Malware Analysis Report

2025-04-03 10:15

Sample ID 250203-gm2zdstqhn
Target JaffaCakes118_853694416d4e65bfb48751e6dfa19799
SHA256 a5658ff89cd6cfb5d279148677709ae7921fc90e37f745cb23ca852f6c604bdb
Tags
blackshades defense_evasion discovery persistence rat upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a5658ff89cd6cfb5d279148677709ae7921fc90e37f745cb23ca852f6c604bdb

Threat Level: Known bad

The file JaffaCakes118_853694416d4e65bfb48751e6dfa19799 was found to be: Known bad.

Malicious Activity Summary

blackshades defense_evasion discovery persistence rat upx

Modifies firewall policy service

Blackshades

Blackshades payload

Blackshades family

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

UPX packed file

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Modifies registry key

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-03 05:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-03 05:56

Reported

2025-02-03 05:58

Platform

win7-20240903-en

Max time kernel

150s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Services\down.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Services\\down.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\SyS64.exe = "C:\\Users\\Admin\\AppData\\Roaming\\SyS64.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\SySwow = "C:\\Users\\Admin\\AppData\\Roaming\\SyS64.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2128 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe
PID 2128 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe
PID 2128 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe
PID 2128 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe
PID 2128 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe
PID 2128 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe
PID 2128 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe
PID 2128 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe
PID 1536 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Windows\SysWOW64\cmd.exe
PID 1536 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Windows\SysWOW64\cmd.exe
PID 1536 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Windows\SysWOW64\cmd.exe
PID 1536 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Windows\SysWOW64\cmd.exe
PID 1760 wrote to memory of 2192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1760 wrote to memory of 2192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1760 wrote to memory of 2192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1760 wrote to memory of 2192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1536 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 1536 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 1536 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 1536 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 2152 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 2152 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 2152 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 2152 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 2152 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 2152 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 2152 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 2152 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 2152 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 2152 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 2152 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 2152 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 2152 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 2152 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 2152 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 2152 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 2164 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 2164 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 2164 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 2164 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 2164 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 2164 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 2164 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 2164 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 2164 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 2164 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 2164 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 2164 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 2164 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 2164 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 2164 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 2164 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 2732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2960 wrote to memory of 2732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2960 wrote to memory of 2732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2960 wrote to memory of 2732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2008 wrote to memory of 2200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2008 wrote to memory of 2200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2008 wrote to memory of 2200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2008 wrote to memory of 2200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2804 wrote to memory of 3056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2804 wrote to memory of 3056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2804 wrote to memory of 3056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2804 wrote to memory of 3056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe"

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\KPMAM.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SySwow" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SyS64.exe" /f

C:\Users\Admin\AppData\Roaming\SyS64.exe

"C:\Users\Admin\AppData\Roaming\SyS64.exe"

C:\Users\Admin\AppData\Roaming\SyS64.exe

"C:\Users\Admin\AppData\Roaming\SyS64.exe"

C:\Users\Admin\AppData\Roaming\SyS64.exe

"C:\Users\Admin\AppData\Roaming\SyS64.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\SyS64.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SyS64.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Services\down.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Services\down.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\SyS64.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SyS64.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Services\down.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Services\down.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 r3dz80.no-ip.biz udp
US 8.8.8.8:53 1r3dz80.no-ip.biz udp
US 8.8.8.8:53 2r3dz80.no-ip.biz udp
US 8.8.8.8:53 3r3dz80.no-ip.biz udp
FR 78.159.135.230:100 3r3dz80.no-ip.biz tcp
US 8.8.8.8:53 4r3dz80.no-ip.biz udp

Files

memory/2128-4-0x00000000002F0000-0x00000000002F1000-memory.dmp

memory/2128-2-0x00000000002F0000-0x00000000002F1000-memory.dmp

memory/2128-14-0x0000000000310000-0x0000000000311000-memory.dmp

memory/2128-26-0x0000000000330000-0x0000000000331000-memory.dmp

memory/2128-38-0x0000000000350000-0x0000000000351000-memory.dmp

memory/2128-58-0x00000000003A0000-0x00000000003A1000-memory.dmp

memory/2128-68-0x00000000003C0000-0x00000000003C1000-memory.dmp

memory/2128-76-0x00000000003E0000-0x00000000003E2000-memory.dmp

memory/2128-83-0x00000000003F0000-0x00000000003F2000-memory.dmp

memory/2128-81-0x00000000003E0000-0x00000000003E2000-memory.dmp

memory/2128-109-0x00000000003E0000-0x00000000003E2000-memory.dmp

memory/2128-104-0x0000000001DC0000-0x0000000001DC2000-memory.dmp

memory/2128-129-0x0000000001E60000-0x0000000001E62000-memory.dmp

memory/2128-128-0x0000000000480000-0x0000000000482000-memory.dmp

memory/2128-121-0x0000000000470000-0x0000000000472000-memory.dmp

memory/2128-114-0x00000000003F0000-0x00000000003F2000-memory.dmp

memory/1536-140-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1536-132-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1536-130-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\KPMAM.bat

MD5 5b73812a675d19256af6b78487d52fb9
SHA1 0ea28ab32f397e25345b000b5be473e48cdf4f8e
SHA256 ff8b1345627191036f58d176d5a719d06526383b777a28b3f931a468926bbe24
SHA512 a48fbc5cbc0a5e066f3021277e8237cfc581f512be411a1225a1a0a95cc5cd3251dadce960d37d5607b6084e6a6908c14456edc78a465513d656b2ec39ba7efe

\Users\Admin\AppData\Roaming\SyS64.exe

MD5 bfb3c380ce1d62f7e877d17e459e088f
SHA1 6b40b89f151d5b4a73ac1286468193fbe4a39824
SHA256 4446397a4a777d021c34322a05bf460a87c23226dfe8f2430312a350622673ea
SHA512 70d22c851a6b06d6473b6dc7790383cd6d3849b2ed332ce80d4d058d3668a4cf1929eeea5f35ede5bbd869cf7765d90f5f6335a676f93185b992cec2e2725610

memory/1536-183-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1748-304-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1536-319-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2164-316-0x0000000000400000-0x000000000047C000-memory.dmp

memory/1748-320-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2164-323-0x0000000000400000-0x000000000047C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-03 05:56

Reported

2025-02-03 05:58

Platform

win10v2004-20250129-en

Max time kernel

149s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Services\down.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Services\\down.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\SyS64.exe = "C:\\Users\\Admin\\AppData\\Roaming\\SyS64.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SySwow = "C:\\Users\\Admin\\AppData\\Roaming\\SyS64.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SyS64.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4004 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe
PID 4004 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe
PID 4004 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe
PID 4004 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe
PID 4004 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe
PID 4004 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe
PID 4004 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe
PID 4004 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe
PID 840 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Windows\SysWOW64\cmd.exe
PID 840 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Windows\SysWOW64\cmd.exe
PID 840 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Windows\SysWOW64\cmd.exe
PID 4268 wrote to memory of 468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4268 wrote to memory of 468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4268 wrote to memory of 468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 840 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 840 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 840 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 4580 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 4580 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 4580 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 4580 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 4580 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 4580 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 4580 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 4580 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 4580 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 4580 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 4580 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 4580 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 4580 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 4580 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 4580 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 4580 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Users\Admin\AppData\Roaming\SyS64.exe
PID 3836 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 3836 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 3836 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 3836 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 3836 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 3836 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 3836 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 3836 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 3836 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 3836 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 3836 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 3836 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Roaming\SyS64.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 2804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2060 wrote to memory of 2804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2060 wrote to memory of 2804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4332 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4332 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4332 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2472 wrote to memory of 364 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2472 wrote to memory of 364 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2472 wrote to memory of 364 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1584 wrote to memory of 3748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1584 wrote to memory of 3748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1584 wrote to memory of 3748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe"

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_853694416d4e65bfb48751e6dfa19799.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NAMUM.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SySwow" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SyS64.exe" /f

C:\Users\Admin\AppData\Roaming\SyS64.exe

"C:\Users\Admin\AppData\Roaming\SyS64.exe"

C:\Users\Admin\AppData\Roaming\SyS64.exe

"C:\Users\Admin\AppData\Roaming\SyS64.exe"

C:\Users\Admin\AppData\Roaming\SyS64.exe

"C:\Users\Admin\AppData\Roaming\SyS64.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\SyS64.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SyS64.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Services\down.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Services\down.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\SyS64.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SyS64.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Services\down.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Services\down.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 2.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
GB 2.18.27.82:443 www.bing.com tcp
US 8.8.8.8:53 13.153.16.2.in-addr.arpa udp
US 8.8.8.8:53 82.27.18.2.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 r3dz80.no-ip.biz udp
US 8.8.8.8:53 11.153.16.2.in-addr.arpa udp
US 8.8.8.8:53 r3dz80.no-ip.biz udp
US 8.8.8.8:53 1r3dz80.no-ip.biz udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 2r3dz80.no-ip.biz udp
US 8.8.8.8:53 3r3dz80.no-ip.biz udp
FR 78.159.135.230:100 3r3dz80.no-ip.biz tcp
US 8.8.8.8:53 4r3dz80.no-ip.biz udp

Files

memory/4004-2-0x0000000002300000-0x0000000002302000-memory.dmp

memory/4004-6-0x0000000002340000-0x0000000002342000-memory.dmp

memory/4004-5-0x0000000002330000-0x0000000002332000-memory.dmp

memory/4004-4-0x0000000002320000-0x0000000002322000-memory.dmp

memory/4004-3-0x0000000002310000-0x0000000002312000-memory.dmp

memory/4004-7-0x00000000023A0000-0x00000000023A2000-memory.dmp

memory/4004-9-0x00000000023D0000-0x00000000023D2000-memory.dmp

memory/4004-12-0x0000000002400000-0x0000000002402000-memory.dmp

memory/4004-11-0x00000000023F0000-0x00000000023F2000-memory.dmp

memory/4004-10-0x00000000023E0000-0x00000000023E2000-memory.dmp

memory/4004-8-0x00000000023C0000-0x00000000023C2000-memory.dmp

memory/840-13-0x0000000000400000-0x000000000040B000-memory.dmp

memory/840-15-0x0000000000400000-0x000000000040B000-memory.dmp

memory/840-18-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4004-17-0x0000000002300000-0x0000000002302000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\NAMUM.txt

MD5 5b73812a675d19256af6b78487d52fb9
SHA1 0ea28ab32f397e25345b000b5be473e48cdf4f8e
SHA256 ff8b1345627191036f58d176d5a719d06526383b777a28b3f931a468926bbe24
SHA512 a48fbc5cbc0a5e066f3021277e8237cfc581f512be411a1225a1a0a95cc5cd3251dadce960d37d5607b6084e6a6908c14456edc78a465513d656b2ec39ba7efe

C:\Users\Admin\AppData\Roaming\SyS64.exe

MD5 45a55dc2f02efc9b736cd8b8756d2524
SHA1 c0e42e562e9c8e4cf3086b4f2befbee89fc06501
SHA256 c9c266b33541222683b8f5142f7a18290c188ae67a8e670c63e2c4d45ef1d6bb
SHA512 08e180d94fcb7a1249325beaf766939aa275821510e7db090d4173e1e7e6d7ac00c830925ab7dccd8d4fa626041f11c098f3b0815077dc9f704b7bd54072b6a9

memory/840-44-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4580-48-0x0000000000400000-0x000000000044B000-memory.dmp

memory/4580-49-0x0000000000400000-0x000000000044B000-memory.dmp

memory/4580-50-0x0000000000400000-0x000000000044B000-memory.dmp

memory/3836-56-0x0000000000400000-0x000000000047C000-memory.dmp

memory/3836-60-0x0000000000400000-0x000000000047C000-memory.dmp

memory/3836-63-0x0000000000400000-0x000000000047C000-memory.dmp

memory/3836-62-0x0000000000400000-0x000000000047C000-memory.dmp

memory/4580-67-0x0000000000400000-0x000000000044B000-memory.dmp

memory/840-70-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1992-71-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3836-72-0x0000000000400000-0x000000000047C000-memory.dmp

memory/3836-76-0x0000000000400000-0x000000000047C000-memory.dmp

memory/3836-78-0x0000000000400000-0x000000000047C000-memory.dmp

memory/3836-80-0x0000000000400000-0x000000000047C000-memory.dmp

memory/3836-82-0x0000000000400000-0x000000000047C000-memory.dmp

memory/3836-84-0x0000000000400000-0x000000000047C000-memory.dmp

memory/3836-86-0x0000000000400000-0x000000000047C000-memory.dmp

memory/3836-88-0x0000000000400000-0x000000000047C000-memory.dmp