Malware Analysis Report

2025-04-03 10:11

Sample ID 250201-q853lsvmgz
Target JaffaCakes118_7272eaa4942abe2950d745d86c076fdb
SHA256 74a0fdfeae207ad0802ef942adc88f622e0a4ab940b6ed51ae48376d4e15d2fe
Tags
discovery blackshades defense_evasion persistence rat upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

74a0fdfeae207ad0802ef942adc88f622e0a4ab940b6ed51ae48376d4e15d2fe

Threat Level: Known bad

The file JaffaCakes118_7272eaa4942abe2950d745d86c076fdb was found to be: Known bad.

Malicious Activity Summary

discovery blackshades defense_evasion persistence rat upx

Blackshades

Blackshades family

Blackshades payload

Modifies firewall policy service

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

UPX packed file

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies registry key

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-01 13:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-01 13:56

Reported

2025-02-01 13:59

Platform

win7-20240903-en

Max time kernel

94s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7272eaa4942abe2950d745d86c076fdb.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7272eaa4942abe2950d745d86c076fdb.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7272eaa4942abe2950d745d86c076fdb.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7272eaa4942abe2950d745d86c076fdb.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7272eaa4942abe2950d745d86c076fdb.exe"

Network

N/A

Files

memory/2904-3765-0x0000000000230000-0x0000000000231000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-01 13:56

Reported

2025-02-01 13:59

Platform

win10v2004-20250129-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7272eaa4942abe2950d745d86c076fdb.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\MSN\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\MSN\\svchost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7272eaa4942abe2950d745d86c076fdb.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\MSN\\svchost.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 112 set thread context of 4260 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Users\Admin\AppData\Roaming\MSN\svchost.exe
PID 112 set thread context of 828 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Users\Admin\AppData\Roaming\MSN\svchost.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7272eaa4942abe2950d745d86c076fdb.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1584 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7272eaa4942abe2950d745d86c076fdb.exe C:\Windows\SysWOW64\cmd.exe
PID 1584 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7272eaa4942abe2950d745d86c076fdb.exe C:\Windows\SysWOW64\cmd.exe
PID 1584 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7272eaa4942abe2950d745d86c076fdb.exe C:\Windows\SysWOW64\cmd.exe
PID 4132 wrote to memory of 3920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4132 wrote to memory of 3920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4132 wrote to memory of 3920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1584 wrote to memory of 112 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7272eaa4942abe2950d745d86c076fdb.exe C:\Users\Admin\AppData\Roaming\MSN\svchost.exe
PID 1584 wrote to memory of 112 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7272eaa4942abe2950d745d86c076fdb.exe C:\Users\Admin\AppData\Roaming\MSN\svchost.exe
PID 1584 wrote to memory of 112 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7272eaa4942abe2950d745d86c076fdb.exe C:\Users\Admin\AppData\Roaming\MSN\svchost.exe
PID 112 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Users\Admin\AppData\Roaming\MSN\svchost.exe
PID 112 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Users\Admin\AppData\Roaming\MSN\svchost.exe
PID 112 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Users\Admin\AppData\Roaming\MSN\svchost.exe
PID 112 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Users\Admin\AppData\Roaming\MSN\svchost.exe
PID 112 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Users\Admin\AppData\Roaming\MSN\svchost.exe
PID 112 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Users\Admin\AppData\Roaming\MSN\svchost.exe
PID 112 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Users\Admin\AppData\Roaming\MSN\svchost.exe
PID 112 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Users\Admin\AppData\Roaming\MSN\svchost.exe
PID 112 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Users\Admin\AppData\Roaming\MSN\svchost.exe
PID 112 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Users\Admin\AppData\Roaming\MSN\svchost.exe
PID 112 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Users\Admin\AppData\Roaming\MSN\svchost.exe
PID 112 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Users\Admin\AppData\Roaming\MSN\svchost.exe
PID 112 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Users\Admin\AppData\Roaming\MSN\svchost.exe
PID 112 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Users\Admin\AppData\Roaming\MSN\svchost.exe
PID 112 wrote to memory of 828 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Users\Admin\AppData\Roaming\MSN\svchost.exe
PID 828 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 828 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 828 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 828 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 828 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 828 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 828 wrote to memory of 3188 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 828 wrote to memory of 3188 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 828 wrote to memory of 3188 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 828 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 828 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 828 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Roaming\MSN\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 5008 wrote to memory of 4116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5008 wrote to memory of 4116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5008 wrote to memory of 4116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2728 wrote to memory of 1760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2728 wrote to memory of 1760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2728 wrote to memory of 1760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3188 wrote to memory of 460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3188 wrote to memory of 460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3188 wrote to memory of 460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2628 wrote to memory of 1592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2628 wrote to memory of 1592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2628 wrote to memory of 1592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7272eaa4942abe2950d745d86c076fdb.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7272eaa4942abe2950d745d86c076fdb.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240656593.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\MSN\svchost.exe" /f

C:\Users\Admin\AppData\Roaming\MSN\svchost.exe

"C:\Users\Admin\AppData\Roaming\MSN\svchost.exe"

C:\Users\Admin\AppData\Roaming\MSN\svchost.exe

"C:\Users\Admin\AppData\Roaming\MSN\svchost.exe"

C:\Users\Admin\AppData\Roaming\MSN\svchost.exe

"C:\Users\Admin\AppData\Roaming\MSN\svchost.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\MSN\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\MSN\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\MSN\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\MSN\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 0.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 7.98.51.23.in-addr.arpa udp
US 8.8.8.8:53 lopta10.no-ip.info udp
US 8.8.8.8:53 lopta10.no-ip.info udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 20.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 1lopta10.no-ip.info udp
US 8.8.8.8:53 2lopta10.no-ip.info udp
US 8.8.8.8:53 11.153.16.2.in-addr.arpa udp
US 8.8.8.8:53 3lopta10.no-ip.info udp
US 78.159.143.172:83 3lopta10.no-ip.info tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 4lopta10.no-ip.info udp
ID 212.117.53.118:83 4lopta10.no-ip.info tcp
US 8.8.8.8:53 5lopta10.no-ip.info udp
US 8.8.8.8:53 6lopta10.no-ip.info udp
US 8.8.8.8:53 7lopta10.no-ip.info udp
US 8.8.8.8:53 50.192.11.51.in-addr.arpa udp
US 8.8.8.8:53 8lopta10.no-ip.info udp

Files

memory/1584-2-0x0000000000530000-0x0000000000531000-memory.dmp

memory/1584-3-0x0000000000560000-0x0000000000561000-memory.dmp

memory/1584-4-0x0000000000580000-0x0000000000581000-memory.dmp

memory/1584-8-0x0000000000550000-0x0000000000551000-memory.dmp

memory/1584-7-0x0000000002140000-0x0000000002141000-memory.dmp

memory/1584-6-0x0000000000530000-0x0000000000531000-memory.dmp

memory/1584-9-0x0000000000560000-0x0000000000561000-memory.dmp

memory/1584-10-0x0000000000580000-0x0000000000581000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\240656593.bat

MD5 92be0e9ab25ff1c1afd49e0b4cab9224
SHA1 dfefb50f694f344ab3581e9bf530f9e94041c4b8
SHA256 ccd0ff6d33ca5531a43b469a89f18733810a532f962c5b567ff67b9ae2491c95
SHA512 b765a500b0f303284545ddfe8cd49684241e2b2a93adc9c1df92a7fca69eafb7daedf10fdf149d448d9349581f805b0a2001769cf51de3458e2fabeaf3757174

memory/1584-16-0x0000000002A10000-0x0000000002A11000-memory.dmp

memory/1584-17-0x0000000002920000-0x0000000002921000-memory.dmp

C:\Users\Admin\AppData\Roaming\MSN\svchost.exe

MD5 7272eaa4942abe2950d745d86c076fdb
SHA1 bae63683f122daafd47781203f0a2df040f17d82
SHA256 74a0fdfeae207ad0802ef942adc88f622e0a4ab940b6ed51ae48376d4e15d2fe
SHA512 3c088566d68159fd22ce597c3542593e2864aa6b786592c3a8961914b51f0d886fb8ef78f25aa16fa945c4503e117b234f655dcfb79693b392d363724f956723

memory/112-32-0x0000000002D70000-0x0000000002D71000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2089655958-977706906-1981639424-1000\699c4b9cdebca7aaea5193cae8a50098_bfc54fb9-d779-4763-84c8-34d8d411096a

MD5 5b63d4dd8c04c88c0e30e494ec6a609a
SHA1 884d5a8bdc25fe794dc22ef9518009dcf0069d09
SHA256 4d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd
SHA512 15ff8551ac6b9de978050569bcdc26f44dfc06a0eaf445ac70fd45453a21bdafa3e4c8b4857d6a1c3226f4102a639682bdfb71d7b255062fb81a51c9126896cb

memory/112-36-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

memory/112-35-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

memory/112-34-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

memory/828-47-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4260-49-0x0000000000400000-0x0000000000407000-memory.dmp

memory/828-63-0x0000000000400000-0x0000000000473000-memory.dmp

memory/828-61-0x0000000000400000-0x0000000000473000-memory.dmp

memory/828-59-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4260-58-0x0000000000400000-0x0000000000407000-memory.dmp

memory/828-55-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4260-54-0x0000000000400000-0x0000000000407000-memory.dmp

memory/4260-52-0x0000000000400000-0x0000000000407000-memory.dmp

memory/112-46-0x0000000003020000-0x0000000003021000-memory.dmp

memory/112-45-0x0000000003110000-0x0000000003111000-memory.dmp

memory/4260-43-0x0000000000400000-0x0000000000407000-memory.dmp

memory/112-42-0x00000000030A0000-0x00000000030A1000-memory.dmp

memory/112-41-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

memory/112-40-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

memory/112-39-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

memory/112-38-0x0000000003080000-0x0000000003081000-memory.dmp

memory/112-37-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

memory/828-67-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4260-68-0x0000000000400000-0x0000000000407000-memory.dmp

memory/828-74-0x0000000000400000-0x0000000000473000-memory.dmp

memory/828-79-0x0000000000400000-0x0000000000473000-memory.dmp

memory/828-83-0x0000000000400000-0x0000000000473000-memory.dmp

memory/828-87-0x0000000000400000-0x0000000000473000-memory.dmp

memory/828-92-0x0000000000400000-0x0000000000473000-memory.dmp

memory/828-96-0x0000000000400000-0x0000000000473000-memory.dmp

memory/828-100-0x0000000000400000-0x0000000000473000-memory.dmp

memory/828-105-0x0000000000400000-0x0000000000473000-memory.dmp

memory/828-109-0x0000000000400000-0x0000000000473000-memory.dmp

memory/828-113-0x0000000000400000-0x0000000000473000-memory.dmp

memory/828-122-0x0000000000400000-0x0000000000473000-memory.dmp