Malware Analysis Report

2025-04-03 10:11

Sample ID 250201-n6mgdatjbk
Target JaffaCakes118_7182e7c37759126da58b5fb29296de8e
SHA256 10e3833de2ebf0dc6e16a94dae301b03d1079d2b94295eb941661ec731812ebb
Tags
blackshades defense_evasion discovery persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

10e3833de2ebf0dc6e16a94dae301b03d1079d2b94295eb941661ec731812ebb

Threat Level: Known bad

The file JaffaCakes118_7182e7c37759126da58b5fb29296de8e was found to be: Known bad.

Malicious Activity Summary

blackshades defense_evasion discovery persistence rat

Blackshades payload

Modifies firewall policy service

Blackshades

Blackshades family

Drops startup file

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Unsigned PE

Suspicious use of SetWindowsHookEx

Modifies registry key

Suspicious use of AdjustPrivilegeToken

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-01 12:00

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-01 12:00

Reported

2025-02-01 12:03

Platform

win7-20240903-en

Max time kernel

148s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\acer.exe = "C:\\Users\\Admin\\AppData\\Roaming\\acer.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Temp\sidebar.exe = "C:\\Windows\\Temp\\sidebar.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sidebar .exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sidebar .exe C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogIe = "C:\\Users\\Admin\\AppData\\Roaming\\sidebar .exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Temp\sidebar.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wscript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Temp\sidebar.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Temp\sidebar.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Temp\sidebar.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Temp\sidebar.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\sidebar .exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe N/A
Token: 1 N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: 31 N/A C:\Windows\Temp\sidebar.exe N/A
Token: 32 N/A C:\Windows\Temp\sidebar.exe N/A
Token: 33 N/A C:\Windows\Temp\sidebar.exe N/A
Token: 34 N/A C:\Windows\Temp\sidebar.exe N/A
Token: 35 N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2916 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\SysWOW64\cmd.exe
PID 2916 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\SysWOW64\cmd.exe
PID 2916 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\SysWOW64\cmd.exe
PID 2916 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\SysWOW64\cmd.exe
PID 2916 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2916 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2916 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2916 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 1640 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1640 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1640 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 1640 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 2916 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2916 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2916 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2916 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2916 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2916 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2916 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2916 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2916 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2916 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2916 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2916 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2916 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2916 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2916 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2916 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2592 wrote to memory of 1568 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 1568 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 1568 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 1568 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2524 wrote to memory of 2276 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 2524 wrote to memory of 2276 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 2524 wrote to memory of 2276 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 2524 wrote to memory of 2276 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 2524 wrote to memory of 1852 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 2524 wrote to memory of 1852 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 2524 wrote to memory of 1852 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 2524 wrote to memory of 1852 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 2524 wrote to memory of 2388 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 2524 wrote to memory of 2388 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 2524 wrote to memory of 2388 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 2524 wrote to memory of 2388 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 2524 wrote to memory of 2396 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 2524 wrote to memory of 2396 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 2524 wrote to memory of 2396 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 2524 wrote to memory of 2396 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 1852 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1852 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1852 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1852 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2276 wrote to memory of 1232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2276 wrote to memory of 1232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2276 wrote to memory of 1232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2276 wrote to memory of 1232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2396 wrote to memory of 1364 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2396 wrote to memory of 1364 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2396 wrote to memory of 1364 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2396 wrote to memory of 1364 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2388 wrote to memory of 1496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2388 wrote to memory of 1496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2388 wrote to memory of 1496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2388 wrote to memory of 1496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\lala.bat" "

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Roaming\invs.vbs" "C:\Users\Admin\AppData\Roaming\lala2.bat

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\lala2.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Temp\sidebar.exe" /t REG_SZ /d "C:\Windows\Temp\sidebar.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\acer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\acer.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Temp\sidebar.exe" /t REG_SZ /d "C:\Windows\Temp\sidebar.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\acer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\acer.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\per.bat" "

C:\Windows\SysWOW64\PING.EXE

ping 1.1.1.1 -n 1 -w 3000

C:\Users\Admin\AppData\Roaming\sidebar .exe

"C:\Users\Admin\AppData\Roaming\sidebar .exe"

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\SysWOW64\PING.EXE

ping 1.1.1.1 -n 1 -w 3000

C:\Users\Admin\AppData\Roaming\sidebar .exe

"C:\Users\Admin\AppData\Roaming\sidebar .exe"

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\SysWOW64\PING.EXE

ping 1.1.1.1 -n 1 -w 3000

C:\Users\Admin\AppData\Roaming\sidebar .exe

"C:\Users\Admin\AppData\Roaming\sidebar .exe"

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\SysWOW64\PING.EXE

ping 1.1.1.1 -n 1 -w 3000

C:\Users\Admin\AppData\Roaming\sidebar .exe

"C:\Users\Admin\AppData\Roaming\sidebar .exe"

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 uripok.servemp3.com udp

Files

memory/2916-0-0x0000000074081000-0x0000000074082000-memory.dmp

memory/2916-1-0x0000000074080000-0x000000007462B000-memory.dmp

memory/2916-2-0x0000000074080000-0x000000007462B000-memory.dmp

C:\Users\Admin\AppData\Roaming\lala.bat

MD5 da2f62b3f68d61e7ff27df1155637ae1
SHA1 326f9ab4df92d730d0f22d0ee5e0faf661c7ac59
SHA256 547013d5a8e3c6f94e61a6e9d0a052451e4a73e54b11b8dd4d1ff357f96cad41
SHA512 f2e24b25add6479f5cc6746392be03f2d6a1ed3afd6b279aefa5614b81279d45c572344e24e3daf849974bc5fae3c0451ddf2c66e338268d22589aeb2b41c34d

C:\Windows\Temp\sidebar.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

memory/2524-37-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2524-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

C:\Users\Admin\AppData\Roaming\invs.vbs

MD5 c578d9653b22800c3eb6b6a51219bbb8
SHA1 a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA256 20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA512 3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

memory/2524-29-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2524-28-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2524-26-0x0000000000400000-0x0000000000470000-memory.dmp

C:\Users\Admin\AppData\Roaming\lala2.bat

MD5 8cfac7da0aee569085574419450d5bf8
SHA1 1847e99f86c011aabf610c2f08561d5ad84c7fbc
SHA256 b9318322b53fb957554e9f876b997f04bf24cab45fcd8c3a70d9432485205ff7
SHA512 545c4a1e045230b3fe933e951ece02b90388fe4d839705f0a948952ea254e2ee4859afc951581a7af93e2cab1a6bfa0800a99406faa535681c1a1c7d3b614136

C:\Users\Admin\AppData\Roaming\sidebar .exe

MD5 7182e7c37759126da58b5fb29296de8e
SHA1 c6f4fa352e3c1e47a0e146bce1c6fa2574152b77
SHA256 10e3833de2ebf0dc6e16a94dae301b03d1079d2b94295eb941661ec731812ebb
SHA512 040fd58614bcc1c81487a3a0b98d8e6c8bd94f4a07b652bece474fde15316945b5ed12439210c9553f8dfce53d4bc923565372b644dae58d6b2d7af1cc759a2c

memory/2916-59-0x0000000074080000-0x000000007462B000-memory.dmp

memory/2524-60-0x0000000000400000-0x0000000000470000-memory.dmp

C:\Users\Admin\AppData\Roaming\per.bat

MD5 4a27d520d3b75c616febcfdb51050e93
SHA1 7ca1a6fe3dffd7069847cbc39eeaf414ff2e6320
SHA256 b03c8cebc68fc2f77101bebfcf99f97ff399398251abb4ddd257f21eba4edf8d
SHA512 6657a3e9dc893e94830b7612da7d6efed4d689de48b72774a9be1df865186b9bffd14d80ca42b100482c8366f6ad395712fe0840aecea72201332745ed2cef6b

memory/2156-88-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2524-89-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2524-90-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2916-92-0x0000000074080000-0x000000007462B000-memory.dmp

memory/2524-93-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2524-94-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2524-95-0x0000000000400000-0x0000000000470000-memory.dmp

memory/912-113-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2524-115-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2524-118-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2576-132-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2524-137-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2420-155-0x0000000000400000-0x0000000000470000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-01 12:00

Reported

2025-02-01 12:03

Platform

win10v2004-20250129-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Temp\sidebar.exe = "C:\\Windows\\Temp\\sidebar.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\acer.exe = "C:\\Users\\Admin\\AppData\\Roaming\\acer.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\wscript.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sidebar .exe C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sidebar .exe C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogIe = "C:\\Users\\Admin\\AppData\\Roaming\\sidebar .exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Temp\sidebar.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Temp\sidebar.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Temp\sidebar.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Temp\sidebar.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Temp\sidebar.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wscript.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe N/A
Token: 1 N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Temp\sidebar.exe N/A
Token: 31 N/A C:\Windows\Temp\sidebar.exe N/A
Token: 32 N/A C:\Windows\Temp\sidebar.exe N/A
Token: 33 N/A C:\Windows\Temp\sidebar.exe N/A
Token: 34 N/A C:\Windows\Temp\sidebar.exe N/A
Token: 35 N/A C:\Windows\Temp\sidebar.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\sidebar .exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2196 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\SysWOW64\cmd.exe
PID 2196 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\SysWOW64\cmd.exe
PID 2196 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\SysWOW64\cmd.exe
PID 2196 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2196 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2196 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2196 wrote to memory of 4184 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2196 wrote to memory of 4184 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2196 wrote to memory of 4184 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2196 wrote to memory of 4184 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 4336 wrote to memory of 2260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 4336 wrote to memory of 2260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 4336 wrote to memory of 2260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\wscript.exe
PID 2196 wrote to memory of 4184 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2196 wrote to memory of 4184 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2196 wrote to memory of 4184 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2196 wrote to memory of 4184 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2196 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2196 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2196 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2196 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2196 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 2196 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\Temp\sidebar.exe
PID 4184 wrote to memory of 5100 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 4184 wrote to memory of 5100 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 4184 wrote to memory of 5100 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 4184 wrote to memory of 1912 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 4184 wrote to memory of 1912 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 4184 wrote to memory of 1912 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 4184 wrote to memory of 5104 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 4184 wrote to memory of 5104 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 4184 wrote to memory of 5104 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 4184 wrote to memory of 5108 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 4184 wrote to memory of 5108 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 4184 wrote to memory of 5108 N/A C:\Windows\Temp\sidebar.exe C:\Windows\SysWOW64\cmd.exe
PID 2260 wrote to memory of 3992 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2260 wrote to memory of 3992 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 2260 wrote to memory of 3992 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1912 wrote to memory of 3704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1912 wrote to memory of 3704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1912 wrote to memory of 3704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5108 wrote to memory of 4464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5108 wrote to memory of 4464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5108 wrote to memory of 4464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5104 wrote to memory of 4824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5104 wrote to memory of 4824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5104 wrote to memory of 4824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5100 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5100 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5100 wrote to memory of 544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2196 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\SysWOW64\cmd.exe
PID 2196 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\SysWOW64\cmd.exe
PID 2196 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe C:\Windows\SysWOW64\cmd.exe
PID 4264 wrote to memory of 3948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4264 wrote to memory of 3948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4264 wrote to memory of 3948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4264 wrote to memory of 3724 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\sidebar .exe
PID 4264 wrote to memory of 3724 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\sidebar .exe
PID 4264 wrote to memory of 3724 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\sidebar .exe
PID 3724 wrote to memory of 460 N/A C:\Users\Admin\AppData\Roaming\sidebar .exe C:\Windows\Temp\sidebar.exe
PID 3724 wrote to memory of 460 N/A C:\Users\Admin\AppData\Roaming\sidebar .exe C:\Windows\Temp\sidebar.exe
PID 3724 wrote to memory of 460 N/A C:\Users\Admin\AppData\Roaming\sidebar .exe C:\Windows\Temp\sidebar.exe
PID 3724 wrote to memory of 764 N/A C:\Users\Admin\AppData\Roaming\sidebar .exe C:\Windows\Temp\sidebar.exe
PID 3724 wrote to memory of 764 N/A C:\Users\Admin\AppData\Roaming\sidebar .exe C:\Windows\Temp\sidebar.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7182e7c37759126da58b5fb29296de8e.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\lala.bat" "

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\SysWOW64\wscript.exe

wscript.exe "C:\Users\Admin\AppData\Roaming\invs.vbs" "C:\Users\Admin\AppData\Roaming\lala2.bat

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Temp\sidebar.exe" /t REG_SZ /d "C:\Windows\Temp\sidebar.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\acer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\acer.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\lala2.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Temp\sidebar.exe" /t REG_SZ /d "C:\Windows\Temp\sidebar.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\acer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\acer.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\per.bat" "

C:\Windows\SysWOW64\PING.EXE

ping 1.1.1.1 -n 1 -w 3000

C:\Users\Admin\AppData\Roaming\sidebar .exe

"C:\Users\Admin\AppData\Roaming\sidebar .exe"

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\SysWOW64\PING.EXE

ping 1.1.1.1 -n 1 -w 3000

C:\Users\Admin\AppData\Roaming\sidebar .exe

"C:\Users\Admin\AppData\Roaming\sidebar .exe"

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\SysWOW64\PING.EXE

ping 1.1.1.1 -n 1 -w 3000

C:\Users\Admin\AppData\Roaming\sidebar .exe

"C:\Users\Admin\AppData\Roaming\sidebar .exe"

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\SysWOW64\PING.EXE

ping 1.1.1.1 -n 1 -w 3000

C:\Users\Admin\AppData\Roaming\sidebar .exe

"C:\Users\Admin\AppData\Roaming\sidebar .exe"

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

C:\Windows\Temp\sidebar.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 uripok.servemp3.com udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 66.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 uripok.servemp3.com udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 uripok.servemp3.com udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 uripok.servemp3.com udp
US 8.8.8.8:53 uripok.servemp3.com udp
US 8.8.8.8:53 uripok.servemp3.com udp
US 8.8.8.8:53 uripok.servemp3.com udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 20.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 uripok.servemp3.com udp
US 8.8.8.8:53 uripok.servemp3.com udp
US 8.8.8.8:53 uripok.servemp3.com udp

Files

memory/2196-0-0x00000000752B2000-0x00000000752B3000-memory.dmp

memory/2196-1-0x00000000752B0000-0x0000000075861000-memory.dmp

memory/2196-2-0x00000000752B0000-0x0000000075861000-memory.dmp

C:\Windows\Temp\sidebar.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

C:\Users\Admin\AppData\Roaming\lala.bat

MD5 da2f62b3f68d61e7ff27df1155637ae1
SHA1 326f9ab4df92d730d0f22d0ee5e0faf661c7ac59
SHA256 547013d5a8e3c6f94e61a6e9d0a052451e4a73e54b11b8dd4d1ff357f96cad41
SHA512 f2e24b25add6479f5cc6746392be03f2d6a1ed3afd6b279aefa5614b81279d45c572344e24e3daf849974bc5fae3c0451ddf2c66e338268d22589aeb2b41c34d

memory/4184-22-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4184-17-0x0000000000400000-0x0000000000470000-memory.dmp

C:\Users\Admin\AppData\Roaming\invs.vbs

MD5 c578d9653b22800c3eb6b6a51219bbb8
SHA1 a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA256 20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA512 3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

C:\Users\Admin\AppData\Roaming\lala2.bat

MD5 8cfac7da0aee569085574419450d5bf8
SHA1 1847e99f86c011aabf610c2f08561d5ad84c7fbc
SHA256 b9318322b53fb957554e9f876b997f04bf24cab45fcd8c3a70d9432485205ff7
SHA512 545c4a1e045230b3fe933e951ece02b90388fe4d839705f0a948952ea254e2ee4859afc951581a7af93e2cab1a6bfa0800a99406faa535681c1a1c7d3b614136

C:\Users\Admin\AppData\Roaming\rundll32-.txt

MD5 7182e7c37759126da58b5fb29296de8e
SHA1 c6f4fa352e3c1e47a0e146bce1c6fa2574152b77
SHA256 10e3833de2ebf0dc6e16a94dae301b03d1079d2b94295eb941661ec731812ebb
SHA512 040fd58614bcc1c81487a3a0b98d8e6c8bd94f4a07b652bece474fde15316945b5ed12439210c9553f8dfce53d4bc923565372b644dae58d6b2d7af1cc759a2c

memory/2196-36-0x00000000752B2000-0x00000000752B3000-memory.dmp

memory/2196-37-0x00000000752B0000-0x0000000075861000-memory.dmp

memory/4184-38-0x0000000000400000-0x0000000000470000-memory.dmp

C:\Users\Admin\AppData\Roaming\per.bat

MD5 4a27d520d3b75c616febcfdb51050e93
SHA1 7ca1a6fe3dffd7069847cbc39eeaf414ff2e6320
SHA256 b03c8cebc68fc2f77101bebfcf99f97ff399398251abb4ddd257f21eba4edf8d
SHA512 6657a3e9dc893e94830b7612da7d6efed4d689de48b72774a9be1df865186b9bffd14d80ca42b100482c8366f6ad395712fe0840aecea72201332745ed2cef6b

memory/4184-44-0x0000000000400000-0x0000000000470000-memory.dmp

memory/764-54-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4184-56-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2196-58-0x00000000752B0000-0x0000000075861000-memory.dmp

memory/4184-59-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4184-60-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4184-64-0x0000000000400000-0x0000000000470000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\sidebar .exe.log

MD5 bbc3cfe1a58732a0477f72ea3d36c7bf
SHA1 fb801263330aa243f63270138ab467a627dffc2e
SHA256 9269d4383b8effa928b7b4a7b38ffa07587b23851f9430fbfe8e7284f845e722
SHA512 5bfdc6520a7a0884e3ccdf26ab0fe536327c9f3330f7f78bed2ed4c89fc31b04ad0c4b4bd6f8f1bca08ef04e46b833b798726dca7f40ccc27c871847ec041be4

memory/4412-73-0x0000000000470000-0x0000000000539000-memory.dmp

memory/4412-74-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4184-75-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4184-76-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4184-79-0x0000000000400000-0x0000000000470000-memory.dmp

memory/3992-89-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4184-93-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4184-94-0x0000000000400000-0x0000000000470000-memory.dmp

memory/3772-104-0x0000000000400000-0x0000000000470000-memory.dmp