blackshades | 1fc172bb6f72f2b6afb8da6f6252718075b33d7d57faa6d2e7075e517049f605

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2025 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Size

440KB
MD5

776ce4d5ef7ed885dacfb5af665f7f65
SHA1

6c4bd1b3bd67a9a5b26f046a8bb64594af99daab
SHA256

1fc172bb6f72f2b6afb8da6f6252718075b33d7d57faa6d2e7075e517049f605
SHA512

02f62d17a51f44b525310c56250c2679915d3b06f413769818b4441f97707200b76ab7defe7aeeafdd50cb62f455bd9e2063c0cc9981ea14243a37e507303211
SSDEEP

6144:vG78LjzOANvSAsQLqF9pXMiY3sGB6UduRfLtc1kKDuw:+7kmAN6omFMb3sGB6UduRfLa1X

Score

10^/10

blackshades defense_evasion discovery persistence rat upx

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 13 IoCs

resource	yara_rule
behavioral2/memory/2860-0-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades
behavioral2/memory/2860-8-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades
behavioral2/memory/2860-9-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades
behavioral2/memory/2860-11-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades
behavioral2/memory/2860-12-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades
behavioral2/memory/2860-13-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades
behavioral2/memory/2860-15-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades
behavioral2/memory/2860-16-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades
behavioral2/memory/2860-19-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades
behavioral2/memory/2860-20-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades
behavioral2/memory/2860-21-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades
behavioral2/memory/2860-24-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades
behavioral2/memory/2860-25-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades

Modifies firewall policy service 3 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\testy2.exe = "C:\\Users\\Admin\\AppData\\Roaming\\testy2.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\testy2.exe"	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D95BFBD4-CEFC-DACB-2A2D-90FFBBAFF3BE}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\testy2.exe"	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Key created	\REGISTRY\USER\S-1-5-21-1412605595-2147700071-3468511006-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{D95BFBD4-CEFC-DACB-2A2D-90FFBBAFF3BE}	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1412605595-2147700071-3468511006-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{D95BFBD4-CEFC-DACB-2A2D-90FFBBAFF3BE}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\testy2.exe"	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D95BFBD4-CEFC-DACB-2A2D-90FFBBAFF3BE}	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe

Executes dropped EXE 1 IoCs

pid	Process
4032	4L3K87S6OGJO4H.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1412605595-2147700071-3468511006-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\testy2.exe"	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\testy2.exe"	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2860-0-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/2860-8-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/2860-9-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/2860-11-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/2860-12-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/2860-13-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/2860-15-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/2860-16-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/2860-19-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/2860-20-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/2860-21-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/2860-24-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/2860-25-0x0000000000400000-0x000000000045D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4L3K87S6OGJO4H.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
4840	reg.exe
4532	reg.exe
4520	reg.exe
1936	reg.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: 1	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeCreateTokenPrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeAssignPrimaryTokenPrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeLockMemoryPrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeIncreaseQuotaPrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeMachineAccountPrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeTcbPrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeSecurityPrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeTakeOwnershipPrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeLoadDriverPrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeSystemProfilePrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeSystemtimePrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeProfSingleProcessPrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeIncBasePriorityPrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeCreatePagefilePrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeCreatePermanentPrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeBackupPrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeRestorePrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeShutdownPrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeDebugPrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeAuditPrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeSystemEnvironmentPrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeChangeNotifyPrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeRemoteShutdownPrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeUndockPrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeSyncAgentPrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeEnableDelegationPrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeManageVolumePrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeImpersonatePrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: SeCreateGlobalPrivilege	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: 31	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: 32	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: 33	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: 34	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
Token: 35	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 4032	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe	84
PID 2860 wrote to memory of 4032	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe	84
PID 2860 wrote to memory of 4032	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe	84
PID 2860 wrote to memory of 4848	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe	85
PID 2860 wrote to memory of 4848	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe	85
PID 2860 wrote to memory of 4848	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe	85
PID 2860 wrote to memory of 2624	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe	87
PID 2860 wrote to memory of 2624	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe	87
PID 2860 wrote to memory of 2624	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe	87
PID 2860 wrote to memory of 5004	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe	88
PID 2860 wrote to memory of 5004	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe	88
PID 2860 wrote to memory of 5004	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe	88
PID 2860 wrote to memory of 2960	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe	89
PID 2860 wrote to memory of 2960	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe	89
PID 2860 wrote to memory of 2960	2860	JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe	89
PID 2624 wrote to memory of 4840	2624	cmd.exe	94
PID 2624 wrote to memory of 4840	2624	cmd.exe	94
PID 2624 wrote to memory of 4840	2624	cmd.exe	94
PID 2960 wrote to memory of 4532	2960	cmd.exe	95
PID 2960 wrote to memory of 4532	2960	cmd.exe	95
PID 2960 wrote to memory of 4532	2960	cmd.exe	95
PID 4848 wrote to memory of 4520	4848	cmd.exe	96
PID 4848 wrote to memory of 4520	4848	cmd.exe	96
PID 4848 wrote to memory of 4520	4848	cmd.exe	96
PID 5004 wrote to memory of 1936	5004	cmd.exe	97
PID 5004 wrote to memory of 1936	5004	cmd.exe	97
PID 5004 wrote to memory of 1936	5004	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe"
1⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\4L3K87S6OGJO4H.exe
  C:\Users\Admin\AppData\Local\Temp\4L3K87S6OGJO4H.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4032
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4520
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe:*:Enabled:Windows Messanger" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_776ce4d5ef7ed885dacfb5af665f7f65.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\testy2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\testy2.exe:*:Enabled:Windows Messanger" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\testy2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\testy2.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4L3K87S6OGJO4H.exe

Filesize
74KB

MD5
05d7543980ad0cea72df5ab66bcc34b6

SHA1
3966578d03efe8b1aeccda73055f989ceab80878

SHA256
698bab0ce72fb66f76d914970d9c214c5983eb117071ed627cd804b26b02a1f0

SHA512
55557cd717e96271b022fa129b58fc4a631c2eda5a55ac28edc8b565e2266d349f4eadfff5d507992784502f4968230aa6907d0b60e74189007e856cc240ea63

Download Submit
memory/2860-13-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2860-8-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2860-9-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2860-11-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2860-12-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2860-0-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2860-15-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2860-16-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2860-19-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2860-20-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2860-21-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2860-24-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2860-25-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads