Malware Analysis Report

2025-04-03 10:15

Sample ID 250202-r57mpswlgt
Target JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c
SHA256 94bfdd9963e0a7fe4ee4488edbeebbd5b0d69fc8f5325f4006f159d4e2067236
Tags
blackshades defense_evasion discovery persistence rat upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

94bfdd9963e0a7fe4ee4488edbeebbd5b0d69fc8f5325f4006f159d4e2067236

Threat Level: Known bad

The file JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c was found to be: Known bad.

Malicious Activity Summary

blackshades defense_evasion discovery persistence rat upx

Modifies firewall policy service

Blackshades payload

Blackshades family

Blackshades

Adds policy Run key to start application

Boot or Logon Autostart Execution: Active Setup

Disables Task Manager via registry modification

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

UPX packed file

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Modifies registry key

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-02 14:47

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-02 14:47

Reported

2025-02-02 14:50

Platform

win7-20240708-en

Max time kernel

148s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BFC191A4-B8A2-DD91-DFA0-BBF8AC208669}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{BFC191A4-B8A2-DD91-DFA0-BBF8AC208669} C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Active Setup\Installed Components\{BFC191A4-B8A2-DD91-DFA0-BBF8AC208669}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BFC191A4-B8A2-DD91-DFA0-BBF8AC208669} C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A

Disables Task Manager via registry modification

defense_evasion

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\QRZKKZG2H5D2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\adesao.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\QRZKKZG2H5D2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX0\adesao.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2428 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe
PID 2428 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe
PID 2428 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe
PID 2428 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe
PID 2428 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe
PID 2428 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe
PID 2428 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe
PID 2428 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe
PID 2428 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe
PID 2428 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe
PID 1932 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\QRZKKZG2H5D2.exe
PID 1932 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\QRZKKZG2H5D2.exe
PID 1932 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\QRZKKZG2H5D2.exe
PID 1932 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\QRZKKZG2H5D2.exe
PID 1932 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\QRZKKZG2H5D2.exe
PID 1932 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\QRZKKZG2H5D2.exe
PID 1932 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\QRZKKZG2H5D2.exe
PID 2772 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\QRZKKZG2H5D2.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\adesao.exe
PID 2772 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\QRZKKZG2H5D2.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\adesao.exe
PID 2772 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\QRZKKZG2H5D2.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\adesao.exe
PID 2772 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\QRZKKZG2H5D2.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\adesao.exe
PID 2772 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\QRZKKZG2H5D2.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\adesao.exe
PID 2772 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\QRZKKZG2H5D2.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\adesao.exe
PID 2772 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\QRZKKZG2H5D2.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\adesao.exe
PID 1932 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 1932 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 1932 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 1932 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 1932 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 1932 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 1932 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 1932 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 1932 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 1932 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 1932 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 1932 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 1932 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 1932 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 1932 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 1932 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2884 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2884 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2884 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 2568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 2568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 2568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 2568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2896 wrote to memory of 3000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2896 wrote to memory of 3000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2896 wrote to memory of 3000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2896 wrote to memory of 3000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2672 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2672 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2672 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2672 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe"

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe

C:\Users\Admin\AppData\Local\Temp\QRZKKZG2H5D2.exe

C:\Users\Admin\AppData\Local\Temp\QRZKKZG2H5D2.exe

C:\Users\Admin\AppData\Local\Temp\RarSFX0\adesao.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\adesao.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
BR 201.25.28.9:80 tcp
US 8.8.8.8:53 blackxpazit.no-ip.biz udp
ID 212.117.48.248:3080 blackxpazit.no-ip.biz tcp
ID 212.117.48.248:3080 blackxpazit.no-ip.biz tcp
ID 212.117.48.248:3080 blackxpazit.no-ip.biz tcp
ID 212.117.48.248:3080 blackxpazit.no-ip.biz tcp
US 8.8.8.8:53 blackxpazit.no-ip.biz udp
ID 212.117.48.248:3080 blackxpazit.no-ip.biz tcp
ID 212.117.48.248:3080 blackxpazit.no-ip.biz tcp
ID 212.117.48.248:3080 blackxpazit.no-ip.biz tcp
ID 212.117.48.248:3080 blackxpazit.no-ip.biz tcp
US 8.8.8.8:53 blackxpazit.no-ip.biz udp
ID 212.117.48.248:3080 blackxpazit.no-ip.biz tcp
ID 212.117.48.248:3080 blackxpazit.no-ip.biz tcp

Files

memory/1932-2-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1932-5-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1932-7-0x0000000000400000-0x0000000000473000-memory.dmp

\Users\Admin\AppData\Local\Temp\QRZKKZG2H5D2.exe

MD5 365bae074103249a8d9e9d78420faa35
SHA1 8186a7a60a484c89af570c97445f0e7cbdfc1265
SHA256 fe089ab38a0025ed758f1e2d43d8da8718a5504da9762a4f9edfc848a03eb971
SHA512 1e8b4cdbb8333b34737904ef48922af9b26e0a108803d98255f077cf29f51dcec68522e01af63ce4deaf660518e0d8c0ba99c78901b16cccf887e86d635eb4e6

C:\Users\Admin\AppData\Local\Temp\RarSFX0\adesao.exe

MD5 fa412c664195d371f93ccc6eb221c7fb
SHA1 9d302f2d5dce64ffab3e805191ea1cd8a9068cb1
SHA256 56b36a3647984401cdbcbe9d03120622d1ee757abb6a877df24514c2c013cf20
SHA512 5af667faa938b5b1f8fa21b3883b13834935a0190ff5850ac66299de34227be1dc65277f772881d07cef4cf332115e93f10e1174e6dbeca6c6abadbd3043c12c

memory/1932-26-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2792-28-0x0000000000400000-0x00000000005A9000-memory.dmp

memory/1932-29-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1932-32-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2792-33-0x0000000000400000-0x00000000005A9000-memory.dmp

memory/1932-34-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1932-36-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1932-39-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1932-43-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1932-46-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1932-48-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1932-50-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1932-53-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1932-55-0x0000000000400000-0x0000000000473000-memory.dmp

memory/1932-57-0x0000000000400000-0x0000000000473000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-02 14:47

Reported

2025-02-02 14:50

Platform

win10v2004-20241007-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BFC191A4-B8A2-DD91-DFA0-BBF8AC208669}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{BFC191A4-B8A2-DD91-DFA0-BBF8AC208669} C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{BFC191A4-B8A2-DD91-DFA0-BBF8AC208669}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BFC191A4-B8A2-DD91-DFA0-BBF8AC208669} C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A

Disables Task Manager via registry modification

defense_evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\HPFA2G31Z.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\HPFA2G31Z.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\adesao.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX0\adesao.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\HPFA2G31Z.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 816 wrote to memory of 4196 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe
PID 816 wrote to memory of 4196 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe
PID 816 wrote to memory of 4196 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe
PID 816 wrote to memory of 4196 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe
PID 816 wrote to memory of 4196 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe
PID 816 wrote to memory of 4196 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe
PID 816 wrote to memory of 4196 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe
PID 816 wrote to memory of 4196 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe
PID 816 wrote to memory of 4196 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe
PID 4196 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\HPFA2G31Z.exe
PID 4196 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\HPFA2G31Z.exe
PID 4196 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Users\Admin\AppData\Local\Temp\HPFA2G31Z.exe
PID 4196 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 4196 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 4196 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 4196 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 4196 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 4196 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 4196 wrote to memory of 3632 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 4196 wrote to memory of 3632 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 4196 wrote to memory of 3632 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 4196 wrote to memory of 3604 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 4196 wrote to memory of 3604 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 4196 wrote to memory of 3604 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 3024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4120 wrote to memory of 3024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4120 wrote to memory of 3024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3732 wrote to memory of 3048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3732 wrote to memory of 3048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3732 wrote to memory of 3048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3632 wrote to memory of 3036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3632 wrote to memory of 3036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3632 wrote to memory of 3036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3604 wrote to memory of 1924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3604 wrote to memory of 1924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3604 wrote to memory of 1924 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1360 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\HPFA2G31Z.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\adesao.exe
PID 1360 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\HPFA2G31Z.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\adesao.exe
PID 1360 wrote to memory of 452 N/A C:\Users\Admin\AppData\Local\Temp\HPFA2G31Z.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\adesao.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe"

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe

C:\Users\Admin\AppData\Local\Temp\HPFA2G31Z.exe

C:\Users\Admin\AppData\Local\Temp\HPFA2G31Z.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dde2cadb794e170aadfa6453a767d3c.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Users\Admin\AppData\Local\Temp\RarSFX0\adesao.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\adesao.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 blackxpazit.no-ip.biz udp
ID 212.117.48.248:3080 blackxpazit.no-ip.biz tcp
BR 201.25.28.9:80 tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 167.173.78.104.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
ID 212.117.48.248:3080 blackxpazit.no-ip.biz tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
ID 212.117.48.248:3080 blackxpazit.no-ip.biz tcp
ID 212.117.48.248:3080 blackxpazit.no-ip.biz tcp
US 8.8.8.8:53 blackxpazit.no-ip.biz udp
ID 212.117.48.248:3080 blackxpazit.no-ip.biz tcp
ID 212.117.48.248:3080 blackxpazit.no-ip.biz tcp
ID 212.117.48.248:3080 blackxpazit.no-ip.biz tcp
ID 212.117.48.248:3080 blackxpazit.no-ip.biz tcp
US 8.8.8.8:53 blackxpazit.no-ip.biz udp
ID 212.117.48.248:3080 blackxpazit.no-ip.biz tcp
ID 212.117.48.248:3080 blackxpazit.no-ip.biz tcp

Files

memory/4196-7-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4196-5-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4196-4-0x0000000000400000-0x0000000000473000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HPFA2G31Z.exe

MD5 365bae074103249a8d9e9d78420faa35
SHA1 8186a7a60a484c89af570c97445f0e7cbdfc1265
SHA256 fe089ab38a0025ed758f1e2d43d8da8718a5504da9762a4f9edfc848a03eb971
SHA512 1e8b4cdbb8333b34737904ef48922af9b26e0a108803d98255f077cf29f51dcec68522e01af63ce4deaf660518e0d8c0ba99c78901b16cccf887e86d635eb4e6

memory/4196-19-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4196-20-0x0000000000400000-0x0000000000473000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\adesao.exe

MD5 fa412c664195d371f93ccc6eb221c7fb
SHA1 9d302f2d5dce64ffab3e805191ea1cd8a9068cb1
SHA256 56b36a3647984401cdbcbe9d03120622d1ee757abb6a877df24514c2c013cf20
SHA512 5af667faa938b5b1f8fa21b3883b13834935a0190ff5850ac66299de34227be1dc65277f772881d07cef4cf332115e93f10e1174e6dbeca6c6abadbd3043c12c

memory/4196-28-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4196-29-0x0000000000400000-0x0000000000473000-memory.dmp

memory/452-33-0x0000000000400000-0x00000000005A9000-memory.dmp

memory/4196-34-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4196-39-0x0000000000400000-0x0000000000473000-memory.dmp

memory/452-42-0x0000000000400000-0x00000000005A9000-memory.dmp

memory/4196-43-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4196-47-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4196-52-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4196-56-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4196-60-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4196-64-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4196-69-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4196-73-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4196-78-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4196-82-0x0000000000400000-0x0000000000473000-memory.dmp

memory/4196-86-0x0000000000400000-0x0000000000473000-memory.dmp