Malware Analysis Report

2025-04-03 10:18

Sample ID 250201-xtpweawket
Target JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a
SHA256 e5db0bf82c2b0247f420ab75c8f67783b9a49528a5160ae8a5a6deffd931c475
Tags
blackshades bootkit defense_evasion discovery persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e5db0bf82c2b0247f420ab75c8f67783b9a49528a5160ae8a5a6deffd931c475

Threat Level: Known bad

The file JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a was found to be: Known bad.

Malicious Activity Summary

blackshades bootkit defense_evasion discovery persistence rat

Blackshades family

Modifies firewall policy service

Blackshades payload

Blackshades

Boot or Logon Autostart Execution: Active Setup

Adds policy Run key to start application

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Writes to the Master Boot Record (MBR)

Suspicious use of SetThreadContext

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SendNotifyMessage

Modifies registry class

Modifies registry key

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-01 19:08

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-01 19:08

Reported

2025-02-01 19:11

Platform

win7-20240903-en

Max time kernel

148s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\lwss.exe = "C:\\Users\\Admin\\AppData\\Roaming\\lwss.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\jMiC3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jMiC3.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\lwss.exe" C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Active Setup\Installed Components\{B2EBFDFF-1FD4-FCF7-FDCC-DC1CBFA10AEC}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\lwss.exe" C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B2EBFDFF-1FD4-FCF7-FDCC-DC1CBFA10AEC} C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B2EBFDFF-1FD4-FCF7-FDCC-DC1CBFA10AEC}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\lwss.exe" C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{B2EBFDFF-1FD4-FCF7-FDCC-DC1CBFA10AEC} C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\lwss.exe" C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\lwss.exe" C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe N/A
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2448 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe
PID 2448 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe
PID 2448 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe
PID 2448 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe
PID 2448 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe
PID 2448 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe
PID 2448 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe
PID 2448 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe
PID 2448 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe
PID 1944 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 1944 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 1944 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 1944 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 1944 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 1944 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 1944 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 1944 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 580 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 580 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 580 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 580 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 580 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 580 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 580 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 580 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 580 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 2692 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 2692 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 2692 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 2692 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 2692 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 2692 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 2692 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 2692 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 1028 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 1028 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 1028 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 1028 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 1028 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 1028 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 1028 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 1028 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 1028 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 1028 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 1028 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 1028 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 1028 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 1028 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 1028 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 1028 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 2104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2200 wrote to memory of 2104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2200 wrote to memory of 2104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2200 wrote to memory of 2104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2716 wrote to memory of 1204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2716 wrote to memory of 1204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2716 wrote to memory of 1204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2716 wrote to memory of 1204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2188 wrote to memory of 2248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2188 wrote to memory of 2248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2188 wrote to memory of 2248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2188 wrote to memory of 2248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1940 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1940 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe"

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe"

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\04.wmv"

C:\Users\Admin\AppData\Local\Temp\jMiC3.exe

"C:\Users\Admin\AppData\Local\Temp\jMiC3.exe"

C:\Users\Admin\AppData\Local\Temp\jMiC3.exe

"C:\Users\Admin\AppData\Local\Temp\jMiC3.exe"

C:\Users\Admin\AppData\Local\Temp\jMiC3.exe

"C:\Users\Admin\AppData\Local\Temp\jMiC3.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\jMiC3.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\jMiC3.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\lwss.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\lwss.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\lwss.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\lwss.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\jMiC3.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\jMiC3.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 unknown9409.no-ip.biz udp
US 8.8.8.8:53 1unknown9409.no-ip.biz udp
US 8.8.8.8:53 2unknown9409.no-ip.biz udp
US 8.8.8.8:53 3unknown9409.no-ip.biz udp
PS 94.73.22.65:1604 3unknown9409.no-ip.biz tcp
US 8.8.8.8:53 4unknown9409.no-ip.biz udp
US 8.8.8.8:53 5unknown9409.no-ip.biz udp
US 8.8.8.8:53 6unknown9409.no-ip.biz udp
US 8.8.8.8:53 7unknown9409.no-ip.biz udp
US 8.8.8.8:53 8unknown9409.no-ip.biz udp

Files

memory/1944-2-0x0000000000400000-0x00000000005D2000-memory.dmp

memory/1944-6-0x0000000000400000-0x00000000005D2000-memory.dmp

memory/1944-4-0x0000000000400000-0x00000000005D2000-memory.dmp

memory/1944-12-0x0000000000400000-0x00000000005D2000-memory.dmp

memory/1944-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1944-16-0x0000000000400000-0x00000000005D2000-memory.dmp

\Users\Admin\AppData\Local\Temp\jMiC3.exe

MD5 830e5e77ca8c49c9becc1524619c5155
SHA1 1704939c3fa88280406ee574b5deb1b4115e9cc6
SHA256 5f2c6fe763b1b800a9b77ec42f48ec4e16b4ae8c276bbdb9f78f79ad39b2e048
SHA512 3b454283ca544cb4d57964f519a8d76427f7878bcd61502f2da557ee8c04a428e1b4fbd86ec324f2901313065f28178a817768b65b08345a4531d4b09797b72c

memory/1944-28-0x0000000000400000-0x00000000005D2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\04.wmv

MD5 b05a1087990c0811ba805b486ef182ad
SHA1 54353d739ca493510a6e65365d0931031bc1cb6a
SHA256 717406e58bf6b0f6ef914102263c0f5b7096aa004e985774f01b132f60f8d0c9
SHA512 b0e1756cad4def64d4f521f9885f11f6a16eafc45cdffeede1523d7a912133c61fb92aa1d9eff6aede5dd8f447a0f0e5acddc8557183ce48913c3ee332649faf

memory/2692-44-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2692-51-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2692-65-0x0000000000400000-0x0000000000475000-memory.dmp

memory/1028-62-0x0000000000400000-0x0000000000470000-memory.dmp

memory/1028-59-0x0000000000400000-0x0000000000470000-memory.dmp

memory/1028-57-0x0000000000400000-0x0000000000470000-memory.dmp

memory/1028-55-0x0000000000400000-0x0000000000470000-memory.dmp

memory/2692-49-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2692-42-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2692-40-0x0000000000400000-0x0000000000475000-memory.dmp

memory/1044-73-0x000007FEFA480000-0x000007FEFA4B4000-memory.dmp

memory/1044-72-0x000000013FE60000-0x000000013FF58000-memory.dmp

memory/1044-81-0x000007FEF70D0000-0x000007FEF70E1000-memory.dmp

memory/1044-80-0x000007FEF70F0000-0x000007FEF710D000-memory.dmp

memory/1044-79-0x000007FEFA440000-0x000007FEFA451000-memory.dmp

memory/1044-78-0x000007FEFA460000-0x000007FEFA477000-memory.dmp

memory/1044-77-0x000007FEFA790000-0x000007FEFA7A1000-memory.dmp

memory/1044-76-0x000007FEFA920000-0x000007FEFA937000-memory.dmp

memory/1044-75-0x000007FEFAF90000-0x000007FEFAFA8000-memory.dmp

memory/1044-74-0x000007FEF5BC0000-0x000007FEF5E76000-memory.dmp

memory/1044-82-0x000007FEF59B0000-0x000007FEF5BBB000-memory.dmp

memory/1044-93-0x000007FEF4850000-0x000007FEF4880000-memory.dmp

memory/1044-92-0x000007FEF4880000-0x000007FEF4898000-memory.dmp

memory/1044-91-0x000007FEF48A0000-0x000007FEF48B1000-memory.dmp

memory/1044-90-0x000007FEF48C0000-0x000007FEF48DB000-memory.dmp

memory/1044-89-0x000007FEF48E0000-0x000007FEF48F1000-memory.dmp

memory/1044-88-0x000007FEF60D0000-0x000007FEF60E1000-memory.dmp

memory/1044-96-0x000007FEF4740000-0x000007FEF4751000-memory.dmp

memory/1044-95-0x000007FEF4760000-0x000007FEF47DC000-memory.dmp

memory/1044-99-0x000007FEF4680000-0x000007FEF46A4000-memory.dmp

memory/1044-98-0x000007FEF46B0000-0x000007FEF46D8000-memory.dmp

memory/1044-97-0x000007FEF46E0000-0x000007FEF4737000-memory.dmp

memory/1044-94-0x000007FEF47E0000-0x000007FEF4847000-memory.dmp

memory/1044-87-0x000007FEF6480000-0x000007FEF6491000-memory.dmp

memory/1044-86-0x000007FEF64A0000-0x000007FEF64B8000-memory.dmp

memory/1044-85-0x000007FEF70A0000-0x000007FEF70C1000-memory.dmp

memory/1044-84-0x000007FEF64C0000-0x000007FEF6501000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-01 19:08

Reported

2025-02-01 19:11

Platform

win10v2004-20250129-en

Max time kernel

149s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\jMiC3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jMiC3.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\lwss.exe = "C:\\Users\\Admin\\AppData\\Roaming\\lwss.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\lwss.exe" C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B2EBFDFF-1FD4-FCF7-FDCC-DC1CBFA10AEC} C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B2EBFDFF-1FD4-FCF7-FDCC-DC1CBFA10AEC}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\lwss.exe" C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{B2EBFDFF-1FD4-FCF7-FDCC-DC1CBFA10AEC} C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{B2EBFDFF-1FD4-FCF7-FDCC-DC1CBFA10AEC}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\lwss.exe" C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\lwss.exe" C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\lwss.exe" C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe N/A
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: 33 N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3576 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe
PID 3576 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe
PID 3576 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe
PID 3576 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe
PID 3576 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe
PID 3576 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe
PID 3576 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe
PID 3576 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe
PID 2824 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2824 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2824 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 2824 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 2824 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 228 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 228 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 228 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 228 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 228 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 228 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 228 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 228 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 1428 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 1428 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 1428 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 1428 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 1428 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 1428 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 1428 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 1428 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Users\Admin\AppData\Local\Temp\jMiC3.exe
PID 4784 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 4784 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 4784 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 4784 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 4784 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 4784 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 4784 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 4784 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 4784 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 4784 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 4784 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 4784 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\jMiC3.exe C:\Windows\SysWOW64\cmd.exe
PID 844 wrote to memory of 1868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 844 wrote to memory of 1868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 844 wrote to memory of 1868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4464 wrote to memory of 4992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4464 wrote to memory of 4992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4464 wrote to memory of 4992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3492 wrote to memory of 1028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3492 wrote to memory of 1028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3492 wrote to memory of 1028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2208 wrote to memory of 4052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2208 wrote to memory of 4052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2208 wrote to memory of 4052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe"

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74d0a7f3410117d31bf03a98a2396a8a.exe"

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\04.wmv"

C:\Users\Admin\AppData\Local\Temp\jMiC3.exe

"C:\Users\Admin\AppData\Local\Temp\jMiC3.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x478 0x4a4

C:\Users\Admin\AppData\Local\Temp\jMiC3.exe

"C:\Users\Admin\AppData\Local\Temp\jMiC3.exe"

C:\Users\Admin\AppData\Local\Temp\jMiC3.exe

"C:\Users\Admin\AppData\Local\Temp\jMiC3.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\jMiC3.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\jMiC3.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\lwss.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\lwss.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\jMiC3.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\jMiC3.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\lwss.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\lwss.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 21.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 unknown9409.no-ip.biz udp
US 8.8.8.8:53 unknown9409.no-ip.biz udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 1unknown9409.no-ip.biz udp
US 8.8.8.8:53 2unknown9409.no-ip.biz udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 3unknown9409.no-ip.biz udp
PS 94.73.22.65:1604 3unknown9409.no-ip.biz tcp
US 8.8.8.8:53 4unknown9409.no-ip.biz udp
US 8.8.8.8:53 181.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 5unknown9409.no-ip.biz udp
US 8.8.8.8:53 6unknown9409.no-ip.biz udp
US 8.8.8.8:53 7unknown9409.no-ip.biz udp
US 8.8.8.8:53 8unknown9409.no-ip.biz udp

Files

memory/2824-2-0x0000000000400000-0x00000000005D2000-memory.dmp

memory/2824-4-0x0000000000400000-0x00000000005D2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\04.wmv

MD5 b05a1087990c0811ba805b486ef182ad
SHA1 54353d739ca493510a6e65365d0931031bc1cb6a
SHA256 717406e58bf6b0f6ef914102263c0f5b7096aa004e985774f01b132f60f8d0c9
SHA512 b0e1756cad4def64d4f521f9885f11f6a16eafc45cdffeede1523d7a912133c61fb92aa1d9eff6aede5dd8f447a0f0e5acddc8557183ce48913c3ee332649faf

C:\Users\Admin\AppData\Local\Temp\jMiC3.exe

MD5 830e5e77ca8c49c9becc1524619c5155
SHA1 1704939c3fa88280406ee574b5deb1b4115e9cc6
SHA256 5f2c6fe763b1b800a9b77ec42f48ec4e16b4ae8c276bbdb9f78f79ad39b2e048
SHA512 3b454283ca544cb4d57964f519a8d76427f7878bcd61502f2da557ee8c04a428e1b4fbd86ec324f2901313065f28178a817768b65b08345a4531d4b09797b72c

memory/2824-28-0x0000000000400000-0x00000000005D2000-memory.dmp

memory/1428-34-0x0000000000400000-0x0000000000475000-memory.dmp

memory/1428-36-0x0000000000400000-0x0000000000475000-memory.dmp

memory/4784-41-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4784-39-0x0000000000400000-0x0000000000470000-memory.dmp

memory/1428-43-0x0000000000400000-0x0000000000475000-memory.dmp

memory/3052-49-0x00007FF76DB60000-0x00007FF76DC58000-memory.dmp

memory/3052-50-0x00007FFB55940000-0x00007FFB55974000-memory.dmp

memory/3052-58-0x00007FFB51730000-0x00007FFB51741000-memory.dmp

memory/3052-56-0x00007FFB52CB0000-0x00007FFB52CC1000-memory.dmp

memory/3052-57-0x00007FFB52C90000-0x00007FFB52CAD000-memory.dmp

memory/3052-51-0x00007FFB50A70000-0x00007FFB50D26000-memory.dmp

memory/3052-55-0x00007FFB55830000-0x00007FFB55847000-memory.dmp

memory/3052-66-0x00007FFB51540000-0x00007FFB5155B000-memory.dmp

memory/3052-65-0x00007FFB51560000-0x00007FFB51571000-memory.dmp

memory/3052-63-0x00007FFB51670000-0x00007FFB51681000-memory.dmp

memory/3052-64-0x00007FFB51650000-0x00007FFB51661000-memory.dmp

memory/3052-59-0x00007FFB41BF0000-0x00007FFB41DFB000-memory.dmp

memory/3052-62-0x00007FFB51690000-0x00007FFB516A8000-memory.dmp

memory/3052-61-0x00007FFB516B0000-0x00007FFB516D1000-memory.dmp

memory/3052-60-0x00007FFB516E0000-0x00007FFB51721000-memory.dmp

memory/3052-54-0x00007FFB55850000-0x00007FFB55861000-memory.dmp

memory/3052-53-0x00007FFB55BF0000-0x00007FFB55C07000-memory.dmp

memory/3052-52-0x00007FFB56910000-0x00007FFB56928000-memory.dmp

memory/4784-70-0x0000000000400000-0x0000000000470000-memory.dmp

memory/4784-91-0x0000000000400000-0x0000000000470000-memory.dmp

memory/3052-96-0x00007FFB50A70000-0x00007FFB50D26000-memory.dmp