Malware Analysis Report

2025-04-03 10:15

Sample ID 250203-hvwb9atqe1
Target fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8
SHA256 fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8
Tags
blackshades defense_evasion discovery persistence rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8

Threat Level: Known bad

The file fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8 was found to be: Known bad.

Malicious Activity Summary

blackshades defense_evasion discovery persistence rat trojan upx

Blackshades payload

Modifies firewall policy service

Blackshades

Blackshades family

Executes dropped EXE

Checks computer location settings

Checks whether UAC is enabled

Adds Run key to start application

UPX packed file

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies registry key

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-03 07:03

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-03 07:03

Reported

2025-02-03 07:06

Platform

win7-20240903-en

Max time kernel

8s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\javaruntime.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\javaruntime = "C:\\Windows\\javaruntime.exe" C:\Windows\SysWOW64\reg.exe N/A

Checks whether UAC is enabled

defense_evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\javaruntime.exe C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe N/A
File opened for modification C:\Windows\javaruntime.exe C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\javaruntime.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1872 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\svchost.exe
PID 1872 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\svchost.exe
PID 1872 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\svchost.exe
PID 1872 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\svchost.exe
PID 1872 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\svchost.exe
PID 1872 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\svchost.exe
PID 1872 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\svchost.exe
PID 1872 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\svchost.exe
PID 1872 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\svchost.exe
PID 1872 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\svchost.exe
PID 1872 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
PID 1872 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
PID 1872 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
PID 1872 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
PID 1872 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
PID 1872 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
PID 1872 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
PID 1872 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
PID 1872 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
PID 1872 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
PID 1872 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
PID 2488 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\cmd.exe
PID 2488 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\cmd.exe
PID 2488 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\cmd.exe
PID 2488 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\cmd.exe
PID 2364 wrote to memory of 1560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2364 wrote to memory of 1560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2364 wrote to memory of 1560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2364 wrote to memory of 1560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2488 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\javaruntime.exe
PID 2488 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\javaruntime.exe
PID 2488 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\javaruntime.exe
PID 2488 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\javaruntime.exe
PID 2488 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\javaruntime.exe
PID 2488 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\javaruntime.exe
PID 2488 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\javaruntime.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe

"C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe

"C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\CGVVI.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaruntime" /t REG_SZ /d "C:\Windows\javaruntime.exe" /f

C:\Windows\javaruntime.exe

"C:\Windows\javaruntime.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\javaruntime.exe

"C:\Windows\javaruntime.exe"

C:\Windows\javaruntime.exe

"C:\Windows\javaruntime.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 jadedcolossal.pointto.us udp

Files

memory/1872-0-0x0000000000400000-0x000000000052D000-memory.dmp

memory/1872-3-0x0000000000250000-0x0000000000251000-memory.dmp

memory/1872-15-0x0000000000270000-0x0000000000271000-memory.dmp

memory/1872-5-0x0000000000250000-0x0000000000251000-memory.dmp

memory/1872-27-0x0000000000290000-0x0000000000291000-memory.dmp

memory/1872-39-0x0000000000330000-0x0000000000331000-memory.dmp

memory/1872-59-0x0000000000404000-0x0000000000405000-memory.dmp

memory/1872-60-0x0000000000370000-0x0000000000371000-memory.dmp

memory/1872-70-0x00000000003D0000-0x00000000003D1000-memory.dmp

memory/1872-78-0x0000000000400000-0x000000000052D000-memory.dmp

memory/1872-79-0x00000000003F0000-0x00000000003F2000-memory.dmp

memory/1872-100-0x0000000000400000-0x000000000052D000-memory.dmp

memory/1872-96-0x0000000000400000-0x000000000052D000-memory.dmp

memory/1872-89-0x0000000000730000-0x0000000000731000-memory.dmp

memory/2472-125-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2472-124-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2472-120-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2472-119-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2472-117-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2472-115-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2472-113-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2472-111-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2472-109-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2472-107-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2472-105-0x0000000000400000-0x000000000040C000-memory.dmp

memory/1872-130-0x0000000000400000-0x000000000052D000-memory.dmp

memory/2488-136-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2488-147-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1872-146-0x0000000002B60000-0x0000000002C8D000-memory.dmp

memory/1872-145-0x0000000000400000-0x000000000052D000-memory.dmp

memory/2488-134-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CGVVI.bat

MD5 163f8e838efe1d166ffff7408b814e28
SHA1 52fa0ccba649587e7d24d21d182657078fa6d028
SHA256 dc60287c419225759aa9e1ea0423be4106337dad71aaa0cdc9d55d2b1af3edb7
SHA512 b6685390029555f7d812f0d1a9f138c619555712add3e79c1c90a1a5a0c544e4a86768a626d25c6af3cec09afc0bbaf7f398114e849831bdc5666fc443a1f68d

memory/2488-182-0x00000000038C0000-0x00000000039ED000-memory.dmp

memory/2488-181-0x00000000038C0000-0x00000000039ED000-memory.dmp

memory/2488-180-0x00000000038C0000-0x00000000039ED000-memory.dmp

memory/2488-179-0x00000000038C0000-0x00000000039ED000-memory.dmp

C:\Windows\javaruntime.exe

MD5 f3edb736f86b42ece463eab119bc58d2
SHA1 7c8aeaec597a980c082a21649df003ee37528d15
SHA256 576bb949b10d407effe06009d117d11a7a0ce4ce0aeac2c67f6962794f848581
SHA512 8e75a8afb619acecbd5e5315212d401a920a0630a89a19e90a86ebe3f90ed8a2820365d52356f704b7682cbfc27c79bbd256a9832ce2eabf123ce9a86c64ff07

memory/812-185-0x0000000000400000-0x000000000052D000-memory.dmp

memory/2472-184-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2472-188-0x0000000000400000-0x000000000040C000-memory.dmp

memory/812-294-0x0000000003250000-0x000000000337D000-memory.dmp

memory/2488-293-0x0000000000400000-0x000000000040B000-memory.dmp

memory/700-314-0x0000000000400000-0x000000000047B000-memory.dmp

memory/2488-313-0x00000000038C0000-0x00000000039ED000-memory.dmp

memory/812-312-0x0000000003250000-0x000000000337D000-memory.dmp

memory/812-317-0x0000000000400000-0x000000000052D000-memory.dmp

memory/2488-322-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2476-326-0x0000000000400000-0x000000000040B000-memory.dmp

memory/700-329-0x0000000000400000-0x000000000047B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-03 07:03

Reported

2025-02-03 07:06

Platform

win10v2004-20250129-en

Max time kernel

22s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\javaruntime.exe = "C:\\Windows\\javaruntime.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\winprocess.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winprocess.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\javaruntime.exe N/A
N/A N/A C:\Windows\javaruntime.exe N/A
N/A N/A C:\Windows\javaruntime.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\javaruntime = "C:\\Windows\\javaruntime.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\javaruntime.exe C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe N/A
File opened for modification C:\Windows\javaruntime.exe C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\javaruntime.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\javaruntime.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\javaruntime.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Windows\javaruntime.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: 31 N/A C:\Windows\javaruntime.exe N/A
Token: 32 N/A C:\Windows\javaruntime.exe N/A
Token: 33 N/A C:\Windows\javaruntime.exe N/A
Token: 34 N/A C:\Windows\javaruntime.exe N/A
Token: 35 N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\javaruntime.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4632 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\svchost.exe
PID 4632 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\svchost.exe
PID 4632 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\svchost.exe
PID 4632 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\svchost.exe
PID 4632 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\svchost.exe
PID 4632 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\svchost.exe
PID 4632 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\svchost.exe
PID 4632 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\svchost.exe
PID 4632 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\svchost.exe
PID 4632 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
PID 4632 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
PID 4632 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
PID 4632 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
PID 4632 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
PID 4632 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
PID 4632 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
PID 4632 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe
PID 5036 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\cmd.exe
PID 5036 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\cmd.exe
PID 5036 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\SysWOW64\cmd.exe
PID 5056 wrote to memory of 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5056 wrote to memory of 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5056 wrote to memory of 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5036 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\javaruntime.exe
PID 5036 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\javaruntime.exe
PID 5036 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe C:\Windows\javaruntime.exe
PID 3296 wrote to memory of 3740 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 3296 wrote to memory of 3740 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 3296 wrote to memory of 3740 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 3296 wrote to memory of 3740 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 3296 wrote to memory of 3740 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 3296 wrote to memory of 3740 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 3296 wrote to memory of 3740 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 3296 wrote to memory of 3740 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 3296 wrote to memory of 3740 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\svchost.exe
PID 3296 wrote to memory of 4356 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3296 wrote to memory of 4356 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3296 wrote to memory of 4356 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3296 wrote to memory of 4356 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3296 wrote to memory of 4356 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3296 wrote to memory of 4356 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3296 wrote to memory of 4356 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3296 wrote to memory of 4356 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3296 wrote to memory of 4920 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3296 wrote to memory of 4920 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3296 wrote to memory of 4920 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3296 wrote to memory of 4920 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3296 wrote to memory of 4920 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3296 wrote to memory of 4920 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3296 wrote to memory of 4920 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 3296 wrote to memory of 4920 N/A C:\Windows\javaruntime.exe C:\Windows\javaruntime.exe
PID 4920 wrote to memory of 216 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 4920 wrote to memory of 216 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 4920 wrote to memory of 216 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 4920 wrote to memory of 4996 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 4920 wrote to memory of 4996 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 4920 wrote to memory of 4996 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 4920 wrote to memory of 2132 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 4920 wrote to memory of 2132 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 4920 wrote to memory of 2132 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 4920 wrote to memory of 1148 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 4920 wrote to memory of 1148 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 4920 wrote to memory of 1148 N/A C:\Windows\javaruntime.exe C:\Windows\SysWOW64\cmd.exe
PID 1148 wrote to memory of 3392 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe

"C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe

"C:\Users\Admin\AppData\Local\Temp\fc1242e04b1cecc3b61bd8f8ca64e539eeaa2d5eb41736cd449fc9d804535fc8.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MKOJR.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaruntime" /t REG_SZ /d "C:\Windows\javaruntime.exe" /f

C:\Windows\javaruntime.exe

"C:\Windows\javaruntime.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\javaruntime.exe

"C:\Windows\javaruntime.exe"

C:\Windows\javaruntime.exe

"C:\Windows\javaruntime.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
GB 88.221.135.40:443 www.bing.com tcp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 40.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 7.98.51.23.in-addr.arpa udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp

Files

memory/4632-0-0x0000000000400000-0x000000000052D000-memory.dmp

memory/4632-3-0x0000000002380000-0x0000000002382000-memory.dmp

memory/4632-4-0x0000000002390000-0x0000000002392000-memory.dmp

memory/4632-5-0x00000000023D0000-0x00000000023D2000-memory.dmp

memory/3272-6-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3272-8-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3272-12-0x0000000000400000-0x000000000040C000-memory.dmp

memory/4632-13-0x0000000000400000-0x000000000052D000-memory.dmp

memory/3272-9-0x0000000000400000-0x000000000040C000-memory.dmp

memory/5036-14-0x0000000000400000-0x000000000040B000-memory.dmp

memory/5036-18-0x0000000000400000-0x000000000040B000-memory.dmp

memory/5036-16-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4632-22-0x0000000000400000-0x000000000052D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MKOJR.txt

MD5 163f8e838efe1d166ffff7408b814e28
SHA1 52fa0ccba649587e7d24d21d182657078fa6d028
SHA256 dc60287c419225759aa9e1ea0423be4106337dad71aaa0cdc9d55d2b1af3edb7
SHA512 b6685390029555f7d812f0d1a9f138c619555712add3e79c1c90a1a5a0c544e4a86768a626d25c6af3cec09afc0bbaf7f398114e849831bdc5666fc443a1f68d

C:\Windows\javaruntime.exe

MD5 db9166760e367e069ff3bdf5b40eb975
SHA1 02ac21c34da8ecbf57c62719e1215571251eb20c
SHA256 747c66c4a2297256fda4eb6ab0afa0c49fcf45bb02d55061e1e34aa702591686
SHA512 612a67b9f374d1b968b178201b5aa88929f269bdf00e1a7735fd780bd94d254ab40c7143f58e495013f0def4895c5965c6b9525e95f92663e2a82b7d3cee5e73

memory/3296-43-0x0000000000400000-0x000000000052D000-memory.dmp

memory/3272-47-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3296-48-0x0000000000400000-0x000000000052D000-memory.dmp

memory/5036-50-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3296-49-0x0000000000400000-0x000000000052D000-memory.dmp

memory/3740-51-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3296-52-0x0000000000400000-0x000000000052D000-memory.dmp

memory/3740-54-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3740-58-0x0000000000400000-0x000000000040C000-memory.dmp

memory/4920-65-0x0000000000400000-0x000000000047B000-memory.dmp

memory/4920-68-0x0000000000400000-0x000000000047B000-memory.dmp

memory/4920-67-0x0000000000400000-0x000000000047B000-memory.dmp

memory/3296-70-0x0000000000400000-0x000000000052D000-memory.dmp

memory/5036-78-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3740-79-0x0000000000400000-0x000000000040C000-memory.dmp

memory/4356-80-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4920-83-0x0000000000400000-0x000000000047B000-memory.dmp

memory/4920-85-0x0000000000400000-0x000000000047B000-memory.dmp

memory/4920-88-0x0000000000400000-0x000000000047B000-memory.dmp

memory/4920-90-0x0000000000400000-0x000000000047B000-memory.dmp

memory/4920-92-0x0000000000400000-0x000000000047B000-memory.dmp

memory/4920-95-0x0000000000400000-0x000000000047B000-memory.dmp

memory/4920-99-0x0000000000400000-0x000000000047B000-memory.dmp

memory/4920-104-0x0000000000400000-0x000000000047B000-memory.dmp