Malware Analysis Report

2025-04-03 10:15

Sample ID 250203-te14cavrfz
Target JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e
SHA256 6381e9fab576582296cd4a74b0dfafb0e1be20e1887ba116f6415f16c44d8163
Tags
blackshades defense_evasion discovery persistence rat upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6381e9fab576582296cd4a74b0dfafb0e1be20e1887ba116f6415f16c44d8163

Threat Level: Known bad

The file JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e was found to be: Known bad.

Malicious Activity Summary

blackshades defense_evasion discovery persistence rat upx

Blackshades payload

Blackshades family

Modifies firewall policy service

Blackshades

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

UPX packed file

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies registry key

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-03 15:59

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-03 15:59

Reported

2025-02-03 16:01

Platform

win7-20241010-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\DE.exe = "C:\\Users\\Admin\\AppData\\Roaming\\DE.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\WinUntilities.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUntilities = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\WinUntilities.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2792 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e.exe C:\Windows\SysWOW64\cmd.exe
PID 2792 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e.exe C:\Windows\SysWOW64\cmd.exe
PID 2792 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e.exe C:\Windows\SysWOW64\cmd.exe
PID 2792 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e.exe C:\Windows\SysWOW64\cmd.exe
PID 1044 wrote to memory of 2980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1044 wrote to memory of 2980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1044 wrote to memory of 2980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1044 wrote to memory of 2980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2792 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 2792 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 2792 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 2792 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 2864 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 2864 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 2864 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 2864 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 2864 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 2864 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 2864 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 2864 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 2864 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 2864 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 2864 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 2864 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 2864 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 2864 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 2864 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 2864 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 2864 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 2996 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 2696 wrote to memory of 2416 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2696 wrote to memory of 2416 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2696 wrote to memory of 2416 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2696 wrote to memory of 2416 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2196 wrote to memory of 2808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2196 wrote to memory of 2808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2196 wrote to memory of 2808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2196 wrote to memory of 2808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2996 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 2780 wrote to memory of 2092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2780 wrote to memory of 2092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2780 wrote to memory of 2092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2780 wrote to memory of 2092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1172 wrote to memory of 1844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1172 wrote to memory of 1844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1172 wrote to memory of 1844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1172 wrote to memory of 1844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\uLjhF.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinUntilities" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe" /f

C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe

"C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe"

C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe

C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe

C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe

C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\DE.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\DE.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\DE.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\DE.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 bs15.no-ip.org udp
N/A 192.168.1.6:411 tcp
N/A 192.168.1.6:411 tcp
N/A 192.168.1.6:411 tcp
N/A 192.168.1.6:411 tcp
N/A 192.168.1.6:411 tcp

Files

memory/2792-0-0x0000000000400000-0x00000000009B5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\uLjhF.bat

MD5 673346b9ed6b77293a9ca891f1aff35e
SHA1 ae1841edadbac9e3512a8ecd354fa2c99647634e
SHA256 72d9b9238a7e62b56724f7d54069d2aea5d3cad1649f3782e17517bd405dbdfe
SHA512 13f8897f90c6a7caac3b8ad5b13287942f8616bdd2184f32804c3a82d72557a52dbef65b8a0883166a195e56f0fb0948759115660d2d6ca93ab3f8c149344ee0

\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe

MD5 8a3c55f4be277fc538f894b8fdbead7e
SHA1 e02ef7865752a32516eb94b9c974ce45d9217d1c
SHA256 6381e9fab576582296cd4a74b0dfafb0e1be20e1887ba116f6415f16c44d8163
SHA512 35b238d14de3c1181260b6ae0345569409658cbf309d9b4bd905ce575b6b99eddf830e929eaee0dfeb377faf37f99c716c5a633b37411ffb49e7d2a70ec951dc

memory/2792-35-0x0000000003880000-0x0000000003E35000-memory.dmp

memory/2792-37-0x0000000003880000-0x0000000003E35000-memory.dmp

memory/2792-36-0x0000000003880000-0x0000000003E35000-memory.dmp

memory/2864-38-0x0000000000400000-0x00000000009B5000-memory.dmp

memory/2792-43-0x0000000000400000-0x00000000009B5000-memory.dmp

memory/2792-39-0x0000000003880000-0x0000000003E35000-memory.dmp

memory/2996-45-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2724-57-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2724-56-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2724-53-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2864-52-0x0000000000400000-0x00000000009B5000-memory.dmp

memory/2724-50-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2996-49-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2724-63-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2996-62-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2996-61-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2996-48-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2996-66-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2996-69-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2996-72-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2996-74-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2996-76-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2996-79-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2996-81-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2996-83-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2996-85-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2996-88-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2996-90-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2996-93-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2996-97-0x0000000000400000-0x0000000000473000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-03 15:59

Reported

2025-02-03 16:01

Platform

win10v2004-20250129-en

Max time kernel

149s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\WinUntilities.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\DE.exe = "C:\\Users\\Admin\\AppData\\Roaming\\DE.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUntilities = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\WinUntilities.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5008 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e.exe C:\Windows\SysWOW64\cmd.exe
PID 5008 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e.exe C:\Windows\SysWOW64\cmd.exe
PID 5008 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e.exe C:\Windows\SysWOW64\cmd.exe
PID 2008 wrote to memory of 3928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2008 wrote to memory of 3928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2008 wrote to memory of 3928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5008 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 5008 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 5008 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 3512 wrote to memory of 812 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 3512 wrote to memory of 812 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 3512 wrote to memory of 812 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 3512 wrote to memory of 812 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 3512 wrote to memory of 812 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 3512 wrote to memory of 812 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 3512 wrote to memory of 812 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 3512 wrote to memory of 812 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 3512 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 3512 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 3512 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 3512 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 3512 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 3512 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 3512 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe
PID 812 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 3680 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 3680 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 3680 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 812 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe C:\Windows\SysWOW64\cmd.exe
PID 3680 wrote to memory of 2524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3680 wrote to memory of 2524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3680 wrote to memory of 2524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1340 wrote to memory of 4916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1340 wrote to memory of 4916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1340 wrote to memory of 4916 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3736 wrote to memory of 4704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3736 wrote to memory of 4704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3736 wrote to memory of 4704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2916 wrote to memory of 2056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2916 wrote to memory of 2056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2916 wrote to memory of 2056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a3c55f4be277fc538f894b8fdbead7e.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AKJEp.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinUntilities" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe" /f

C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe

"C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe"

C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe

C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe

C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe

C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\DE.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\DE.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\DE.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\DE.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 bs15.no-ip.org udp
N/A 192.168.1.6:411 tcp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 bs15.no-ip.org udp
US 8.8.8.8:53 70.252.19.2.in-addr.arpa udp
N/A 192.168.1.6:411 tcp
US 8.8.8.8:53 bs15.no-ip.org udp
US 8.8.8.8:53 11.153.16.2.in-addr.arpa udp
N/A 192.168.1.6:411 tcp
US 8.8.8.8:53 bs15.no-ip.org udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
N/A 192.168.1.6:411 tcp
US 8.8.8.8:53 bs15.no-ip.org udp
N/A 192.168.1.6:411 tcp

Files

memory/5008-0-0x0000000000400000-0x00000000009B5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\AKJEp.bat

MD5 673346b9ed6b77293a9ca891f1aff35e
SHA1 ae1841edadbac9e3512a8ecd354fa2c99647634e
SHA256 72d9b9238a7e62b56724f7d54069d2aea5d3cad1649f3782e17517bd405dbdfe
SHA512 13f8897f90c6a7caac3b8ad5b13287942f8616bdd2184f32804c3a82d72557a52dbef65b8a0883166a195e56f0fb0948759115660d2d6ca93ab3f8c149344ee0

C:\Users\Admin\AppData\Roaming\Windows\WinUntilities.exe

MD5 8a3c55f4be277fc538f894b8fdbead7e
SHA1 e02ef7865752a32516eb94b9c974ce45d9217d1c
SHA256 6381e9fab576582296cd4a74b0dfafb0e1be20e1887ba116f6415f16c44d8163
SHA512 35b238d14de3c1181260b6ae0345569409658cbf309d9b4bd905ce575b6b99eddf830e929eaee0dfeb377faf37f99c716c5a633b37411ffb49e7d2a70ec951dc

memory/3512-20-0x0000000000400000-0x00000000009B5000-memory.dmp

memory/5008-19-0x0000000000400000-0x00000000009B5000-memory.dmp

memory/812-28-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3156-30-0x0000000000400000-0x0000000000407000-memory.dmp

memory/3156-35-0x0000000000400000-0x0000000000407000-memory.dmp

memory/3156-33-0x0000000000400000-0x0000000000407000-memory.dmp

memory/812-26-0x0000000000400000-0x0000000000473000-memory.dmp

memory/812-23-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3156-38-0x0000000000400000-0x0000000000407000-memory.dmp

memory/3156-36-0x0000000000400000-0x0000000000407000-memory.dmp

memory/3512-43-0x0000000000400000-0x00000000009B5000-memory.dmp

memory/812-46-0x0000000000400000-0x0000000000473000-memory.dmp

memory/3156-47-0x0000000000400000-0x0000000000407000-memory.dmp

memory/812-48-0x0000000000400000-0x0000000000473000-memory.dmp

memory/812-52-0x0000000000400000-0x0000000000473000-memory.dmp

memory/812-57-0x0000000000400000-0x0000000000473000-memory.dmp

memory/812-61-0x0000000000400000-0x0000000000473000-memory.dmp

memory/812-65-0x0000000000400000-0x0000000000473000-memory.dmp

memory/812-70-0x0000000000400000-0x0000000000473000-memory.dmp

memory/812-74-0x0000000000400000-0x0000000000473000-memory.dmp

memory/812-78-0x0000000000400000-0x0000000000473000-memory.dmp

memory/812-83-0x0000000000400000-0x0000000000473000-memory.dmp

memory/812-87-0x0000000000400000-0x0000000000473000-memory.dmp

memory/812-91-0x0000000000400000-0x0000000000473000-memory.dmp

memory/812-95-0x0000000000400000-0x0000000000473000-memory.dmp

memory/812-100-0x0000000000400000-0x0000000000473000-memory.dmp

memory/812-104-0x0000000000400000-0x0000000000473000-memory.dmp