-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/1712-15-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/1712-71-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/2592-1-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/2592-2-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/2592-14-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/2592-0-0x0000000074531000-0x0000000074532000-memory.dmp

Filesize
4KB

Download
memory/2892-31-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2892-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2892-27-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2892-25-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2892-37-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2892-36-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2892-35-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2892-33-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2892-23-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2892-72-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download