Malware Analysis Report

2025-04-03 10:15

Sample ID 250204-ealqjavrdn
Target afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de
SHA256 afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de
Tags
blackshades defense_evasion discovery persistence rat upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de

Threat Level: Known bad

The file afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de was found to be: Known bad.

Malicious Activity Summary

blackshades defense_evasion discovery persistence rat upx

Modifies firewall policy service

Blackshades family

Blackshades

Blackshades payload

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

UPX packed file

Suspicious use of SetThreadContext

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Modifies registry key

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-04 03:44

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-04 03:44

Reported

2025-02-04 03:46

Platform

win7-20240903-en

Max time kernel

148s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Updater.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Updater.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update\\winupdt.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Window Updates = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update\\winupdt.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2964 set thread context of 2960 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1632 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de.exe C:\Windows\SysWOW64\cmd.exe
PID 1632 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de.exe C:\Windows\SysWOW64\cmd.exe
PID 1632 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de.exe C:\Windows\SysWOW64\cmd.exe
PID 1632 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de.exe C:\Windows\SysWOW64\cmd.exe
PID 2244 wrote to memory of 2640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2244 wrote to memory of 2640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2244 wrote to memory of 2640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2244 wrote to memory of 2640 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1632 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 1632 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 1632 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 1632 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 2964 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 2964 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 2964 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 2964 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 2964 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 2964 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 2964 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 2964 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 2964 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 2960 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 2568 wrote to memory of 1572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2568 wrote to memory of 1572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2568 wrote to memory of 1572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2568 wrote to memory of 1572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2156 wrote to memory of 1764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2156 wrote to memory of 1764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2156 wrote to memory of 1764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2156 wrote to memory of 1764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2660 wrote to memory of 2032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2660 wrote to memory of 2032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2660 wrote to memory of 2032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2660 wrote to memory of 2032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2592 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2592 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2592 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2592 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de.exe

"C:\Users\Admin\AppData\Local\Temp\afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\sUmPx.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Window Updates" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /f

C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe

"C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe"

C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe

"C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 havefunnuke.servequake.com udp

Files

memory/1632-0-0x0000000000400000-0x00000000005A7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sUmPx.bat

MD5 1954c7e666c5b4d1117ef07bc0c9b8ec
SHA1 559e3c0273c1463e9184027b749bdaad0a372681
SHA256 35e0dbc8b455ca38976157ce9d0293fd6cdca20f46f1cb69058a1e0f0af6f693
SHA512 3939de8d0ab7e67b59ff8bebed5580dafd38d8785193fd42a289728500761a68b9e6660605e19e10d4278dd106fea4b273a208f25485e7389c8f19b2958c926a

C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe

MD5 9f7f3c2143815e3481c658811a3c75ae
SHA1 a2c174d4746fe9a5a699730ba0aa00e3e2fafea7
SHA256 49169fe4ae5855da3bdefdc3505a1b75c59401c6660f5ae8a5d3c20f455472cf
SHA512 e5d939f85fce4a790a73360c27991bdf7f75cd1eaa20ef5549aeb3ac416a6fcc3f760f769e2fff3cf12a85374e26364547da9f5f15b1be2a4893396862e9bed1

memory/1632-42-0x0000000003270000-0x0000000003417000-memory.dmp

memory/2964-44-0x0000000000400000-0x00000000005A7000-memory.dmp

memory/1632-46-0x0000000000400000-0x00000000005A7000-memory.dmp

memory/2960-51-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2960-56-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2960-54-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2964-58-0x0000000000400000-0x00000000005A7000-memory.dmp

memory/2960-64-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2960-66-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2960-68-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2960-69-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2960-70-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2960-72-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2960-74-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2960-77-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2960-80-0x0000000000400000-0x000000000045C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-04 03:44

Reported

2025-02-04 03:46

Platform

win10v2004-20250129-en

Max time kernel

148s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update\\winupdt.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Updater.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Updater.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4003209913-3868522715-854928974-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4003209913-3868522715-854928974-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Window Updates = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update\\winupdt.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 732 set thread context of 1624 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1572 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de.exe C:\Windows\SysWOW64\cmd.exe
PID 1572 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de.exe C:\Windows\SysWOW64\cmd.exe
PID 1572 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de.exe C:\Windows\SysWOW64\cmd.exe
PID 4880 wrote to memory of 4948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4880 wrote to memory of 4948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4880 wrote to memory of 4948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1572 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 1572 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 1572 wrote to memory of 732 N/A C:\Users\Admin\AppData\Local\Temp\afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 732 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 732 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 732 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 732 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 732 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 732 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 732 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 732 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe
PID 1624 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 1624 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 1624 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 1624 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 1624 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 1624 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 1624 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 1624 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 1624 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 1624 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 1624 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 1624 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe C:\Windows\SysWOW64\cmd.exe
PID 4296 wrote to memory of 1048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4296 wrote to memory of 1048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4296 wrote to memory of 1048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1840 wrote to memory of 4140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1840 wrote to memory of 4140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1840 wrote to memory of 4140 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4652 wrote to memory of 1380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4652 wrote to memory of 1380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4652 wrote to memory of 1380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3524 wrote to memory of 3752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3524 wrote to memory of 3752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3524 wrote to memory of 3752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de.exe

"C:\Users\Admin\AppData\Local\Temp\afa41dae856207646760abedd72019b3ee3d32f3ef30d1d196ae0805000786de.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Buyqg.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Window Updates" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /f

C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe

"C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe"

C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe

"C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 182.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 5.114.82.104.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
GB 95.101.143.201:443 www.bing.com tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 201.143.101.95.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 20.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 22.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 havefunnuke.servequake.com udp

Files

memory/1572-0-0x0000000000400000-0x00000000005A7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Buyqg.txt

MD5 1954c7e666c5b4d1117ef07bc0c9b8ec
SHA1 559e3c0273c1463e9184027b749bdaad0a372681
SHA256 35e0dbc8b455ca38976157ce9d0293fd6cdca20f46f1cb69058a1e0f0af6f693
SHA512 3939de8d0ab7e67b59ff8bebed5580dafd38d8785193fd42a289728500761a68b9e6660605e19e10d4278dd106fea4b273a208f25485e7389c8f19b2958c926a

C:\Users\Admin\AppData\Roaming\Windows Update\winupdt.txt

MD5 dd3b467a92075ea3396bf059a32c9c8b
SHA1 acdf9cc75a78067ac5dac4a56bf389e0f1645881
SHA256 9ab0c737aa76954f83448aae4ae1886be438fb061a3a1191c75043a5bb03a7dd
SHA512 8147c80c469936a236e25d3af3d18c6917602cfb0fce4cce7ed74683766cbcadf50eb6939ba7bfc618e506a3de5b21344afa73eba6d1bdd25aad89aeaffb6d7e

memory/1572-29-0x0000000000400000-0x00000000005A7000-memory.dmp

memory/1624-32-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1624-35-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1624-39-0x0000000000400000-0x000000000045C000-memory.dmp

memory/732-38-0x0000000000400000-0x00000000005A7000-memory.dmp

memory/1624-45-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1624-47-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1624-49-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1624-50-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1624-51-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1624-53-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1624-54-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1624-55-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1624-57-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1624-58-0x0000000000400000-0x000000000045C000-memory.dmp