blackshades | 159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905

Analysis

max time kernel
10s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
05-02-2025 11:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe
Size

405KB
MD5

6d6ded5c29c54d37ed5e481270d0cb20
SHA1

70a2ba22881f9d2c02cc65d801a04f18b39bd359
SHA256

159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905
SHA512

dedbda5b25762844417fec10fa3134749781911c44d6294fd9c1a2f80286ad239f46c39f22ca53fe9d4e18c2a9e3aff32f433c5d2a0ab167d2d2349b437625c8
SSDEEP

6144:foYn9sE89XKTK/J6brj3nmHWrt63P5A9GJ6vbmF4ifKyjlKI4r3mzzrLVIo8ZJr7:ZsNDBIrCHWux6iFTJf4r2zPBv8Xi8xSG

Score

10^/10

blackshades discovery persistence rat upx

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 10 IoCs

resource	yara_rule
behavioral2/memory/1088-66-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/1088-81-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/1088-83-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/1088-86-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/1088-88-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/1088-90-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/1088-93-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/1088-95-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/1088-97-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/1088-102-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\Control Panel\International\Geo\Nation	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe

Executes dropped EXE 3 IoCs

pid	Process
2408	javaruntime.exe
3532	javaruntime.exe
1088	javaruntime.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\javaruntime = "C:\\Windows\\javaruntime.exe"	reg.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2788 set thread context of 916	2788	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	90
PID 2788 set thread context of 1420	2788	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	91
PID 2408 set thread context of 2040	2408	javaruntime.exe	97
PID 2408 set thread context of 3532	2408	javaruntime.exe	98
PID 2408 set thread context of 1088	2408	javaruntime.exe	99

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2788-0-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/2788-13-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/1420-14-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/1420-18-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/1420-16-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/2788-22-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/files/0x000c000000023b37-36.dat	upx
behavioral2/memory/2408-47-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/2408-55-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/1420-53-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/1088-63-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1088-66-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1088-65-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/2408-68-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/1420-76-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/3532-78-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/1088-81-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1088-83-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1088-86-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1088-88-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1088-90-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1088-93-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1088-95-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1088-97-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1088-102-0x0000000000400000-0x000000000047B000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\javaruntime.exe	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe
File opened for modification	C:\Windows\javaruntime.exe	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaruntime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaruntime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaruntime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1712	reg.exe
460	reg.exe
1740	reg.exe
1592	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe
916	svchost.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: 1	1088	javaruntime.exe
Token: SeCreateTokenPrivilege	1088	javaruntime.exe
Token: SeAssignPrimaryTokenPrivilege	1088	javaruntime.exe
Token: SeLockMemoryPrivilege	1088	javaruntime.exe
Token: SeIncreaseQuotaPrivilege	1088	javaruntime.exe
Token: SeMachineAccountPrivilege	1088	javaruntime.exe
Token: SeTcbPrivilege	1088	javaruntime.exe
Token: SeSecurityPrivilege	1088	javaruntime.exe
Token: SeTakeOwnershipPrivilege	1088	javaruntime.exe
Token: SeLoadDriverPrivilege	1088	javaruntime.exe
Token: SeSystemProfilePrivilege	1088	javaruntime.exe
Token: SeSystemtimePrivilege	1088	javaruntime.exe
Token: SeProfSingleProcessPrivilege	1088	javaruntime.exe
Token: SeIncBasePriorityPrivilege	1088	javaruntime.exe
Token: SeCreatePagefilePrivilege	1088	javaruntime.exe
Token: SeCreatePermanentPrivilege	1088	javaruntime.exe
Token: SeBackupPrivilege	1088	javaruntime.exe
Token: SeRestorePrivilege	1088	javaruntime.exe
Token: SeShutdownPrivilege	1088	javaruntime.exe
Token: SeDebugPrivilege	1088	javaruntime.exe
Token: SeAuditPrivilege	1088	javaruntime.exe
Token: SeSystemEnvironmentPrivilege	1088	javaruntime.exe
Token: SeChangeNotifyPrivilege	1088	javaruntime.exe
Token: SeRemoteShutdownPrivilege	1088	javaruntime.exe
Token: SeUndockPrivilege	1088	javaruntime.exe
Token: SeSyncAgentPrivilege	1088	javaruntime.exe
Token: SeEnableDelegationPrivilege	1088	javaruntime.exe
Token: SeManageVolumePrivilege	1088	javaruntime.exe
Token: SeImpersonatePrivilege	1088	javaruntime.exe
Token: SeCreateGlobalPrivilege	1088	javaruntime.exe
Token: 31	1088	javaruntime.exe
Token: 32	1088	javaruntime.exe
Token: 33	1088	javaruntime.exe
Token: 34	1088	javaruntime.exe
Token: 35	1088	javaruntime.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2788	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe
916	svchost.exe
1420	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe
2408	javaruntime.exe
2408	javaruntime.exe
2040	svchost.exe
3532	javaruntime.exe
1088	javaruntime.exe
1088	javaruntime.exe
1088	javaruntime.exe
1088	javaruntime.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 916	2788	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	90
PID 2788 wrote to memory of 916	2788	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	90
PID 2788 wrote to memory of 916	2788	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	90
PID 2788 wrote to memory of 916	2788	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	90
PID 2788 wrote to memory of 916	2788	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	90
PID 2788 wrote to memory of 916	2788	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	90
PID 2788 wrote to memory of 916	2788	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	90
PID 2788 wrote to memory of 916	2788	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	90
PID 2788 wrote to memory of 916	2788	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	90
PID 2788 wrote to memory of 1420	2788	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	91
PID 2788 wrote to memory of 1420	2788	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	91
PID 2788 wrote to memory of 1420	2788	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	91
PID 2788 wrote to memory of 1420	2788	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	91
PID 2788 wrote to memory of 1420	2788	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	91
PID 2788 wrote to memory of 1420	2788	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	91
PID 2788 wrote to memory of 1420	2788	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	91
PID 2788 wrote to memory of 1420	2788	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	91
PID 1420 wrote to memory of 4616	1420	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	92
PID 1420 wrote to memory of 4616	1420	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	92
PID 1420 wrote to memory of 4616	1420	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	92
PID 4616 wrote to memory of 3920	4616	cmd.exe	95
PID 4616 wrote to memory of 3920	4616	cmd.exe	95
PID 4616 wrote to memory of 3920	4616	cmd.exe	95
PID 1420 wrote to memory of 2408	1420	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	96
PID 1420 wrote to memory of 2408	1420	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	96
PID 1420 wrote to memory of 2408	1420	159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe	96
PID 2408 wrote to memory of 2040	2408	javaruntime.exe	97
PID 2408 wrote to memory of 2040	2408	javaruntime.exe	97
PID 2408 wrote to memory of 2040	2408	javaruntime.exe	97
PID 2408 wrote to memory of 2040	2408	javaruntime.exe	97
PID 2408 wrote to memory of 2040	2408	javaruntime.exe	97
PID 2408 wrote to memory of 2040	2408	javaruntime.exe	97
PID 2408 wrote to memory of 2040	2408	javaruntime.exe	97
PID 2408 wrote to memory of 2040	2408	javaruntime.exe	97
PID 2408 wrote to memory of 2040	2408	javaruntime.exe	97
PID 2408 wrote to memory of 3532	2408	javaruntime.exe	98
PID 2408 wrote to memory of 3532	2408	javaruntime.exe	98
PID 2408 wrote to memory of 3532	2408	javaruntime.exe	98
PID 2408 wrote to memory of 3532	2408	javaruntime.exe	98
PID 2408 wrote to memory of 3532	2408	javaruntime.exe	98
PID 2408 wrote to memory of 3532	2408	javaruntime.exe	98
PID 2408 wrote to memory of 3532	2408	javaruntime.exe	98
PID 2408 wrote to memory of 3532	2408	javaruntime.exe	98
PID 2408 wrote to memory of 1088	2408	javaruntime.exe	99
PID 2408 wrote to memory of 1088	2408	javaruntime.exe	99
PID 2408 wrote to memory of 1088	2408	javaruntime.exe	99
PID 2408 wrote to memory of 1088	2408	javaruntime.exe	99
PID 2408 wrote to memory of 1088	2408	javaruntime.exe	99
PID 2408 wrote to memory of 1088	2408	javaruntime.exe	99
PID 2408 wrote to memory of 1088	2408	javaruntime.exe	99
PID 2408 wrote to memory of 1088	2408	javaruntime.exe	99
PID 1088 wrote to memory of 3820	1088	javaruntime.exe	100
PID 1088 wrote to memory of 3820	1088	javaruntime.exe	100
PID 1088 wrote to memory of 3820	1088	javaruntime.exe	100
PID 1088 wrote to memory of 2728	1088	javaruntime.exe	101
PID 1088 wrote to memory of 2728	1088	javaruntime.exe	101
PID 1088 wrote to memory of 2728	1088	javaruntime.exe	101
PID 1088 wrote to memory of 5008	1088	javaruntime.exe	102
PID 1088 wrote to memory of 5008	1088	javaruntime.exe	102
PID 1088 wrote to memory of 5008	1088	javaruntime.exe	102
PID 1088 wrote to memory of 3188	1088	javaruntime.exe	103
PID 1088 wrote to memory of 3188	1088	javaruntime.exe	103
PID 1088 wrote to memory of 3188	1088	javaruntime.exe	103

C:\Users\Admin\AppData\Local\Temp\159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe
"C:\Users\Admin\AppData\Local\Temp\159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:916
- C:\Users\Admin\AppData\Local\Temp\159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe
  "C:\Users\Admin\AppData\Local\Temp\159586353622aa4ed7aaca1c40d8d01e3d7446eeab27a016d8956048af21e905N.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JXXLM.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaruntime" /t REG_SZ /d "C:\Windows\javaruntime.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:3920
- - C:\Windows\javaruntime.exe
    "C:\Windows\javaruntime.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2040
  - - C:\Windows\javaruntime.exe
      "C:\Windows\javaruntime.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3532
  - - C:\Windows\javaruntime.exe
      "C:\Windows\javaruntime.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1088
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:3820
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        6⤵
        Modifies registry key
        
        PID:460
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f
        5⤵
        
        PID:2728
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f
        6⤵
        Modifies registry key
        
        PID:1712
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:5008
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        6⤵
        Modifies registry key
        
        PID:1592
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f
        5⤵
        
        PID:3188
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f
        6⤵
        Modifies registry key
        
        PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JXXLM.txt

Filesize
124B

MD5
163f8e838efe1d166ffff7408b814e28

SHA1
52fa0ccba649587e7d24d21d182657078fa6d028

SHA256
dc60287c419225759aa9e1ea0423be4106337dad71aaa0cdc9d55d2b1af3edb7

SHA512
b6685390029555f7d812f0d1a9f138c619555712add3e79c1c90a1a5a0c544e4a86768a626d25c6af3cec09afc0bbaf7f398114e849831bdc5666fc443a1f68d

Download Submit
C:\Windows\javaruntime.exe

Filesize
405KB

MD5
6ec1d86fd5476dce40dff94568c09a0f

SHA1
4c79a8b95c5edf4b3c45962309630c755ff38424

SHA256
2db84c6507cb129ece0eb45c6229787c3e8bb33e473ed519ac6a6d85ab06b28f

SHA512
75d6e1bd7913d00318d8bf52ea4ce0c1d41a4974a5ea501a5a7d70f5c67cc4eaef4f318fe01c4e4bf3586471f25a22828beb847357b9c8f723f80ba4cee51ca8

Download Submit
memory/916-8-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/916-46-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/916-6-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/916-9-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/916-12-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1088-93-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1088-63-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1088-90-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1088-88-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1088-86-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1088-83-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1088-95-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1088-97-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1088-102-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1088-81-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1088-65-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1088-66-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1420-74-0x0000000000490000-0x0000000000559000-memory.dmp

Filesize
804KB

Download
memory/1420-76-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1420-53-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1420-14-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1420-18-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1420-16-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2040-48-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2040-77-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2040-56-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2040-50-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2408-55-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2408-68-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2408-47-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2788-13-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2788-22-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2788-0-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2788-5-0x0000000002F90000-0x0000000002F92000-memory.dmp

Filesize
8KB

Download
memory/2788-4-0x0000000002F50000-0x0000000002F52000-memory.dmp

Filesize
8KB

Download
memory/2788-3-0x0000000002C30000-0x0000000002C32000-memory.dmp

Filesize
8KB

Download
memory/3532-78-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download