Malware Analysis Report

2025-04-03 10:09

Sample ID 250204-ty9vlatmhj
Target 1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe
SHA256 1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193
Tags
upx blackshades defense_evasion discovery persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193

Threat Level: Known bad

The file 1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe was found to be: Known bad.

Malicious Activity Summary

upx blackshades defense_evasion discovery persistence rat

Blackshades family

Modifies firewall policy service

Blackshades

Blackshades payload

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

UPX packed file

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Modifies registry key

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-04 16:29

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-04 16:29

Reported

2025-02-04 16:31

Platform

win7-20241010-en

Max time kernel

120s

Max time network

20s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Updater.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Updater.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Window Updates\\winupdt2.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdt = "C:\\Users\\Admin\\AppData\\Roaming\\Window Updates\\winupdt2.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 816 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe C:\Windows\SysWOW64\cmd.exe
PID 816 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe C:\Windows\SysWOW64\cmd.exe
PID 816 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe C:\Windows\SysWOW64\cmd.exe
PID 816 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe C:\Windows\SysWOW64\cmd.exe
PID 2656 wrote to memory of 3024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2656 wrote to memory of 3024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2656 wrote to memory of 3024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2656 wrote to memory of 3024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 816 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 816 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 816 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 816 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2128 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2128 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2128 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2128 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2128 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2128 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2128 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2128 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2128 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2128 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2128 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2128 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2128 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2128 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2128 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2128 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2128 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2128 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2816 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 2816 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 1148 wrote to memory of 2412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1148 wrote to memory of 2412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1148 wrote to memory of 2412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1148 wrote to memory of 2412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2596 wrote to memory of 776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2596 wrote to memory of 776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2596 wrote to memory of 776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2596 wrote to memory of 776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2428 wrote to memory of 2968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2428 wrote to memory of 2968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2428 wrote to memory of 2968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2428 wrote to memory of 2968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2760 wrote to memory of 2152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2760 wrote to memory of 2152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2760 wrote to memory of 2152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2760 wrote to memory of 2152 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe

"C:\Users\Admin\AppData\Local\Temp\1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\SukqF.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinUpdt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /f

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 havefunnuke.servequake.com udp

Files

memory/816-0-0x0000000000400000-0x00000000005CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SukqF.bat

MD5 49bb161b07149b1bda99901c71d98b1f
SHA1 e5e3b389c09d551bd8f3a4cf71ee30e566fdf6e2
SHA256 734c4f48449a118dbdfbbe4971ecf112b26b2b45d1889678c01dea98eb5767d8
SHA512 da09a2af9b7f9528916ab719ed97ee8b61179bba92016eaed64b3e7d6bf08646801aeeb0eb332bdde175eb64b48106f7cf2fe2bf01ea6128753e4ce1d48707be

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

MD5 62d1d4365c1300ed30e0ed0e272f37cc
SHA1 04d35457981cb6d7ed43ee75265f07e6e4317058
SHA256 54532e6ccfa8429ac2fd6b513cb53f1a8a47c953dec9dbfd045123e57e1747f9
SHA512 b30239a5a9e3dca3293944a61eaa1c2ed2a5d3e6adcc2a1812cd92c3bd0bae5dd445d0f76b16bc261d655a5f0523a77da4acaec6db78b466192bdb84b2e4b9ba

memory/816-44-0x0000000002E00000-0x0000000002FCA000-memory.dmp

memory/816-43-0x0000000000400000-0x00000000005CA000-memory.dmp

memory/2128-48-0x0000000000400000-0x00000000005CA000-memory.dmp

memory/2816-49-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2128-59-0x0000000000400000-0x00000000005CA000-memory.dmp

memory/2820-58-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2820-57-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2820-54-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2816-53-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-52-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-67-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2820-68-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2816-70-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-75-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-79-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-82-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-84-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-91-0x0000000000400000-0x000000000045C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-04 16:29

Reported

2025-02-04 16:31

Platform

win10v2004-20250129-en

Max time kernel

120s

Max time network

109s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Updater.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Updater.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Window Updates\\winupdt2.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3625106387-4207083342-115176794-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3625106387-4207083342-115176794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdt = "C:\\Users\\Admin\\AppData\\Roaming\\Window Updates\\winupdt2.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5072 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe C:\Windows\SysWOW64\cmd.exe
PID 5072 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe C:\Windows\SysWOW64\cmd.exe
PID 5072 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe C:\Windows\SysWOW64\cmd.exe
PID 4648 wrote to memory of 4552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4648 wrote to memory of 4552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4648 wrote to memory of 4552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5072 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 5072 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 5072 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2748 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2748 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2748 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2748 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2748 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2748 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2748 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2748 wrote to memory of 4916 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2748 wrote to memory of 220 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2748 wrote to memory of 220 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2748 wrote to memory of 220 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2748 wrote to memory of 220 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2748 wrote to memory of 220 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2748 wrote to memory of 220 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2748 wrote to memory of 220 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 2748 wrote to memory of 220 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
PID 4916 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 4916 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 4916 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 4916 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 4916 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 4916 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 4916 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 4916 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 4916 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 4916 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 4916 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 4916 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe C:\Windows\SysWOW64\cmd.exe
PID 4384 wrote to memory of 984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4384 wrote to memory of 984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4384 wrote to memory of 984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4376 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4376 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4376 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1832 wrote to memory of 2828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1832 wrote to memory of 2828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1832 wrote to memory of 2828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3388 wrote to memory of 3896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3388 wrote to memory of 3896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3388 wrote to memory of 3896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe

"C:\Users\Admin\AppData\Local\Temp\1588c4808cc1812e8bbdb5aa4236dad04e25e716583c668f896215b3cbbf2193.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oNMkd.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinUpdt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /f

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
GB 88.221.135.11:443 www.bing.com tcp
US 8.8.8.8:53 64.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 11.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 54.120.234.20.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 180.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 havefunnuke.servequake.com udp
US 8.8.8.8:53 havefunnuke.servequake.com udp

Files

memory/5072-0-0x0000000000400000-0x00000000005CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\oNMkd.bat

MD5 49bb161b07149b1bda99901c71d98b1f
SHA1 e5e3b389c09d551bd8f3a4cf71ee30e566fdf6e2
SHA256 734c4f48449a118dbdfbbe4971ecf112b26b2b45d1889678c01dea98eb5767d8
SHA512 da09a2af9b7f9528916ab719ed97ee8b61179bba92016eaed64b3e7d6bf08646801aeeb0eb332bdde175eb64b48106f7cf2fe2bf01ea6128753e4ce1d48707be

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.txt

MD5 3220240c36c85d16a4b6391336164ff2
SHA1 abad9a9bc85d3ffc6c341b2f29e5e1ae4b980e8f
SHA256 59fee842f4842438c4b917dc36028a236b90062da9753f4253e17cced2bde808
SHA512 5056ec7bd0f53c5ce370f2453ba3bc60cc10f72ba5aaf37722510fe1715e4282442aad5e8959ee3284ed55ed9307e99d210d02d67e23505f0321ee27407adad3

memory/5072-28-0x0000000000400000-0x00000000005CA000-memory.dmp

memory/4916-31-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4916-34-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4916-36-0x0000000000400000-0x000000000045C000-memory.dmp

memory/220-39-0x0000000000400000-0x0000000000409000-memory.dmp

memory/220-43-0x0000000000400000-0x0000000000409000-memory.dmp

memory/220-45-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2748-48-0x0000000000400000-0x00000000005CA000-memory.dmp

memory/4916-51-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4916-52-0x0000000000400000-0x000000000045C000-memory.dmp

memory/220-53-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4916-56-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4916-59-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4916-61-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4916-63-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4916-66-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4916-70-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4916-75-0x0000000000400000-0x000000000045C000-memory.dmp