blackshades | fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8

Analysis

max time kernel
15s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2025 07:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
Size

405KB
MD5

5fde41a53d9c991786b8896a90c09c0e
SHA1

9939bccf6517d3cc79f0d09c7dee6db6d2ca93a5
SHA256

fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8
SHA512

dfd4ba3809c894977ebe767c0f95f702d578459333d9394ac8f2666b1f9b1915cc77736a4fc1f39ceefcc08cda23756816c1e63b6fca04ae67c70bdf5c8bf727
SSDEEP

6144:foYn9sE89XKTK/J6brj3nmHWrt63P5A9GJ6vbmF4ifKyjlKI4r3mzzrLVIo8ZJrz:ZsNDBIrCHWux6iFTJf4r2zPBv8Xi8xSG

Score

10^/10

blackshades defense_evasion discovery persistence rat upx

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 9 IoCs

resource	yara_rule
behavioral2/memory/3688-66-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/3688-80-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/3688-82-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/3688-84-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/3688-87-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/3688-89-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/3688-91-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/3688-96-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/3688-101-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades

Modifies firewall policy service 3 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\javaruntime.exe = "C:\\Windows\\javaruntime.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\winprocess.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winprocess.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000\Control Panel\International\Geo\Nation	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe

Executes dropped EXE 3 IoCs

pid	Process
4952	javaruntime.exe
1404	javaruntime.exe
3688	javaruntime.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1121399784-3202166597-3503557106-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\javaruntime = "C:\\Windows\\javaruntime.exe"	reg.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 1052 set thread context of 2248	1052	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	89
PID 1052 set thread context of 184	1052	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	90
PID 4952 set thread context of 4208	4952	javaruntime.exe	96
PID 4952 set thread context of 1404	4952	javaruntime.exe	97
PID 4952 set thread context of 3688	4952	javaruntime.exe	98

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1052-0-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/1052-13-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/184-16-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/184-18-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/1052-21-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/184-14-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x001800000002397a-36.dat	upx
behavioral2/memory/4952-44-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/4952-48-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/184-55-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/3688-63-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3688-66-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3688-65-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/184-75-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/4952-68-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/1404-77-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/3688-80-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3688-82-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3688-84-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3688-87-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3688-89-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3688-91-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3688-96-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3688-101-0x0000000000400000-0x000000000047B000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\javaruntime.exe	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
File opened for modification	C:\Windows\javaruntime.exe	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaruntime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaruntime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaruntime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
3348	reg.exe
1628	reg.exe
720	reg.exe
4072	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: 1	3688	javaruntime.exe
Token: SeCreateTokenPrivilege	3688	javaruntime.exe
Token: SeAssignPrimaryTokenPrivilege	3688	javaruntime.exe
Token: SeLockMemoryPrivilege	3688	javaruntime.exe
Token: SeIncreaseQuotaPrivilege	3688	javaruntime.exe
Token: SeMachineAccountPrivilege	3688	javaruntime.exe
Token: SeTcbPrivilege	3688	javaruntime.exe
Token: SeSecurityPrivilege	3688	javaruntime.exe
Token: SeTakeOwnershipPrivilege	3688	javaruntime.exe
Token: SeLoadDriverPrivilege	3688	javaruntime.exe
Token: SeSystemProfilePrivilege	3688	javaruntime.exe
Token: SeSystemtimePrivilege	3688	javaruntime.exe
Token: SeProfSingleProcessPrivilege	3688	javaruntime.exe
Token: SeIncBasePriorityPrivilege	3688	javaruntime.exe
Token: SeCreatePagefilePrivilege	3688	javaruntime.exe
Token: SeCreatePermanentPrivilege	3688	javaruntime.exe
Token: SeBackupPrivilege	3688	javaruntime.exe
Token: SeRestorePrivilege	3688	javaruntime.exe
Token: SeShutdownPrivilege	3688	javaruntime.exe
Token: SeDebugPrivilege	3688	javaruntime.exe
Token: SeAuditPrivilege	3688	javaruntime.exe
Token: SeSystemEnvironmentPrivilege	3688	javaruntime.exe
Token: SeChangeNotifyPrivilege	3688	javaruntime.exe
Token: SeRemoteShutdownPrivilege	3688	javaruntime.exe
Token: SeUndockPrivilege	3688	javaruntime.exe
Token: SeSyncAgentPrivilege	3688	javaruntime.exe
Token: SeEnableDelegationPrivilege	3688	javaruntime.exe
Token: SeManageVolumePrivilege	3688	javaruntime.exe
Token: SeImpersonatePrivilege	3688	javaruntime.exe
Token: SeCreateGlobalPrivilege	3688	javaruntime.exe
Token: 31	3688	javaruntime.exe
Token: 32	3688	javaruntime.exe
Token: 33	3688	javaruntime.exe
Token: 34	3688	javaruntime.exe
Token: 35	3688	javaruntime.exe
Token: SeDebugPrivilege	1404	javaruntime.exe
Token: SeDebugPrivilege	1404	javaruntime.exe
Token: SeDebugPrivilege	1404	javaruntime.exe
Token: SeDebugPrivilege	1404	javaruntime.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1052	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
2248	svchost.exe
184	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
4952	javaruntime.exe
4952	javaruntime.exe
4208	svchost.exe
1404	javaruntime.exe
3688	javaruntime.exe
3688	javaruntime.exe
3688	javaruntime.exe
3688	javaruntime.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 2248	1052	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	89
PID 1052 wrote to memory of 2248	1052	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	89
PID 1052 wrote to memory of 2248	1052	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	89
PID 1052 wrote to memory of 2248	1052	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	89
PID 1052 wrote to memory of 2248	1052	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	89
PID 1052 wrote to memory of 2248	1052	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	89
PID 1052 wrote to memory of 2248	1052	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	89
PID 1052 wrote to memory of 2248	1052	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	89
PID 1052 wrote to memory of 2248	1052	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	89
PID 1052 wrote to memory of 184	1052	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	90
PID 1052 wrote to memory of 184	1052	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	90
PID 1052 wrote to memory of 184	1052	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	90
PID 1052 wrote to memory of 184	1052	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	90
PID 1052 wrote to memory of 184	1052	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	90
PID 1052 wrote to memory of 184	1052	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	90
PID 1052 wrote to memory of 184	1052	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	90
PID 1052 wrote to memory of 184	1052	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	90
PID 184 wrote to memory of 4708	184	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	91
PID 184 wrote to memory of 4708	184	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	91
PID 184 wrote to memory of 4708	184	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	91
PID 4708 wrote to memory of 1516	4708	cmd.exe	94
PID 4708 wrote to memory of 1516	4708	cmd.exe	94
PID 4708 wrote to memory of 1516	4708	cmd.exe	94
PID 184 wrote to memory of 4952	184	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	95
PID 184 wrote to memory of 4952	184	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	95
PID 184 wrote to memory of 4952	184	fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe	95
PID 4952 wrote to memory of 4208	4952	javaruntime.exe	96
PID 4952 wrote to memory of 4208	4952	javaruntime.exe	96
PID 4952 wrote to memory of 4208	4952	javaruntime.exe	96
PID 4952 wrote to memory of 4208	4952	javaruntime.exe	96
PID 4952 wrote to memory of 4208	4952	javaruntime.exe	96
PID 4952 wrote to memory of 4208	4952	javaruntime.exe	96
PID 4952 wrote to memory of 4208	4952	javaruntime.exe	96
PID 4952 wrote to memory of 4208	4952	javaruntime.exe	96
PID 4952 wrote to memory of 4208	4952	javaruntime.exe	96
PID 4952 wrote to memory of 1404	4952	javaruntime.exe	97
PID 4952 wrote to memory of 1404	4952	javaruntime.exe	97
PID 4952 wrote to memory of 1404	4952	javaruntime.exe	97
PID 4952 wrote to memory of 1404	4952	javaruntime.exe	97
PID 4952 wrote to memory of 1404	4952	javaruntime.exe	97
PID 4952 wrote to memory of 1404	4952	javaruntime.exe	97
PID 4952 wrote to memory of 1404	4952	javaruntime.exe	97
PID 4952 wrote to memory of 1404	4952	javaruntime.exe	97
PID 4952 wrote to memory of 3688	4952	javaruntime.exe	98
PID 4952 wrote to memory of 3688	4952	javaruntime.exe	98
PID 4952 wrote to memory of 3688	4952	javaruntime.exe	98
PID 4952 wrote to memory of 3688	4952	javaruntime.exe	98
PID 4952 wrote to memory of 3688	4952	javaruntime.exe	98
PID 4952 wrote to memory of 3688	4952	javaruntime.exe	98
PID 4952 wrote to memory of 3688	4952	javaruntime.exe	98
PID 4952 wrote to memory of 3688	4952	javaruntime.exe	98
PID 3688 wrote to memory of 2456	3688	javaruntime.exe	99
PID 3688 wrote to memory of 2456	3688	javaruntime.exe	99
PID 3688 wrote to memory of 2456	3688	javaruntime.exe	99
PID 3688 wrote to memory of 2768	3688	javaruntime.exe	100
PID 3688 wrote to memory of 2768	3688	javaruntime.exe	100
PID 3688 wrote to memory of 2768	3688	javaruntime.exe	100
PID 3688 wrote to memory of 2732	3688	javaruntime.exe	101
PID 3688 wrote to memory of 2732	3688	javaruntime.exe	101
PID 3688 wrote to memory of 2732	3688	javaruntime.exe	101
PID 3688 wrote to memory of 1616	3688	javaruntime.exe	102
PID 3688 wrote to memory of 1616	3688	javaruntime.exe	102
PID 3688 wrote to memory of 1616	3688	javaruntime.exe	102
PID 1616 wrote to memory of 4072	1616	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
"C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2248
- C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
  "C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:184
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PCGCQ.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaruntime" /t REG_SZ /d "C:\Windows\javaruntime.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:1516
- - C:\Windows\javaruntime.exe
    "C:\Windows\javaruntime.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4208
  - - C:\Windows\javaruntime.exe
      "C:\Windows\javaruntime.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1404
  - - C:\Windows\javaruntime.exe
      "C:\Windows\javaruntime.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3688
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2456
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        6⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1628
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2768
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f
        6⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3348
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2732
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        6⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:720
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1616
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f
        6⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\PCGCQ.txt

Filesize
124B

MD5
163f8e838efe1d166ffff7408b814e28

SHA1
52fa0ccba649587e7d24d21d182657078fa6d028

SHA256
dc60287c419225759aa9e1ea0423be4106337dad71aaa0cdc9d55d2b1af3edb7

SHA512
b6685390029555f7d812f0d1a9f138c619555712add3e79c1c90a1a5a0c544e4a86768a626d25c6af3cec09afc0bbaf7f398114e849831bdc5666fc443a1f68d

Download Submit
C:\Windows\javaruntime.exe

Filesize
405KB

MD5
e1a70f3b3e98246099f58b8e3730296c

SHA1
7475f61dad2496e9d656b4998cc8560184df7a86

SHA256
d2d927d78763c94e46c8a58f973e3663715a6b620fba8104858918383c23e9b8

SHA512
83cb98da9bddf6ac3d601f3f41dc15db21a9af91c1b787a9e4677176de0144762f3624fb2a6fbf40cb47b20cd1613f3f32dd9355ef25ee554ac7121d3fa57ca2

Download Submit
memory/184-55-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/184-16-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/184-14-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/184-75-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/184-18-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1052-21-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1052-13-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1052-4-0x00000000023E0000-0x00000000023E2000-memory.dmp

Filesize
8KB

Download
memory/1052-3-0x00000000023D0000-0x00000000023D2000-memory.dmp

Filesize
8KB

Download
memory/1052-5-0x0000000002430000-0x0000000002432000-memory.dmp

Filesize
8KB

Download
memory/1052-0-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1404-77-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2248-8-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2248-12-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2248-9-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2248-6-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2248-47-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3688-84-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3688-96-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3688-82-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3688-63-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3688-66-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3688-65-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3688-91-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3688-87-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3688-101-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3688-89-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3688-80-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4208-51-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4208-76-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4208-56-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4208-49-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4952-68-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/4952-48-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/4952-44-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download