blackshades | 001f9f11da02e10099ad21eff3fca1ec7b155b4efbc205ee9f100fe7c8a35622

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2025, 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe
Size

4.0MB
MD5

843418d201e93a3f3f41cc94f0b6841f
SHA1

690a37191f5f122e8b6ab5064d942cc18ec759f1
SHA256

001f9f11da02e10099ad21eff3fca1ec7b155b4efbc205ee9f100fe7c8a35622
SHA512

a57f0570a7dc57d814c99ca10e3768040ab32d8181aa85213a219457f0dc018992e16c1b47cea28b74b603f521f4ca23a89e3f5b5f067d770e105a9c14afd225
SSDEEP

98304:rOQ530RjmmafJZRNJlXpCK502oknqcYsy5G+MZr0MdOgcKJnT:rOQ53zmgvRNJl5CK/oSqcYsTTLcK5T

Score

10^/10

blackshades defense_evasion discovery persistence rat

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 9 IoCs

resource	yara_rule
behavioral2/memory/2756-29-0x0000000000400000-0x0000000000470000-memory.dmp	family_blackshades
behavioral2/memory/2756-42-0x0000000000400000-0x0000000000470000-memory.dmp	family_blackshades
behavioral2/memory/2756-66-0x0000000000400000-0x0000000000470000-memory.dmp	family_blackshades
behavioral2/memory/2756-67-0x0000000000400000-0x0000000000470000-memory.dmp	family_blackshades
behavioral2/memory/2756-70-0x0000000000400000-0x0000000000470000-memory.dmp	family_blackshades
behavioral2/memory/2756-71-0x0000000000400000-0x0000000000470000-memory.dmp	family_blackshades
behavioral2/memory/2756-73-0x0000000000400000-0x0000000000470000-memory.dmp	family_blackshades
behavioral2/memory/2756-74-0x0000000000400000-0x0000000000470000-memory.dmp	family_blackshades
behavioral2/memory/2756-75-0x0000000000400000-0x0000000000470000-memory.dmp	family_blackshades

Modifies firewall policy service 3 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\noinstall.exe = "C:\\Users\\Admin\\AppData\\Roaming\\noinstall.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\CMsk1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CMsk1.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000\Control Panel\International\Geo\Nation	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe

Executes dropped EXE 4 IoCs

pid	Process
3040	b6FC6.exe
2756	CMsk1.exe
1208	AngryBirdsSeasons.exe
4664	BGa7RW.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSE = "C:\\Users\\Admin\\AppData\\Local\\Temp\\javaw.exe"	b6FC6.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 552 set thread context of 2756	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMsk1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BGa7RW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b6FC6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AngryBirdsSeasons.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
4676	reg.exe
2652	reg.exe
2088	reg.exe
2040	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe
4664	BGa7RW.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe
Token: 1	2756	CMsk1.exe
Token: SeCreateTokenPrivilege	2756	CMsk1.exe
Token: SeAssignPrimaryTokenPrivilege	2756	CMsk1.exe
Token: SeLockMemoryPrivilege	2756	CMsk1.exe
Token: SeIncreaseQuotaPrivilege	2756	CMsk1.exe
Token: SeMachineAccountPrivilege	2756	CMsk1.exe
Token: SeTcbPrivilege	2756	CMsk1.exe
Token: SeSecurityPrivilege	2756	CMsk1.exe
Token: SeTakeOwnershipPrivilege	2756	CMsk1.exe
Token: SeLoadDriverPrivilege	2756	CMsk1.exe
Token: SeSystemProfilePrivilege	2756	CMsk1.exe
Token: SeSystemtimePrivilege	2756	CMsk1.exe
Token: SeProfSingleProcessPrivilege	2756	CMsk1.exe
Token: SeIncBasePriorityPrivilege	2756	CMsk1.exe
Token: SeCreatePagefilePrivilege	2756	CMsk1.exe
Token: SeCreatePermanentPrivilege	2756	CMsk1.exe
Token: SeBackupPrivilege	2756	CMsk1.exe
Token: SeRestorePrivilege	2756	CMsk1.exe
Token: SeShutdownPrivilege	2756	CMsk1.exe
Token: SeDebugPrivilege	2756	CMsk1.exe
Token: SeAuditPrivilege	2756	CMsk1.exe
Token: SeSystemEnvironmentPrivilege	2756	CMsk1.exe
Token: SeChangeNotifyPrivilege	2756	CMsk1.exe
Token: SeRemoteShutdownPrivilege	2756	CMsk1.exe
Token: SeUndockPrivilege	2756	CMsk1.exe
Token: SeSyncAgentPrivilege	2756	CMsk1.exe
Token: SeEnableDelegationPrivilege	2756	CMsk1.exe
Token: SeManageVolumePrivilege	2756	CMsk1.exe
Token: SeImpersonatePrivilege	2756	CMsk1.exe
Token: SeCreateGlobalPrivilege	2756	CMsk1.exe
Token: 31	2756	CMsk1.exe
Token: 32	2756	CMsk1.exe
Token: 33	2756	CMsk1.exe
Token: 34	2756	CMsk1.exe
Token: 35	2756	CMsk1.exe
Token: SeDebugPrivilege	4664	BGa7RW.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2756	CMsk1.exe
2756	CMsk1.exe
2756	CMsk1.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 1592	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	86
PID 552 wrote to memory of 1592	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	86
PID 552 wrote to memory of 1592	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	86
PID 1592 wrote to memory of 2876	1592	csc.exe	88
PID 1592 wrote to memory of 2876	1592	csc.exe	88
PID 1592 wrote to memory of 2876	1592	csc.exe	88
PID 552 wrote to memory of 3040	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	89
PID 552 wrote to memory of 3040	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	89
PID 552 wrote to memory of 3040	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	89
PID 552 wrote to memory of 1264	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	90
PID 552 wrote to memory of 1264	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	90
PID 552 wrote to memory of 1264	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	90
PID 552 wrote to memory of 2756	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	92
PID 552 wrote to memory of 2756	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	92
PID 552 wrote to memory of 2756	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	92
PID 552 wrote to memory of 2756	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	92
PID 552 wrote to memory of 2756	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	92
PID 552 wrote to memory of 2756	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	92
PID 552 wrote to memory of 2756	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	92
PID 552 wrote to memory of 2756	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	92
PID 552 wrote to memory of 1208	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	93
PID 552 wrote to memory of 1208	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	93
PID 552 wrote to memory of 1208	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	93
PID 1264 wrote to memory of 1192	1264	csc.exe	94
PID 1264 wrote to memory of 1192	1264	csc.exe	94
PID 1264 wrote to memory of 1192	1264	csc.exe	94
PID 2756 wrote to memory of 3292	2756	CMsk1.exe	95
PID 2756 wrote to memory of 3292	2756	CMsk1.exe	95
PID 2756 wrote to memory of 3292	2756	CMsk1.exe	95
PID 2756 wrote to memory of 1480	2756	CMsk1.exe	96
PID 2756 wrote to memory of 1480	2756	CMsk1.exe	96
PID 2756 wrote to memory of 1480	2756	CMsk1.exe	96
PID 2756 wrote to memory of 644	2756	CMsk1.exe	97
PID 2756 wrote to memory of 644	2756	CMsk1.exe	97
PID 2756 wrote to memory of 644	2756	CMsk1.exe	97
PID 2756 wrote to memory of 4556	2756	CMsk1.exe	98
PID 2756 wrote to memory of 4556	2756	CMsk1.exe	98
PID 2756 wrote to memory of 4556	2756	CMsk1.exe	98
PID 552 wrote to memory of 4664	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	104
PID 552 wrote to memory of 4664	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	104
PID 552 wrote to memory of 4664	552	JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe	104
PID 3292 wrote to memory of 4676	3292	cmd.exe	105
PID 3292 wrote to memory of 4676	3292	cmd.exe	105
PID 3292 wrote to memory of 4676	3292	cmd.exe	105
PID 4556 wrote to memory of 2652	4556	cmd.exe	106
PID 4556 wrote to memory of 2652	4556	cmd.exe	106
PID 4556 wrote to memory of 2652	4556	cmd.exe	106
PID 1480 wrote to memory of 2088	1480	cmd.exe	107
PID 1480 wrote to memory of 2088	1480	cmd.exe	107
PID 1480 wrote to memory of 2088	1480	cmd.exe	107
PID 644 wrote to memory of 2040	644	cmd.exe	108
PID 644 wrote to memory of 2040	644	cmd.exe	108
PID 644 wrote to memory of 2040	644	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_843418d201e93a3f3f41cc94f0b6841f.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\h4hg5wbj.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9AE9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9AE8.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2876
- C:\Users\Admin\AppData\Local\Temp\b6FC6.exe
  "C:\Users\Admin\AppData\Local\Temp\b6FC6.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3040
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eniuzdgq.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA00A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA009.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1192
- C:\Users\Admin\AppData\Local\Temp\CMsk1.exe
  C:\Users\Admin\AppData\Local\Temp\CMsk1.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3292
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4676
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\CMsk1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CMsk1.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1480
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\CMsk1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\CMsk1.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2088
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:644
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2040
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\noinstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\noinstall.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\noinstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\noinstall.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2652
- C:\Users\Admin\AppData\Local\Temp\AngryBirdsSeasons.exe
  "C:\Users\Admin\AppData\Local\Temp\AngryBirdsSeasons.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1208
- C:\Users\Admin\AppData\Local\Temp\BGa7RW.exe
  "C:\Users\Admin\AppData\Local\Temp\BGa7RW.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AngryBirdsSeasons.exe

Filesize
1.5MB

MD5
e987de1586ef2e544822b89957fbb842

SHA1
80e562c8f00806163ef93f91331882d430fba762

SHA256
9d1c3d99596ae3b66b31d17a1d586a8379deb9a76208a8fc6f1359a2653dbd19

SHA512
b506e638e2b72382e5367f4b60a6eac703de157a3fb02f31b8fd8b0288bbed90b7c0dab1f55706d1dfdbe6ee6adf3a5842a8e20083146e301dffeea403673782

Download Submit
C:\Users\Admin\AppData\Local\Temp\BGa7RW.exe

Filesize
20KB

MD5
dc711cd45f201e4a34978d92ebb5804e

SHA1
9c5c13c20e88e2292c90618800fe5353e1426fe8

SHA256
0e845ca27a25de729939d794f84a321b862c2b35072c9fe58199efac34f88d10

SHA512
e9e298c06031bfc13ff5fa69edbc85738c660ce7f63ae22684f1c10f23be46c54547e469c989b91703d9c3f936926f05131800bf38930fa8f22af0a07917c768

Download Submit
C:\Users\Admin\AppData\Local\Temp\CMsk1.exe

Filesize
34KB

MD5
e118330b4629b12368d91b9df6488be0

SHA1
ce90218c7e3b90df2a3409ec253048bb6472c2fd

SHA256
3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9

SHA512
ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9AE9.tmp

Filesize
1KB

MD5
4a4b3957b29ed201fe3196dadf142cfe

SHA1
bab76367974fbb351a10fcadf042ba27eb096833

SHA256
0cc1e1f91f0965aa7559d4914ead7afc4a03455785aa1bde8378bbc851aa8593

SHA512
f024977dd510c595b13b15d6ecf55a88cb3ffb90e5f0aaa2758391bf7ec4a92176b6bf948b1755da7c62cc1a016d3c0a218f2616d81e68e1551556c2b542c94a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA00A.tmp

Filesize
1KB

MD5
628fbd672d7c8cd833d5cca006ba1615

SHA1
12dd838a8d66313221e4d22bfce15912fe570f48

SHA256
b8d092b6da6a93d0a9e296f8b0a618f634053a0907eacf0c7c39e17a67c79d4c

SHA512
d58dda65a1d0cfd388615af0e6d9c1c8ec48e7dcde00bfebd01987ce3e1eea0f95f4a57e452971c3b556dabaf554237c386769e87c9ccd323433460c907a2b79

Download Submit
C:\Users\Admin\AppData\Local\Temp\b6FC6.exe

Filesize
4KB

MD5
c9f8df07644d5af32589f3b24a742a80

SHA1
d91de36e9bd83ec222b5b4593a46f3ca83f70d66

SHA256
53583989ec762133823a67431337da8065a4f6652ec928a45861cf39aea696ef

SHA512
aac27fd9db6a8f4482e47f50ecac9d335f20df99a7621d432f99cabbb917c1ffe947a07744260c4b4e2458be6fe6e60c5b463fc37951d726b73b790ed19832d0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC9AE8.tmp

Filesize
636B

MD5
a1134e17cc7135288e52a56a0feda4ba

SHA1
6ecc9ef1d36c35134818fa8e830cc2d25c7b291f

SHA256
89ea30c4a1a47331dc335e884566201f716ca97a1af66963cb4f9647aeedea11

SHA512
3d9c1a20246c9ba286a953f9a16bb361c4220b12b7c4734c413c4008bcaaa91023253011e319d8f276aafe9fc99d5f0384af324ee9d98ad40f97a6a3a390904e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCA009.tmp

Filesize
644B

MD5
d9181a8d5ad15cea9bd83d124adfafe6

SHA1
5117311ee4365edc718331c4672974d112b7c30a

SHA256
d771893d41089369afd786e4eaf2187d5787ed24aef9ebdd597ea0dda34c8528

SHA512
77a94bf90e036ad1ae06b673fe82d0fe8218bc9731dcd3152e48b9910bc91f9ca048e4f0b35b2f3d8d73c43371baa5f8dcdfb1a1f8315e5f2842bf17ba5670ba

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\eniuzdgq.0.cs

Filesize
4KB

MD5
63e5aee854b95119845f32cfd50daeec

SHA1
411c321a68cfa2e79f2a3d541038f3f3441cf7c0

SHA256
2a4506735bf9c47a0b1ae39c467d3e839646aa2e698a7a6050c59dc034375580

SHA512
1216bb919425692e99c7a916cfe399f2c877523f03bd62f6ff23d79509ea42e5a41c62696a0abbb53cb0d1c31000e7d9432205ffeb38e9a19fbee3b99504f790

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\eniuzdgq.cmdline

Filesize
319B

MD5
a8e5d1cf4f3cbaea49ddc7ed2b7e5378

SHA1
d3ccbba7b9b0a2cd3454f41835e4de7d3840bbfa

SHA256
4d6454a0ec3974a13a9eb2d933c0fcbb7e87485d88839bf8a25a192535f73694

SHA512
fd4ae10b18345f15e2da8fa63c9a0b1b17b23a605cef0335187b4ba3376aabd1c201c2ac4e0a11b9b7247148b759f10a7e8ecb976510ca17656b184a7c342780

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\h4hg5wbj.0.cs

Filesize
1KB

MD5
a7afd4e117b8a9f37f12abe4c0a31fe1

SHA1
216cbd4090269590d1086e0560c2d901c8b89dfa

SHA256
0c3690324a85c67a4410624475c3c8ed0ef30e3866c238230f5011a03f527fd8

SHA512
0c329906ee8bc4864f68956852d2495cd1487f67a444d5b2e6b682501ed2472764a37f4956846e033685ece264c37afb20a783728088ddeab0c5f24d4975d751

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\h4hg5wbj.cmdline

Filesize
258B

MD5
d6bd853d2ca945fbb389edb2d5517aa3

SHA1
b44e3278515d73269bdda2c329965fd313d8d530

SHA256
f891fae53dfeb692ee807f3e44280262991ddb576bf9ff43290276f914c5d8e9

SHA512
593323d3404b5d7ac3ec4c3fe2cc67c714e3b4d16db413061d0d47fcc3136fdbffbcb173c1f9837ca24ad6efd9c9bda37ab61f22a9f3409d31f2e4e004919860

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\resource.resources

Filesize
15KB

MD5
201b2dbfc9f9906cf9c4b9117acbe283

SHA1
44f14fab1e5fae13a8c5026a0730c17b8c54c958

SHA256
3109e96501a07a3d837298681fbaacf5962b56810021293bd1cc1c2e7895064f

SHA512
db9a1cba1ff3fae70824f91ae12dc9a88a5b98d4d5bec5ad09edb3672408470bc9b18e51deec206c423edae4b166678d3b773cb3058d02e3d5ae7d2060466f85

Download Submit
memory/552-2-0x0000000075060000-0x0000000075611000-memory.dmp

Filesize
5.7MB

Download
memory/552-63-0x0000000075060000-0x0000000075611000-memory.dmp

Filesize
5.7MB

Download
memory/552-0-0x0000000075062000-0x0000000075063000-memory.dmp

Filesize
4KB

Download
memory/552-22-0x0000000075060000-0x0000000075611000-memory.dmp

Filesize
5.7MB

Download
memory/552-1-0x0000000075060000-0x0000000075611000-memory.dmp

Filesize
5.7MB

Download
memory/1592-15-0x0000000075060000-0x0000000075611000-memory.dmp

Filesize
5.7MB

Download
memory/1592-8-0x0000000075060000-0x0000000075611000-memory.dmp

Filesize
5.7MB

Download
memory/2756-29-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2756-42-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2756-66-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2756-67-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2756-70-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2756-71-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2756-73-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2756-74-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2756-75-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3040-64-0x0000000075060000-0x0000000075611000-memory.dmp

Filesize
5.7MB

Download
memory/3040-21-0x0000000075060000-0x0000000075611000-memory.dmp

Filesize
5.7MB

Download