Malware Analysis Report

2025-04-03 10:15

Sample ID 250203-xycfwasjej
Target 0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5
SHA256 0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5
Tags
upx blackshades defense_evasion discovery persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5

Threat Level: Known bad

The file 0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5 was found to be: Known bad.

Malicious Activity Summary

upx blackshades defense_evasion discovery persistence rat

Modifies firewall policy service

Blackshades payload

Blackshades

Blackshades family

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

UPX packed file

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Modifies registry key

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-03 19:15

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-03 19:15

Reported

2025-02-03 19:17

Platform

win7-20240708-en

Max time kernel

149s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Window Updates\\winupdt2.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Updater.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Updater.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdt = "C:\\Users\\Admin\\AppData\\Roaming\\Window Updates\\winupdt2.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2096 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5.exe C:\Windows\SysWOW64\cmd.exe
PID 2096 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5.exe C:\Windows\SysWOW64\cmd.exe
PID 2096 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5.exe C:\Windows\SysWOW64\cmd.exe
PID 2096 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5.exe C:\Windows\SysWOW64\cmd.exe
PID 2576 wrote to memory of 380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2576 wrote to memory of 380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2576 wrote to memory of 380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2576 wrote to memory of 380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2096 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2096 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2096 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2096 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2740 wrote to memory of 592 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2740 wrote to memory of 592 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2740 wrote to memory of 592 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2740 wrote to memory of 592 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2740 wrote to memory of 592 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2740 wrote to memory of 592 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2740 wrote to memory of 592 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2740 wrote to memory of 592 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2740 wrote to memory of 592 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2740 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2740 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2740 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2740 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2740 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2740 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2740 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2740 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2740 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 592 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 592 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 592 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 592 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 592 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 592 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 592 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 592 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 592 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 592 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 592 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 592 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 592 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 592 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 592 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 592 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2604 wrote to memory of 688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2604 wrote to memory of 688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2604 wrote to memory of 688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2604 wrote to memory of 688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2612 wrote to memory of 580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2612 wrote to memory of 580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2612 wrote to memory of 580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2612 wrote to memory of 580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2652 wrote to memory of 1136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2652 wrote to memory of 1136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2652 wrote to memory of 1136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2652 wrote to memory of 1136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1668 wrote to memory of 1708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1668 wrote to memory of 1708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1668 wrote to memory of 1708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1668 wrote to memory of 1708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5.exe

"C:\Users\Admin\AppData\Local\Temp\0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\OzNel.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinUpdt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /f

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 havefunnuke.servequake.com udp

Files

memory/2096-0-0x0000000000400000-0x00000000005CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\OzNel.bat

MD5 49bb161b07149b1bda99901c71d98b1f
SHA1 e5e3b389c09d551bd8f3a4cf71ee30e566fdf6e2
SHA256 734c4f48449a118dbdfbbe4971ecf112b26b2b45d1889678c01dea98eb5767d8
SHA512 da09a2af9b7f9528916ab719ed97ee8b61179bba92016eaed64b3e7d6bf08646801aeeb0eb332bdde175eb64b48106f7cf2fe2bf01ea6128753e4ce1d48707be

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

MD5 521add7bba2051704d356c24ff4c41e4
SHA1 0bb73e2ec36085db7e31d0132749599a7ea7db08
SHA256 7b2218f461bbbc4bf2677d955545f6dffcd7e2220c3440be0d72f3792a449f67
SHA512 043fe507efcee59ec5d3b41c0b4e4a0807bf7369ef464baece17cb9cd7860e278ee35768c11ba5ae1463d57582f1de37294a9dd6211282cbf58f99cb53e17623

memory/2096-42-0x0000000003170000-0x000000000333A000-memory.dmp

memory/2740-45-0x0000000000400000-0x00000000005CA000-memory.dmp

memory/2096-44-0x0000000000400000-0x00000000005CA000-memory.dmp

memory/2716-64-0x0000000000400000-0x0000000000409000-memory.dmp

memory/592-63-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2740-60-0x0000000000400000-0x00000000005CA000-memory.dmp

memory/2716-59-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2716-56-0x0000000000400000-0x0000000000409000-memory.dmp

memory/592-55-0x0000000000400000-0x000000000045C000-memory.dmp

memory/592-54-0x0000000000400000-0x000000000045C000-memory.dmp

memory/592-53-0x0000000000400000-0x000000000045C000-memory.dmp

memory/592-70-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2716-71-0x0000000000400000-0x0000000000409000-memory.dmp

memory/592-72-0x0000000000400000-0x000000000045C000-memory.dmp

memory/592-74-0x0000000000400000-0x000000000045C000-memory.dmp

memory/592-76-0x0000000000400000-0x000000000045C000-memory.dmp

memory/592-79-0x0000000000400000-0x000000000045C000-memory.dmp

memory/592-81-0x0000000000400000-0x000000000045C000-memory.dmp

memory/592-83-0x0000000000400000-0x000000000045C000-memory.dmp

memory/592-88-0x0000000000400000-0x000000000045C000-memory.dmp

memory/592-93-0x0000000000400000-0x000000000045C000-memory.dmp

memory/592-97-0x0000000000400000-0x000000000045C000-memory.dmp

memory/592-102-0x0000000000400000-0x000000000045C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-03 19:15

Reported

2025-02-03 19:17

Platform

win10v2004-20250129-en

Max time kernel

149s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Window Updates\\winupdt2.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Updater.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Updater.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4003209913-3868522715-854928974-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4003209913-3868522715-854928974-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdt = "C:\\Users\\Admin\\AppData\\Roaming\\Window Updates\\winupdt2.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2512 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5.exe C:\Windows\SysWOW64\cmd.exe
PID 2512 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5.exe C:\Windows\SysWOW64\cmd.exe
PID 2512 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2756 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2756 wrote to memory of 2632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2512 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2512 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2512 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 5016 wrote to memory of 412 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 5016 wrote to memory of 412 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 5016 wrote to memory of 412 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 5016 wrote to memory of 412 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 5016 wrote to memory of 412 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 5016 wrote to memory of 412 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 5016 wrote to memory of 412 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 5016 wrote to memory of 412 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 5016 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 5016 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 5016 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 5016 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 5016 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 5016 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 5016 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 5016 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 412 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 412 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 412 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 412 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 412 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 412 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 412 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 412 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 412 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 412 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 412 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 412 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 3388 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3388 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3388 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1520 wrote to memory of 4020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1520 wrote to memory of 4020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1520 wrote to memory of 4020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3468 wrote to memory of 4388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3468 wrote to memory of 4388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3468 wrote to memory of 4388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3104 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3104 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3104 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5.exe

"C:\Users\Admin\AppData\Local\Temp\0302cf308e28bfe47376cc04d63cc82cdd83611659a19c53a185fa1d9f1707d5.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\poreX.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinUpdt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /f

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
GB 95.101.143.201:443 www.bing.com tcp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 201.143.101.95.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 182.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 havefunnuke.servequake.com udp

Files

memory/2512-0-0x0000000000400000-0x00000000005CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\poreX.txt

MD5 49bb161b07149b1bda99901c71d98b1f
SHA1 e5e3b389c09d551bd8f3a4cf71ee30e566fdf6e2
SHA256 734c4f48449a118dbdfbbe4971ecf112b26b2b45d1889678c01dea98eb5767d8
SHA512 da09a2af9b7f9528916ab719ed97ee8b61179bba92016eaed64b3e7d6bf08646801aeeb0eb332bdde175eb64b48106f7cf2fe2bf01ea6128753e4ce1d48707be

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.txt

MD5 d677d163633bec852d01fc6f82c90b54
SHA1 c9414a2da6d776d5d8cd937250e7d65e7757ea0e
SHA256 98863bc87eea08924cd90d4826ab06dc7ecfba1e6a07afc6f9a63c89429e33fd
SHA512 3b667afb6592fb76a9747858734cc3cb1f756c5abe52f881e9eb073f18a8d9d4f2ed3fab7bab4be8c197192171ed06647d59e5841d541620a3187e6747f5b346

memory/2512-30-0x0000000000400000-0x00000000005CA000-memory.dmp

memory/412-34-0x0000000000400000-0x000000000045C000-memory.dmp

memory/412-36-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4084-48-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4084-46-0x0000000000400000-0x0000000000409000-memory.dmp

memory/5016-51-0x0000000000400000-0x00000000005CA000-memory.dmp

memory/4084-40-0x0000000000400000-0x0000000000409000-memory.dmp

memory/412-31-0x0000000000400000-0x000000000045C000-memory.dmp

memory/412-52-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4084-53-0x0000000000400000-0x0000000000409000-memory.dmp

memory/412-54-0x0000000000400000-0x000000000045C000-memory.dmp

memory/412-56-0x0000000000400000-0x000000000045C000-memory.dmp

memory/412-59-0x0000000000400000-0x000000000045C000-memory.dmp

memory/412-61-0x0000000000400000-0x000000000045C000-memory.dmp

memory/412-63-0x0000000000400000-0x000000000045C000-memory.dmp

memory/412-66-0x0000000000400000-0x000000000045C000-memory.dmp

memory/412-68-0x0000000000400000-0x000000000045C000-memory.dmp

memory/412-75-0x0000000000400000-0x000000000045C000-memory.dmp

memory/412-80-0x0000000000400000-0x000000000045C000-memory.dmp