Malware Analysis Report

2025-04-03 10:11

Sample ID 250201-v1dqlssmd1
Target 707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe
SHA256 707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3
Tags
upx blackshades defense_evasion discovery persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3

Threat Level: Known bad

The file 707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe was found to be: Known bad.

Malicious Activity Summary

upx blackshades defense_evasion discovery persistence rat

Blackshades

Blackshades payload

Modifies firewall policy service

Blackshades family

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

UPX packed file

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Modifies registry key

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-01 17:27

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-01 17:27

Reported

2025-02-01 17:29

Platform

win7-20240729-en

Max time kernel

119s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\Windowsdef.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDef = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\Windowsdef.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1440 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe C:\Windows\SysWOW64\cmd.exe
PID 1440 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe C:\Windows\SysWOW64\cmd.exe
PID 1440 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe C:\Windows\SysWOW64\cmd.exe
PID 1440 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe C:\Windows\SysWOW64\cmd.exe
PID 2084 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2084 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2084 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2084 wrote to memory of 2756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1440 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 1440 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 1440 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 1440 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2844 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2844 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2844 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2844 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2844 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2844 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2844 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2844 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2844 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2844 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2844 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2844 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2844 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2844 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2844 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2844 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2844 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2844 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 2200 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 2468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2740 wrote to memory of 2468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2740 wrote to memory of 2468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2740 wrote to memory of 2468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2676 wrote to memory of 1828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2676 wrote to memory of 1828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2676 wrote to memory of 1828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2676 wrote to memory of 1828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2640 wrote to memory of 1052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2640 wrote to memory of 1052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2640 wrote to memory of 1052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2640 wrote to memory of 1052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1444 wrote to memory of 2916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1444 wrote to memory of 2916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1444 wrote to memory of 2916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1444 wrote to memory of 2916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe

"C:\Users\Admin\AppData\Local\Temp\707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\eHfGW.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDef" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe" /f

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe

"C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe"

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
N/A 192.168.1.2:3080 tcp
N/A 192.168.1.2:3080 tcp
N/A 192.168.1.2:3080 tcp
N/A 192.168.1.2:3080 tcp
N/A 192.168.1.2:3080 tcp
N/A 192.168.1.2:3080 tcp
N/A 192.168.1.2:3080 tcp
N/A 192.168.1.2:3080 tcp

Files

memory/1440-0-0x0000000000400000-0x00000000005FD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\eHfGW.bat

MD5 130a1ad614bfc1851533b7a02e302622
SHA1 6cd68d0bacb7b24ca9baedc80d90f1bfca3bb92c
SHA256 4620f5f49d3f3c3fcb10d7dd83e5fdc0b2efd44ae429ee5a8dc3e64d76e6bc9a
SHA512 16b5e40deb2e66287b86bbff11ac986f36b94a5849fbe2ed7124296e95d563ec0e9b00cbd6008c993c383d1610d371177faf5a9cd5da77a34a778e901f9e7a25

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe

MD5 4a4529b0e4d2a16c275cf6eafabb7cef
SHA1 9629d0c31bd7a8d154284f94c75a88f522b9e4e0
SHA256 37a21f0a92069ddf7de5e5d691a6af4c75022127da558c4ba54396d870e26dc3
SHA512 46855da58c3ae4f682bfbec1b1a4603dc9dee4e16b8772cd1bbbcd001b68521ee5bbd13d80a5a9d8d1f28b4ee8be39576892393ee28c8470babb077f18da67d9

memory/1440-43-0x0000000003830000-0x0000000003A2D000-memory.dmp

memory/1440-42-0x0000000003830000-0x0000000003A2D000-memory.dmp

memory/1440-45-0x0000000000400000-0x00000000005FD000-memory.dmp

memory/2844-62-0x0000000000400000-0x00000000005FD000-memory.dmp

memory/2844-61-0x0000000002900000-0x0000000002AFD000-memory.dmp

memory/2864-60-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2864-59-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2200-56-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2200-55-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2864-54-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2200-53-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2200-70-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2864-71-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2200-74-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2200-76-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2200-79-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2200-81-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2200-84-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2200-86-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2200-88-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2200-90-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2200-93-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2200-95-0x0000000000400000-0x000000000045C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-01 17:27

Reported

2025-02-01 17:29

Platform

win10v2004-20241007-en

Max time kernel

119s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\Windowsdef.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDef = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\Windowsdef.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4468 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe C:\Windows\SysWOW64\cmd.exe
PID 4468 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe C:\Windows\SysWOW64\cmd.exe
PID 4468 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe C:\Windows\SysWOW64\cmd.exe
PID 1028 wrote to memory of 1516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1028 wrote to memory of 1516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1028 wrote to memory of 1516 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4468 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 4468 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 4468 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 4700 wrote to memory of 872 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 4700 wrote to memory of 872 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 4700 wrote to memory of 872 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 4700 wrote to memory of 872 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 4700 wrote to memory of 872 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 4700 wrote to memory of 872 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 4700 wrote to memory of 872 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 4700 wrote to memory of 872 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 4700 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 4700 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 4700 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 4700 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 4700 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 4700 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 4700 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 4700 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe
PID 872 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 872 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 872 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 872 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 872 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 872 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 872 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 872 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 872 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 872 wrote to memory of 3364 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 872 wrote to memory of 3364 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 872 wrote to memory of 3364 N/A C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe C:\Windows\SysWOW64\cmd.exe
PID 3460 wrote to memory of 2068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3460 wrote to memory of 2068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3460 wrote to memory of 2068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3696 wrote to memory of 4444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3696 wrote to memory of 4444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3696 wrote to memory of 4444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1508 wrote to memory of 2388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1508 wrote to memory of 2388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1508 wrote to memory of 2388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3364 wrote to memory of 2352 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3364 wrote to memory of 2352 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3364 wrote to memory of 2352 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe

"C:\Users\Admin\AppData\Local\Temp\707b9bcb9f91c510825dee9fdcfe9e50ce21b6febecbc050056a0b2882f3ccb3N.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Jgpor.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDef" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe" /f

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe

"C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe"

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
N/A 192.168.1.2:3080 tcp
US 8.8.8.8:53 167.173.78.104.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
N/A 192.168.1.2:3080 tcp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 167.190.18.2.in-addr.arpa udp
N/A 192.168.1.2:3080 tcp
N/A 192.168.1.2:3080 tcp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
N/A 192.168.1.2:3080 tcp
N/A 192.168.1.2:3080 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
N/A 192.168.1.2:3080 tcp
N/A 192.168.1.2:3080 tcp

Files

memory/4468-0-0x0000000000400000-0x00000000005FD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Jgpor.txt

MD5 130a1ad614bfc1851533b7a02e302622
SHA1 6cd68d0bacb7b24ca9baedc80d90f1bfca3bb92c
SHA256 4620f5f49d3f3c3fcb10d7dd83e5fdc0b2efd44ae429ee5a8dc3e64d76e6bc9a
SHA512 16b5e40deb2e66287b86bbff11ac986f36b94a5849fbe2ed7124296e95d563ec0e9b00cbd6008c993c383d1610d371177faf5a9cd5da77a34a778e901f9e7a25

C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.txt

MD5 c3344d288a916353466bf9d78d133b12
SHA1 8373424d644015bfecc19e0717e1a5c9359b5c56
SHA256 378d88667cf64252fcdcc958d27e026f67ee3b650929f915b6af411759c6b128
SHA512 b5862cf04983614b3cbfeaebe83e5090fc5b70c9e6b4bce0d4d05de2dc2fee9523134a34db484a466f35c3147121dce117143af739e0fa2397153749feff7b86

memory/4468-30-0x0000000000400000-0x00000000005FD000-memory.dmp

memory/872-31-0x0000000000400000-0x000000000045C000-memory.dmp

memory/872-36-0x0000000000400000-0x000000000045C000-memory.dmp

memory/872-34-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2292-38-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2292-43-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2292-45-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4700-50-0x0000000000400000-0x00000000005FD000-memory.dmp

memory/872-51-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2292-52-0x0000000000400000-0x0000000000409000-memory.dmp

memory/872-53-0x0000000000400000-0x000000000045C000-memory.dmp

memory/872-58-0x0000000000400000-0x000000000045C000-memory.dmp

memory/872-60-0x0000000000400000-0x000000000045C000-memory.dmp

memory/872-62-0x0000000000400000-0x000000000045C000-memory.dmp

memory/872-65-0x0000000000400000-0x000000000045C000-memory.dmp

memory/872-67-0x0000000000400000-0x000000000045C000-memory.dmp

memory/872-69-0x0000000000400000-0x000000000045C000-memory.dmp

memory/872-72-0x0000000000400000-0x000000000045C000-memory.dmp

memory/872-74-0x0000000000400000-0x000000000045C000-memory.dmp

memory/872-76-0x0000000000400000-0x000000000045C000-memory.dmp