Malware Analysis Report

2025-04-03 10:15

Sample ID 250202-qzkqbatpav
Target 06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe
SHA256 06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6
Tags
blackshades defense_evasion discovery persistence rat upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6

Threat Level: Known bad

The file 06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe was found to be: Known bad.

Malicious Activity Summary

blackshades defense_evasion discovery persistence rat upx

Blackshades

Modifies firewall policy service

Blackshades payload

Blackshades family

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

UPX packed file

Suspicious use of SetThreadContext

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Modifies registry key

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-02 13:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-02 13:41

Reported

2025-02-02 13:44

Platform

win7-20241010-en

Max time kernel

119s

Max time network

19s

Command Line

"C:\Users\Admin\AppData\Local\Temp\06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java Machine = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3000 set thread context of 3016 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3000 set thread context of 1048 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2792 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe C:\Windows\SysWOW64\cmd.exe
PID 2792 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe C:\Windows\SysWOW64\cmd.exe
PID 2792 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe C:\Windows\SysWOW64\cmd.exe
PID 2792 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe C:\Windows\SysWOW64\cmd.exe
PID 2840 wrote to memory of 2916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2840 wrote to memory of 2916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2840 wrote to memory of 2916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2840 wrote to memory of 2916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2792 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2792 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2792 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2792 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3000 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3000 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3000 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3000 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3000 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3000 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3000 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3000 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3000 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3000 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3000 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3000 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3000 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3000 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3000 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3000 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3000 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3000 wrote to memory of 1048 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3016 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3016 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2596 wrote to memory of 1292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2596 wrote to memory of 1292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2596 wrote to memory of 1292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2596 wrote to memory of 1292 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2692 wrote to memory of 1172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2692 wrote to memory of 1172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2692 wrote to memory of 1172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2692 wrote to memory of 1172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2356 wrote to memory of 2396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2356 wrote to memory of 2396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2356 wrote to memory of 2396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2356 wrote to memory of 2396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2588 wrote to memory of 2108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2588 wrote to memory of 2108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2588 wrote to memory of 2108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2588 wrote to memory of 2108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe

"C:\Users\Admin\AppData\Local\Temp\06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\yKhYE.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java Machine" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /f

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

"C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe"

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 jingerred2.no-ip.biz udp

Files

memory/2792-0-0x0000000000400000-0x00000000005A4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\yKhYE.bat

MD5 976ffa9a304b234c039c8739d97bb893
SHA1 f70f7ede8b6e5d1b8a9b53c9bf43882485b55bd6
SHA256 2b77cf051bb584aada8b9e5e07cba06e2077b42f009c33d10e31994ceec10384
SHA512 1bd398b968736efbab740c81776781023a4ef0dc1c0191d6393a7582bd79b452666163691d82a27ee8989a1e293e6d6df57c303aa9b34497ae52be417f9e269c

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

MD5 0f93ae61a9f7749145ed4f68276c39b3
SHA1 ae25c84a3bb6f03282663325889238c35aef4bf5
SHA256 683695d9284c1cc09a5c0f6ecfa22d8c2be7867532d85f856d48d9eddb873294
SHA512 85efc8649ada4c8bd48dae7f727a6860ff65fa23b7be64246f8a8668fd9019cefe69744edacae8e0e30756087d744ebb3ac82756ffde90f525be293489a39ea6

memory/3016-47-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1048-55-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1048-52-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3016-51-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3016-50-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1048-57-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1048-60-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3016-65-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1048-66-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3016-67-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3016-69-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3016-71-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3016-74-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3016-78-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3016-81-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3016-83-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3016-88-0x0000000000400000-0x000000000045C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-02 13:41

Reported

2025-02-02 13:43

Platform

win10v2004-20250129-en

Max time kernel

119s

Max time network

109s

Command Line

"C:\Users\Admin\AppData\Local\Temp\06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Machine = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2084 set thread context of 4984 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2084 set thread context of 4240 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4204 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe C:\Windows\SysWOW64\cmd.exe
PID 4204 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe C:\Windows\SysWOW64\cmd.exe
PID 4204 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 4252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2120 wrote to memory of 4252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2120 wrote to memory of 4252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4204 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 4204 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 4204 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2084 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2084 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2084 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2084 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2084 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2084 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2084 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2084 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2084 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2084 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2084 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2084 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2084 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2084 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2084 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 4984 wrote to memory of 216 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 216 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 216 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2084 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 216 wrote to memory of 4708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 216 wrote to memory of 4708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 216 wrote to memory of 4708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5100 wrote to memory of 3988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5100 wrote to memory of 3988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5100 wrote to memory of 3988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5004 wrote to memory of 3052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5004 wrote to memory of 3052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5004 wrote to memory of 3052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2028 wrote to memory of 4640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2028 wrote to memory of 4640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2028 wrote to memory of 4640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe

"C:\Users\Admin\AppData\Local\Temp\06863b373d281304477581572f862c37e9744adff8043c66c1a3796ab0c04ae6.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hgpol.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java Machine" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /f

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

"C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe"

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
GB 88.221.135.1:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 1.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
US 8.8.8.8:53 86.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
US 8.8.8.8:53 13.153.16.2.in-addr.arpa udp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 jingerred2.no-ip.biz udp

Files

memory/4204-0-0x0000000000400000-0x00000000005A4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\hgpol.txt

MD5 976ffa9a304b234c039c8739d97bb893
SHA1 f70f7ede8b6e5d1b8a9b53c9bf43882485b55bd6
SHA256 2b77cf051bb584aada8b9e5e07cba06e2077b42f009c33d10e31994ceec10384
SHA512 1bd398b968736efbab740c81776781023a4ef0dc1c0191d6393a7582bd79b452666163691d82a27ee8989a1e293e6d6df57c303aa9b34497ae52be417f9e269c

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.txt

MD5 304c6da022e560e9ec548cf6debe4edd
SHA1 0279d756decac65879fb7cd2691f022f68fe0ee3
SHA256 a1599533dfe3d03f113abe1e0fb4d773b92b563757f66a6c9ebb605ab62103f8
SHA512 afdd4f90b07c6471c65a42bd4b496366076d05c1017113af7c96479fbf200bc644b43b4a6f586f15110771be25314abc7782fe0ab05f40b5d9cf777a3c14be84

memory/4984-31-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4984-36-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4984-34-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4240-42-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4240-45-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4240-47-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4984-50-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4240-51-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4984-52-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4984-54-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4984-57-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4984-59-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4984-61-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4984-64-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4984-66-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4984-70-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4984-73-0x0000000000400000-0x000000000045C000-memory.dmp