Malware Analysis Report

2025-04-03 10:17

Sample ID 250202-gyzcmsyqdx
Target efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe
SHA256 efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160
Tags
upx blackshades defense_evasion discovery persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160

Threat Level: Known bad

The file efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe was found to be: Known bad.

Malicious Activity Summary

upx blackshades defense_evasion discovery persistence rat

Modifies firewall policy service

Blackshades family

Blackshades

Blackshades payload

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

UPX packed file

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Modifies registry key

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-02 06:13

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-02 06:13

Reported

2025-02-02 06:15

Platform

win7-20241023-en

Max time kernel

119s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Java\uninstall.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Java\\uninstall.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Falaheye.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Falaheye.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java(TM) Platform SE Auto Updator 2.1 = "C:\\Users\\Admin\\AppData\\Roaming\\Java\\uninstall.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2880 set thread context of 2708 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 set thread context of 2960 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2120 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 2184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1048 wrote to memory of 2184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1048 wrote to memory of 2184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1048 wrote to memory of 2184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2120 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2120 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2120 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2120 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2120 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2120 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2120 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2880 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2708 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe

"C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\IXfHW.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java(TM) Platform SE Auto Updator 2.1" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /f

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

"C:\Users\Admin\AppData\Roaming\Java\uninstall.exe"

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Falaheye.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Falaheye.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Falaheye.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Falaheye.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 lolitsbroward.no-ip.org udp

Files

memory/2120-0-0x0000000000400000-0x000000000065F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXfHW.bat

MD5 0f9512ff58185a551abc4fa80ffde3b5
SHA1 eb2df1adbb3504236d2857d8a9c297121c97a95d
SHA256 79747cbd0b884c6870d0ab8b90e4b64af598f1c1c97b2eb31c1fc1a1d6128189
SHA512 1f7216ce7cd2e1ae6e30c7d6d0f84b3a7a637c6cfe9568a10ffa802b99a832b3e4f45c7bd02cbbe70665e79ea917e7e9ac9a38ceaf469836fb207a47ef52ff3e

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

MD5 f6ec77ef7f73666cf3e9c101e546dacb
SHA1 fd430aec4b374cbda47b779e3b61032b0232e748
SHA256 e543ded388d58d2be828b51b1f7b8ac5d4ac066ea75a84f86cad6e4550299bee
SHA512 6d917e53ea2c8024432bdd538c8512c3bf072765009b468a4b6bb2150883883fa6e77ed1f73042bcf1f1344f2f810779eebe8d2699e12a24ace05b00ff5cd93b

memory/2120-39-0x0000000003130000-0x000000000338F000-memory.dmp

memory/2120-43-0x0000000000400000-0x000000000065F000-memory.dmp

memory/2880-42-0x0000000000400000-0x000000000065F000-memory.dmp

memory/2880-47-0x0000000000CB0000-0x0000000000F0F000-memory.dmp

memory/2880-51-0x0000000002ED0000-0x000000000312F000-memory.dmp

memory/2708-52-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2708-73-0x0000000000A60000-0x0000000000CBF000-memory.dmp

memory/2960-77-0x0000000000CB0000-0x0000000000F0F000-memory.dmp

memory/2880-80-0x0000000000400000-0x000000000065F000-memory.dmp

memory/2960-76-0x0000000000CB0000-0x0000000000F0F000-memory.dmp

memory/2960-75-0x0000000000CB0000-0x0000000000F0F000-memory.dmp

memory/2708-74-0x0000000000A60000-0x0000000000CBF000-memory.dmp

memory/2708-71-0x0000000000A60000-0x0000000000CBF000-memory.dmp

memory/2960-68-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2960-67-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2960-63-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2960-61-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2708-59-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2708-55-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2708-60-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2708-83-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2708-84-0x0000000000A60000-0x0000000000CBF000-memory.dmp

memory/2960-85-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2708-88-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2708-90-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2708-93-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2708-95-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2708-97-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2708-100-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2708-102-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2708-107-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2708-109-0x0000000000400000-0x000000000045C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-02 06:13

Reported

2025-02-02 06:15

Platform

win10v2004-20250129-en

Max time kernel

119s

Max time network

110s

Command Line

"C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Falaheye.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Falaheye.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Java\uninstall.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Java\\uninstall.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3625106387-4207083342-115176794-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3625106387-4207083342-115176794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java(TM) Platform SE Auto Updator 2.1 = "C:\\Users\\Admin\\AppData\\Roaming\\Java\\uninstall.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2684 set thread context of 2168 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2684 set thread context of 3972 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2296 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe C:\Windows\SysWOW64\cmd.exe
PID 2296 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe C:\Windows\SysWOW64\cmd.exe
PID 2296 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe C:\Windows\SysWOW64\cmd.exe
PID 4308 wrote to memory of 5016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4308 wrote to memory of 5016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4308 wrote to memory of 5016 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2296 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2296 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2296 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2684 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2684 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2684 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2684 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2684 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2684 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2684 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2684 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2684 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2684 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2684 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2684 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2684 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2684 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2684 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2684 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
PID 2168 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2168 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2168 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2168 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2168 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2168 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2168 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2168 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2168 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2168 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2168 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 2168 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Roaming\Java\uninstall.exe C:\Windows\SysWOW64\cmd.exe
PID 3200 wrote to memory of 3004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3200 wrote to memory of 3004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3200 wrote to memory of 3004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2948 wrote to memory of 2832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2948 wrote to memory of 2832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2948 wrote to memory of 2832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5072 wrote to memory of 3008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5072 wrote to memory of 3008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5072 wrote to memory of 3008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3304 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3304 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3304 wrote to memory of 2760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe

"C:\Users\Admin\AppData\Local\Temp\efc4019bd52f530a9736e54a8162dad1c95db08a31f1d9d232536c279af2b160.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qZEDo.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java(TM) Platform SE Auto Updator 2.1" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /f

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

"C:\Users\Admin\AppData\Roaming\Java\uninstall.exe"

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Falaheye.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Falaheye.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Falaheye.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Falaheye.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 128.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 13.153.16.2.in-addr.arpa udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 lolitsbroward.no-ip.org udp

Files

memory/2296-0-0x0000000000400000-0x000000000065F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\qZEDo.txt

MD5 0f9512ff58185a551abc4fa80ffde3b5
SHA1 eb2df1adbb3504236d2857d8a9c297121c97a95d
SHA256 79747cbd0b884c6870d0ab8b90e4b64af598f1c1c97b2eb31c1fc1a1d6128189
SHA512 1f7216ce7cd2e1ae6e30c7d6d0f84b3a7a637c6cfe9568a10ffa802b99a832b3e4f45c7bd02cbbe70665e79ea917e7e9ac9a38ceaf469836fb207a47ef52ff3e

C:\Users\Admin\AppData\Roaming\Java\uninstall.txt

MD5 62e78110b29a7a00a1e221bacfdccf55
SHA1 ef20b97717b4dfeb08b3d6e44e5fbe738290c504
SHA256 358b08ba86dd1c8b3286c424c538a636e24b17b1dbd1ca2d12564a8e5b7ad7fb
SHA512 aaa872108f7a74be3d12dc1704b320c5e5876c15aac8fa373e0e9887f8b167b92d4b54c26b632cb1427de1a4e1b41d48fe475ed8edfd14e6e83b5bab1311486b

memory/2296-30-0x0000000000400000-0x000000000065F000-memory.dmp

memory/2168-31-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2168-36-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2168-34-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3972-44-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2684-48-0x0000000000400000-0x000000000065F000-memory.dmp

memory/3972-40-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3972-37-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2168-51-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3972-52-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2168-53-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2168-55-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2168-58-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2168-60-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2168-62-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2168-67-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2168-69-0x0000000000400000-0x000000000045C000-memory.dmp