Malware Analysis Report

2025-04-03 10:15

Sample ID 250203-zpcfmavlgj
Target 22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d
SHA256 22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d
Tags
upx blackshades defense_evasion discovery persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d

Threat Level: Known bad

The file 22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d was found to be: Known bad.

Malicious Activity Summary

upx blackshades defense_evasion discovery persistence rat

Blackshades payload

Blackshades

Modifies firewall policy service

Blackshades family

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

UPX packed file

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Modifies registry key

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-03 20:53

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-03 20:53

Reported

2025-02-03 20:55

Platform

win7-20240903-en

Max time kernel

149s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Window Updates\\winupdt2.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Updater.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Updater.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdt = "C:\\Users\\Admin\\AppData\\Roaming\\Window Updates\\winupdt2.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2420 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d.exe C:\Windows\SysWOW64\cmd.exe
PID 2420 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d.exe C:\Windows\SysWOW64\cmd.exe
PID 2420 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d.exe C:\Windows\SysWOW64\cmd.exe
PID 2420 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2712 wrote to memory of 2672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2712 wrote to memory of 2672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2712 wrote to memory of 2672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2420 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2420 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2420 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2420 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 3052 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 3052 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 3052 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 3052 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 3052 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 3052 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 3052 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 3052 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 3052 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 3052 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 3052 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 3052 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 3052 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 3052 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 3052 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 3052 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 3052 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2584 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 3052 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2584 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2540 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2540 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2540 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2540 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1924 wrote to memory of 764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1924 wrote to memory of 764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1924 wrote to memory of 764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1924 wrote to memory of 764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1488 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1488 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1488 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1488 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1744 wrote to memory of 2768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1744 wrote to memory of 2768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1744 wrote to memory of 2768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1744 wrote to memory of 2768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d.exe

"C:\Users\Admin\AppData\Local\Temp\22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tNelI.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinUpdt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /f

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 havefunnuke.servequake.com udp

Files

memory/2420-2-0x0000000000400000-0x00000000005CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tNelI.bat

MD5 49bb161b07149b1bda99901c71d98b1f
SHA1 e5e3b389c09d551bd8f3a4cf71ee30e566fdf6e2
SHA256 734c4f48449a118dbdfbbe4971ecf112b26b2b45d1889678c01dea98eb5767d8
SHA512 da09a2af9b7f9528916ab719ed97ee8b61179bba92016eaed64b3e7d6bf08646801aeeb0eb332bdde175eb64b48106f7cf2fe2bf01ea6128753e4ce1d48707be

\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

MD5 c0515403f748f548698f090176157f65
SHA1 f8ce496f754fc21cd3063b9de11bfb943cad5af3
SHA256 62d9c30c6fbee6f7b05e2c98a3d69613cdfc78989f7877184eba1890e544c829
SHA512 6379ff7f2a5d7ddfd182d1c0fcad28bf4ce2af7f6f330fd09e3ef4172a45b9f6b9ea916fcc03af8afae9fa95437773c8bd2009dc200170ed109c1ece84f22867

memory/2420-43-0x0000000003160000-0x000000000332A000-memory.dmp

memory/2420-45-0x0000000000400000-0x00000000005CA000-memory.dmp

memory/2420-42-0x0000000003160000-0x000000000332A000-memory.dmp

memory/3052-50-0x0000000000400000-0x00000000005CA000-memory.dmp

memory/3052-67-0x0000000000400000-0x00000000005CA000-memory.dmp

memory/2584-54-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3068-66-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3068-71-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2584-70-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3068-65-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3068-60-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2584-56-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2584-51-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2584-72-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3068-73-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2584-76-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2584-79-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2584-81-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2584-83-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2584-85-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2584-90-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2584-95-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2584-99-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2584-104-0x0000000000400000-0x000000000045C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-03 20:53

Reported

2025-02-03 20:55

Platform

win10v2004-20250129-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Window Updates\\winupdt2.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Updater.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Updater.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3625106387-4207083342-115176794-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3625106387-4207083342-115176794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdt = "C:\\Users\\Admin\\AppData\\Roaming\\Window Updates\\winupdt2.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2216 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d.exe C:\Windows\SysWOW64\cmd.exe
PID 2216 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d.exe C:\Windows\SysWOW64\cmd.exe
PID 2216 wrote to memory of 4440 N/A C:\Users\Admin\AppData\Local\Temp\22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d.exe C:\Windows\SysWOW64\cmd.exe
PID 4440 wrote to memory of 4300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4440 wrote to memory of 4300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4440 wrote to memory of 4300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2216 wrote to memory of 1004 N/A C:\Users\Admin\AppData\Local\Temp\22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2216 wrote to memory of 1004 N/A C:\Users\Admin\AppData\Local\Temp\22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2216 wrote to memory of 1004 N/A C:\Users\Admin\AppData\Local\Temp\22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 1004 wrote to memory of 5052 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 1004 wrote to memory of 5052 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 1004 wrote to memory of 5052 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 1004 wrote to memory of 5052 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 1004 wrote to memory of 5052 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 1004 wrote to memory of 5052 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 1004 wrote to memory of 5052 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 1004 wrote to memory of 5052 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 1004 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 1004 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 1004 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 1004 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 1004 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 1004 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 1004 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 1004 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 5052 wrote to memory of 64 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 5052 wrote to memory of 64 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 5052 wrote to memory of 64 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 5052 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 5052 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 5052 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 5052 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 5052 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 5052 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 5052 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 5052 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 5052 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2472 wrote to memory of 2132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2472 wrote to memory of 2132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2472 wrote to memory of 2132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2584 wrote to memory of 3680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2584 wrote to memory of 3680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2584 wrote to memory of 3680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 64 wrote to memory of 4616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 64 wrote to memory of 4616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 64 wrote to memory of 4616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2604 wrote to memory of 1948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2604 wrote to memory of 1948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2604 wrote to memory of 1948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d.exe

"C:\Users\Admin\AppData\Local\Temp\22b1a72336542a672deb9d9e3dfe39b2f84d0f374cae19f5bb40706569145c5d.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XVQPK.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinUpdt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /f

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 3.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 20.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 54.120.234.20.in-addr.arpa udp
GB 88.221.135.11:443 www.bing.com tcp
US 8.8.8.8:53 11.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 166.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 8.179.89.13.in-addr.arpa udp

Files

memory/2216-0-0x0000000000400000-0x00000000005CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XVQPK.txt

MD5 49bb161b07149b1bda99901c71d98b1f
SHA1 e5e3b389c09d551bd8f3a4cf71ee30e566fdf6e2
SHA256 734c4f48449a118dbdfbbe4971ecf112b26b2b45d1889678c01dea98eb5767d8
SHA512 da09a2af9b7f9528916ab719ed97ee8b61179bba92016eaed64b3e7d6bf08646801aeeb0eb332bdde175eb64b48106f7cf2fe2bf01ea6128753e4ce1d48707be

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.txt

MD5 a9ddd7f99dd05299a8def4237cef0763
SHA1 193a92f67f56a27a20714951cfaeca8078fad95b
SHA256 6b4433bb37e7e1b6dcbbe208a1b478b54a3ced648d4cef4d472fa3cbd7c9c257
SHA512 cb251ce192bfc8a4aaaaac0e0bd99f73863cde94e455a2b33219325a77716385ca64034201381960c9f3fbc3319aa7928ef55ca347e6538deff2bbd41bcc0a21

memory/2216-28-0x0000000000400000-0x00000000005CA000-memory.dmp

memory/5052-31-0x0000000000400000-0x000000000045C000-memory.dmp

memory/5052-36-0x0000000000400000-0x000000000045C000-memory.dmp

memory/5052-34-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4592-42-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4592-38-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4592-43-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1004-48-0x0000000000400000-0x00000000005CA000-memory.dmp

memory/5052-51-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4592-52-0x0000000000400000-0x0000000000409000-memory.dmp

memory/5052-53-0x0000000000400000-0x000000000045C000-memory.dmp

memory/5052-55-0x0000000000400000-0x000000000045C000-memory.dmp

memory/5052-58-0x0000000000400000-0x000000000045C000-memory.dmp

memory/5052-60-0x0000000000400000-0x000000000045C000-memory.dmp

memory/5052-62-0x0000000000400000-0x000000000045C000-memory.dmp

memory/5052-65-0x0000000000400000-0x000000000045C000-memory.dmp

memory/5052-67-0x0000000000400000-0x000000000045C000-memory.dmp

memory/5052-71-0x0000000000400000-0x000000000045C000-memory.dmp

memory/5052-74-0x0000000000400000-0x000000000045C000-memory.dmp

memory/5052-76-0x0000000000400000-0x000000000045C000-memory.dmp

memory/5052-78-0x0000000000400000-0x000000000045C000-memory.dmp

memory/5052-81-0x0000000000400000-0x000000000045C000-memory.dmp