Malware Analysis Report

2025-04-03 10:15

Sample ID 250204-kf74ls1nct
Target JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442
SHA256 6581e844b0f7815000ae606d4bddbb3fdc76a2f3e3d241a5ec26af51acf451b3
Tags
blackshades defense_evasion discovery persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6581e844b0f7815000ae606d4bddbb3fdc76a2f3e3d241a5ec26af51acf451b3

Threat Level: Known bad

The file JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442 was found to be: Known bad.

Malicious Activity Summary

blackshades defense_evasion discovery persistence rat

Blackshades family

Modifies firewall policy service

Blackshades payload

Blackshades

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Modifies registry key

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-04 08:33

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-04 08:33

Reported

2025-02-04 08:36

Platform

win7-20240903-en

Max time kernel

148s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\smss.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\smss.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ռƈƍӂƋ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wsctfy.exe" C:\Users\Admin\AppData\Local\Temp\ռƈƍӂƋ.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1696 set thread context of 2372 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\smss.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ռƈƍӂƋ.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1696 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1696 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1696 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 1696 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2088 wrote to memory of 1164 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2088 wrote to memory of 1164 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2088 wrote to memory of 1164 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2088 wrote to memory of 1164 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 1696 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\ռƈƍӂƋ.exe
PID 1696 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\ռƈƍӂƋ.exe
PID 1696 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\ռƈƍӂƋ.exe
PID 1696 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\ռƈƍӂƋ.exe
PID 1696 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\smss.exe
PID 1696 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\smss.exe
PID 1696 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\smss.exe
PID 1696 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\smss.exe
PID 1696 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\smss.exe
PID 1696 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\smss.exe
PID 1696 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\smss.exe
PID 1696 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\smss.exe
PID 2372 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 2768 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2768 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2768 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2768 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 864 wrote to memory of 2504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 864 wrote to memory of 2504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 864 wrote to memory of 2504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 864 wrote to memory of 2504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2584 wrote to memory of 3000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2584 wrote to memory of 3000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2584 wrote to memory of 3000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2584 wrote to memory of 3000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2868 wrote to memory of 3044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2868 wrote to memory of 3044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2868 wrote to memory of 3044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2868 wrote to memory of 3044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g9wnhxoh.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDE30.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDE2F.tmp"

C:\Users\Admin\AppData\Local\Temp\ռƈƍӂƋ.exe

"C:\Users\Admin\AppData\Local\Temp\ռƈƍӂƋ.exe"

C:\Users\Admin\AppData\Local\Temp\smss.exe

C:\Users\Admin\AppData\Local\Temp\smss.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\smss.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\smss.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\smss.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\smss.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
N/A 192.168.1.4:3333 tcp
N/A 192.168.1.4:3333 tcp

Files

memory/1696-0-0x00000000746E1000-0x00000000746E2000-memory.dmp

memory/1696-1-0x00000000746E0000-0x0000000074C8B000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\g9wnhxoh.cmdline

MD5 e9a0da2e0f44ad2e40103f15a9af31f0
SHA1 eddd4d6cdf07b7e4d664d949017626f5a010d75d
SHA256 8b07b621eca8548723630e9d26fd8608a1b400b8778c21e940bfc8a82780b93a
SHA512 c2656d9fd793a9ed326f720b42b84b97a75d29644b1df154d3e2a6a3c72bb55820aec4547867b828f6ff471e31b44b94a3ce3463fccdff95fec06982cf60a3ac

\??\c:\Users\Admin\AppData\Local\Temp\g9wnhxoh.0.cs

MD5 e6d189b282a26b1d0301ec0a8775b485
SHA1 9ff4f0fc126f7fb5e22e368710a47dd51de4c310
SHA256 6bf1991fb09c2e57f2b61ae0d774de6efc2544d600928b0028de9b6fda8cd038
SHA512 6a8ce26bd6d3fe10873dd49443a5212368adfbe15f3b213c03677634e7f8c8666ce2a903327c8d581d04b0e8daedd6dd29a0f98b19df96810b613517d6cc51fd

memory/2088-7-0x00000000746E0000-0x0000000074C8B000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\CSCDE2F.tmp

MD5 4b89aba9a5ca28c1f14379edf525f8b1
SHA1 95a5d8110b18238dee3b91db524703ea67febc8c
SHA256 dc19cd538d40592c076bd2e4fea637992d08fa124f6b45d78d33152222530db1
SHA512 0974a462c9488ddefdc901ecd2cc6f36d83e233adde1841c36daaaee3d9fb9920b245b24368c29419b542054ef0cdb28399e8acf31e11c195fc1f3de07295308

C:\Users\Admin\AppData\Local\Temp\RESDE30.tmp

MD5 cec46f9f7259e2930fb5ed60c0dc602f
SHA1 6cc2f00df8833a4e51d9561f977f5ec07975d5ab
SHA256 03494da1fd9de921058ebdd6fa050256474e23887b066749de236caf5877599b
SHA512 631bc57dfef705bc4fbb7be1f7a8200304a3ec26ebb7d161426842f1b792c2c8d6f331f7920e744640ac0318f814f37d374000175293c69fbba47925be227113

memory/2088-14-0x00000000746E0000-0x0000000074C8B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ռƈƍӂƋ.exe

MD5 f57619e0e26d52d7dea47ffa3f9660f8
SHA1 1a18f579054f7ae00ce91040042208bf74e80047
SHA256 55d889fee1747258e14306055347a793d8098dcb67c0d559a01fe44a097a8563
SHA512 35e98290f86ca83180c2f37f031cbc78d10351cc19954735e0e113c1091b82b070f44e5c6507b7ebcaaa5bd33ef78325ce0af4919fbd7860170d105cb15927ae

\Users\Admin\AppData\Local\Temp\smss.exe

MD5 ed797d8dc2c92401985d162e42ffa450
SHA1 0f02fc517c7facc4baefde4fe9467fb6488ebabe
SHA256 b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e
SHA512 e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

memory/2372-24-0x0000000000400000-0x0000000000478000-memory.dmp

memory/1696-35-0x00000000746E0000-0x0000000074C8B000-memory.dmp

memory/2372-31-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2372-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2372-28-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2372-26-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2372-43-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2372-44-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2372-46-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2372-47-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2372-48-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2372-51-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2372-52-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2372-55-0x0000000000400000-0x0000000000478000-memory.dmp

memory/2372-59-0x0000000000400000-0x0000000000478000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-04 08:33

Reported

2025-02-04 08:36

Platform

win10v2004-20250129-en

Max time kernel

149s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\smss.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\smss.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ռƈƍӂƋ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wsctfy.exe" C:\Users\Admin\AppData\Local\Temp\ռƈƍӂƋ.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 868 set thread context of 1060 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\smss.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ռƈƍӂƋ.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 868 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 868 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 868 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 4556 wrote to memory of 1608 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4556 wrote to memory of 1608 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 4556 wrote to memory of 1608 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 868 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\ռƈƍӂƋ.exe
PID 868 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\ռƈƍӂƋ.exe
PID 868 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\ռƈƍӂƋ.exe
PID 868 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\smss.exe
PID 868 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\smss.exe
PID 868 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\smss.exe
PID 868 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\smss.exe
PID 868 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\smss.exe
PID 868 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\smss.exe
PID 868 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\smss.exe
PID 868 wrote to memory of 1060 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe C:\Users\Admin\AppData\Local\Temp\smss.exe
PID 1060 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 1060 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 1060 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 1060 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 1060 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 1060 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 1060 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 1060 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 1060 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 1060 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 1060 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 1060 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\smss.exe C:\Windows\SysWOW64\cmd.exe
PID 1796 wrote to memory of 744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1796 wrote to memory of 744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1796 wrote to memory of 744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3028 wrote to memory of 4964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3028 wrote to memory of 4964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3028 wrote to memory of 4964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4496 wrote to memory of 440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4496 wrote to memory of 440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4496 wrote to memory of 440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3416 wrote to memory of 4440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3416 wrote to memory of 4440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3416 wrote to memory of 4440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_91e0a030c52a77bd0a98fbb99c1fc442.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ab_6j2tb.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8E27.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8E26.tmp"

C:\Users\Admin\AppData\Local\Temp\ռƈƍӂƋ.exe

"C:\Users\Admin\AppData\Local\Temp\ռƈƍӂƋ.exe"

C:\Users\Admin\AppData\Local\Temp\smss.exe

C:\Users\Admin\AppData\Local\Temp\smss.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\smss.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\smss.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\smss.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\smss.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 214.72.21.2.in-addr.arpa udp
N/A 192.168.1.4:3333 tcp
GB 23.73.138.75:443 www.bing.com tcp
US 8.8.8.8:53 75.138.73.23.in-addr.arpa udp
N/A 192.168.1.4:3333 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 98.250.22.2.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 181.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

memory/868-0-0x0000000075062000-0x0000000075063000-memory.dmp

memory/868-1-0x0000000075060000-0x0000000075611000-memory.dmp

memory/868-2-0x0000000075060000-0x0000000075611000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\ab_6j2tb.cmdline

MD5 2550cd34ff18b200e25b38b03db871d0
SHA1 07644eca174fe42616668ada364981da6127bd41
SHA256 216886836f42fab4e567d3a7e8ee199e1d0af3e28edb4451ed4fd24395aa8354
SHA512 370faddfdd723c02b6dde003a61d0ed597ddad3bd2bd12f75c449a86d9c0c805a727f951e14c88274775ce77cb8cad62347784916ac40ab9c332999221a89302

\??\c:\Users\Admin\AppData\Local\Temp\ab_6j2tb.0.cs

MD5 e6d189b282a26b1d0301ec0a8775b485
SHA1 9ff4f0fc126f7fb5e22e368710a47dd51de4c310
SHA256 6bf1991fb09c2e57f2b61ae0d774de6efc2544d600928b0028de9b6fda8cd038
SHA512 6a8ce26bd6d3fe10873dd49443a5212368adfbe15f3b213c03677634e7f8c8666ce2a903327c8d581d04b0e8daedd6dd29a0f98b19df96810b613517d6cc51fd

memory/4556-8-0x0000000075060000-0x0000000075611000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\CSC8E26.tmp

MD5 4b89aba9a5ca28c1f14379edf525f8b1
SHA1 95a5d8110b18238dee3b91db524703ea67febc8c
SHA256 dc19cd538d40592c076bd2e4fea637992d08fa124f6b45d78d33152222530db1
SHA512 0974a462c9488ddefdc901ecd2cc6f36d83e233adde1841c36daaaee3d9fb9920b245b24368c29419b542054ef0cdb28399e8acf31e11c195fc1f3de07295308

C:\Users\Admin\AppData\Local\Temp\RES8E27.tmp

MD5 3ad858a0fcad85ab1308c9446de342dc
SHA1 8c2d783fbc8338c47ce1376e9de587785ab84516
SHA256 18d489be1b2e279f508b0104603e7759d08c92854e557d17d6d5c932c4f75056
SHA512 6b03a48fd8531b8f3b7ffbd479eb99b4e037d53d53bfb96be87823ee9cce946b85cd3ca2a3951e9215002ff5cbf197848b1ee7decb73ed526ba8ccbf4e752e14

memory/4556-15-0x0000000075060000-0x0000000075611000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ռƈƍӂƋ.exe

MD5 07a848fbc4558eca629a4181d0686de4
SHA1 550dae6a14ce7a25d4c2a23ed85bc2babed13626
SHA256 2d30d4f1e89fa0773802903bc24695a71cd1212bd51f60ff6b10bec40bdbb76f
SHA512 6279751200bb63e80d41d151bd1868b686d06084b1f793c05c502b170ce1db0158bbb6239bcef4b5ec44e4bd335e9e0ae7fad5a639b66980b947b84ff5aee86b

memory/1988-19-0x0000000075060000-0x0000000075611000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\smss.exe

MD5 e118330b4629b12368d91b9df6488be0
SHA1 ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA256 3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
SHA512 ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

memory/1060-27-0x0000000000400000-0x0000000000478000-memory.dmp

memory/1060-22-0x0000000000400000-0x0000000000478000-memory.dmp

memory/868-31-0x0000000075060000-0x0000000075611000-memory.dmp

memory/1988-36-0x0000000075060000-0x0000000075611000-memory.dmp

memory/1060-37-0x0000000000400000-0x0000000000478000-memory.dmp

memory/1060-38-0x0000000000400000-0x0000000000478000-memory.dmp

memory/1060-40-0x0000000000400000-0x0000000000478000-memory.dmp

memory/1060-41-0x0000000000400000-0x0000000000478000-memory.dmp

memory/1060-42-0x0000000000400000-0x0000000000478000-memory.dmp