blackshades | 01e3fb379387c569f03bb90fe3369ef98261a3fa9185edf9af73f26d72ba80bb

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
07-02-2025 23:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe
Size

672KB
MD5

bcafc79e3bff707f85b81c371243e101
SHA1

e6458c00ce9c743cfa3ecd7aa65fd133da27d136
SHA256

01e3fb379387c569f03bb90fe3369ef98261a3fa9185edf9af73f26d72ba80bb
SHA512

108ce9bd8049931fa71c93524b7514233718cb7cfb728c1e9820a5070fdc761536af9645bce23b8ee4f3b05cd1774ed40c7180b3536b8593eb919935abd67f99
SSDEEP

12288:7I7TyVli2X4DeSMhjp2kRn3fNvmqPIj81P9gbJraFH/g5rxiQt7k:WTei2oaPhHZ5mqS81P9ghay5dn

Score

10^/10

blackshades defense_evasion discovery persistence rat upx

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 12 IoCs

resource	yara_rule
behavioral2/memory/1152-36-0x0000000000400000-0x00000000005AC000-memory.dmp	family_blackshades
behavioral2/memory/1152-48-0x0000000000400000-0x00000000005AC000-memory.dmp	family_blackshades
behavioral2/memory/1152-49-0x0000000000400000-0x00000000005AC000-memory.dmp	family_blackshades
behavioral2/memory/1152-51-0x0000000000400000-0x00000000005AC000-memory.dmp	family_blackshades
behavioral2/memory/1152-53-0x0000000000400000-0x00000000005AC000-memory.dmp	family_blackshades
behavioral2/memory/1152-54-0x0000000000400000-0x00000000005AC000-memory.dmp	family_blackshades
behavioral2/memory/1152-56-0x0000000000400000-0x00000000005AC000-memory.dmp	family_blackshades
behavioral2/memory/1152-57-0x0000000000400000-0x00000000005AC000-memory.dmp	family_blackshades
behavioral2/memory/1152-58-0x0000000000400000-0x00000000005AC000-memory.dmp	family_blackshades
behavioral2/memory/1152-61-0x0000000000400000-0x00000000005AC000-memory.dmp	family_blackshades
behavioral2/memory/1152-65-0x0000000000400000-0x00000000005AC000-memory.dmp	family_blackshades
behavioral2/memory/1152-66-0x0000000000400000-0x00000000005AC000-memory.dmp	family_blackshades

Modifies firewall policy service 3 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\[INJECT-INTO].exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\[INJECT-INTO].exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\I56XO8J9R6.exe = "C:\\Users\\Admin\\AppData\\Roaming\\I56XO8J9R6.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
36	2208	Process not Found

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-194335498-2604837297-537231065-1000\Control Panel\International\Geo\Nation	JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe

Executes dropped EXE 2 IoCs

pid	Process
3268	B0ey5D.exe
1152	[INJECT-INTO].exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-194335498-2604837297-537231065-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSE = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CSRSS.exe"	B0ey5D.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4476 set thread context of 1152	4476	JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe	95

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1152-32-0x0000000000400000-0x00000000005AC000-memory.dmp	upx
behavioral2/memory/1152-35-0x0000000000400000-0x00000000005AC000-memory.dmp	upx
behavioral2/memory/1152-36-0x0000000000400000-0x00000000005AC000-memory.dmp	upx
behavioral2/memory/1152-48-0x0000000000400000-0x00000000005AC000-memory.dmp	upx
behavioral2/memory/1152-49-0x0000000000400000-0x00000000005AC000-memory.dmp	upx
behavioral2/memory/1152-51-0x0000000000400000-0x00000000005AC000-memory.dmp	upx
behavioral2/memory/1152-53-0x0000000000400000-0x00000000005AC000-memory.dmp	upx
behavioral2/memory/1152-54-0x0000000000400000-0x00000000005AC000-memory.dmp	upx
behavioral2/memory/1152-56-0x0000000000400000-0x00000000005AC000-memory.dmp	upx
behavioral2/memory/1152-57-0x0000000000400000-0x00000000005AC000-memory.dmp	upx
behavioral2/memory/1152-58-0x0000000000400000-0x00000000005AC000-memory.dmp	upx
behavioral2/memory/1152-61-0x0000000000400000-0x00000000005AC000-memory.dmp	upx
behavioral2/memory/1152-65-0x0000000000400000-0x00000000005AC000-memory.dmp	upx
behavioral2/memory/1152-66-0x0000000000400000-0x00000000005AC000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B0ey5D.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[INJECT-INTO].exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1796	MicrosoftEdgeUpdate.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1800	reg.exe
4968	reg.exe
3276	reg.exe
4072	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	4476	JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe
Token: 1	1152	[INJECT-INTO].exe
Token: SeCreateTokenPrivilege	1152	[INJECT-INTO].exe
Token: SeAssignPrimaryTokenPrivilege	1152	[INJECT-INTO].exe
Token: SeLockMemoryPrivilege	1152	[INJECT-INTO].exe
Token: SeIncreaseQuotaPrivilege	1152	[INJECT-INTO].exe
Token: SeMachineAccountPrivilege	1152	[INJECT-INTO].exe
Token: SeTcbPrivilege	1152	[INJECT-INTO].exe
Token: SeSecurityPrivilege	1152	[INJECT-INTO].exe
Token: SeTakeOwnershipPrivilege	1152	[INJECT-INTO].exe
Token: SeLoadDriverPrivilege	1152	[INJECT-INTO].exe
Token: SeSystemProfilePrivilege	1152	[INJECT-INTO].exe
Token: SeSystemtimePrivilege	1152	[INJECT-INTO].exe
Token: SeProfSingleProcessPrivilege	1152	[INJECT-INTO].exe
Token: SeIncBasePriorityPrivilege	1152	[INJECT-INTO].exe
Token: SeCreatePagefilePrivilege	1152	[INJECT-INTO].exe
Token: SeCreatePermanentPrivilege	1152	[INJECT-INTO].exe
Token: SeBackupPrivilege	1152	[INJECT-INTO].exe
Token: SeRestorePrivilege	1152	[INJECT-INTO].exe
Token: SeShutdownPrivilege	1152	[INJECT-INTO].exe
Token: SeDebugPrivilege	1152	[INJECT-INTO].exe
Token: SeAuditPrivilege	1152	[INJECT-INTO].exe
Token: SeSystemEnvironmentPrivilege	1152	[INJECT-INTO].exe
Token: SeChangeNotifyPrivilege	1152	[INJECT-INTO].exe
Token: SeRemoteShutdownPrivilege	1152	[INJECT-INTO].exe
Token: SeUndockPrivilege	1152	[INJECT-INTO].exe
Token: SeSyncAgentPrivilege	1152	[INJECT-INTO].exe
Token: SeEnableDelegationPrivilege	1152	[INJECT-INTO].exe
Token: SeManageVolumePrivilege	1152	[INJECT-INTO].exe
Token: SeImpersonatePrivilege	1152	[INJECT-INTO].exe
Token: SeCreateGlobalPrivilege	1152	[INJECT-INTO].exe
Token: 31	1152	[INJECT-INTO].exe
Token: 32	1152	[INJECT-INTO].exe
Token: 33	1152	[INJECT-INTO].exe
Token: 34	1152	[INJECT-INTO].exe
Token: 35	1152	[INJECT-INTO].exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1152	[INJECT-INTO].exe
1152	[INJECT-INTO].exe
1152	[INJECT-INTO].exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 4416	4476	JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe	87
PID 4476 wrote to memory of 4416	4476	JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe	87
PID 4476 wrote to memory of 4416	4476	JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe	87
PID 4416 wrote to memory of 3700	4416	csc.exe	90
PID 4416 wrote to memory of 3700	4416	csc.exe	90
PID 4416 wrote to memory of 3700	4416	csc.exe	90
PID 4476 wrote to memory of 3268	4476	JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe	92
PID 4476 wrote to memory of 3268	4476	JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe	92
PID 4476 wrote to memory of 3268	4476	JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe	92
PID 4476 wrote to memory of 4160	4476	JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe	93
PID 4476 wrote to memory of 4160	4476	JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe	93
PID 4476 wrote to memory of 4160	4476	JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe	93
PID 4476 wrote to memory of 1152	4476	JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe	95
PID 4476 wrote to memory of 1152	4476	JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe	95
PID 4476 wrote to memory of 1152	4476	JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe	95
PID 4476 wrote to memory of 1152	4476	JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe	95
PID 4476 wrote to memory of 1152	4476	JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe	95
PID 4476 wrote to memory of 1152	4476	JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe	95
PID 4476 wrote to memory of 1152	4476	JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe	95
PID 4476 wrote to memory of 1152	4476	JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe	95
PID 1152 wrote to memory of 4444	1152	[INJECT-INTO].exe	96
PID 1152 wrote to memory of 4444	1152	[INJECT-INTO].exe	96
PID 1152 wrote to memory of 4444	1152	[INJECT-INTO].exe	96
PID 1152 wrote to memory of 2968	1152	[INJECT-INTO].exe	97
PID 1152 wrote to memory of 2968	1152	[INJECT-INTO].exe	97
PID 1152 wrote to memory of 2968	1152	[INJECT-INTO].exe	97
PID 1152 wrote to memory of 2152	1152	[INJECT-INTO].exe	98
PID 1152 wrote to memory of 2152	1152	[INJECT-INTO].exe	98
PID 1152 wrote to memory of 2152	1152	[INJECT-INTO].exe	98
PID 1152 wrote to memory of 4316	1152	[INJECT-INTO].exe	99
PID 1152 wrote to memory of 4316	1152	[INJECT-INTO].exe	99
PID 1152 wrote to memory of 4316	1152	[INJECT-INTO].exe	99
PID 2968 wrote to memory of 4968	2968	cmd.exe	104
PID 2968 wrote to memory of 4968	2968	cmd.exe	104
PID 2968 wrote to memory of 4968	2968	cmd.exe	104
PID 4444 wrote to memory of 3276	4444	cmd.exe	105
PID 4444 wrote to memory of 3276	4444	cmd.exe	105
PID 4444 wrote to memory of 3276	4444	cmd.exe	105
PID 2152 wrote to memory of 4072	2152	cmd.exe	106
PID 2152 wrote to memory of 4072	2152	cmd.exe	106
PID 2152 wrote to memory of 4072	2152	cmd.exe	106
PID 4316 wrote to memory of 1800	4316	cmd.exe	107
PID 4316 wrote to memory of 1800	4316	cmd.exe	107
PID 4316 wrote to memory of 1800	4316	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bcafc79e3bff707f85b81c371243e101.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3ww_oaga.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB101.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB100.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3700
- C:\Users\Admin\AppData\Local\Temp\B0ey5D.exe
  "C:\Users\Admin\AppData\Local\Temp\B0ey5D.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3268
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n7n9cqnk.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4160
- C:\Users\Admin\AppData\Local\Temp\[INJECT-INTO].exe
  C:\Users\Admin\AppData\Local\Temp\[INJECT-INTO].exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3276
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\[INJECT-INTO].exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\[INJECT-INTO].exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\[INJECT-INTO].exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\[INJECT-INTO].exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4968
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4072
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\I56XO8J9R6.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\I56XO8J9R6.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\I56XO8J9R6.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\I56XO8J9R6.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1800

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDE1REU2RDctOUI1NC00NUIwLUJDRTEtMzdBQzVENTVCQzA4fSIgdXNlcmlkPSJ7Nzk1NERDOEQtMEVDMi00MDI3LTg1RjEtNzdGNzYwOEM4QjE4fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RjFFQUNFNTAtMTFDRi00NjNELTk4MzYtNTU1RUIxNzI1RkRGfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDcxNzgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTY4MDM3MTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTg2NzIxMTY4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\B0ey5D.exe

Filesize
4KB

MD5
2cbc47d1af449024632d29cb065cac2a

SHA1
daf453c2d35704d8d299a2233d44e570d6e1effa

SHA256
547dfd1897371aa271201c088ac816fb8e6729156dd0e29989f573d111ee8758

SHA512
0b6499e064634a4bcd2364c107a29bb929711030f8084f5c69b9d5e8b360b9629284bab38541790b528691aee6e2ae5dffd68a7f1720d8143d17a2ac29b202aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB101.tmp

Filesize
1KB

MD5
c0143a5df87f2da943c686b7d88b5e36

SHA1
c06fcfce7e0f12680ebd74f42ea164c5d25b6af7

SHA256
8b11b7cec3f376034e1fe01aefeb32003664c9fdd7405c937ff0e9233aeeaf37

SHA512
34c04c1ee9ab091a67e2c1cb79d332668394ca71447bcc5b7be12f831b5802aa6d0e630264c8d92087e4ead08afaf205b63e8f6eebee0c2b0d41ab6188270ba8

Download Submit
C:\Users\Admin\AppData\Local\Temp\[INJECT-INTO].exe

Filesize
34KB

MD5
e118330b4629b12368d91b9df6488be0

SHA1
ce90218c7e3b90df2a3409ec253048bb6472c2fd

SHA256
3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9

SHA512
ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\3ww_oaga.0.cs

Filesize
1KB

MD5
0d8bfefc47cbaa18cb21568fb4c67dda

SHA1
2d579fc297c776c0a93b206b68a2a404cfc70864

SHA256
24eba0abffc6f8f47f713c1fd77a0a0e88fcd9443e9afd87efb4a4d685300d7c

SHA512
33469a80cdb9d8607fc87ed96f8db61a42a836f80193994ceea8f751748f54979e35112b51065330597c44121a673430886beb9ae2e45389cd664944ec2415fe

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\3ww_oaga.cmdline

Filesize
259B

MD5
00befb6fd8b2f26c746084b7f5650ace

SHA1
535ae7684e50ee2249a10477d5a1f97a92ae67a6

SHA256
ec1c06fcca13c9263ba7076809d2e9d21bffeadf10a25f2939a392ce0ed07002

SHA512
c44b76b65f71000bce4210876fa0adb9afe93714450b2d2f9116f953cdb70a30c45781f91a8d86ed031a0f13b2083bc16354238bb4e45754fbc2748e3721e1d3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCB100.tmp

Filesize
644B

MD5
6a839250f168a7421004a2b77ee5c3d2

SHA1
81ba3f3b5bc6864b95d187f2751307fc1e7842ec

SHA256
9cf0ca48aedb822be6530fdc7f6c2c9ac78c16605c72e3e6937c7d9f23eb4be5

SHA512
228d3a34513060b9e81e3211ba74b7685446d6a4c315ce28bac94ce22eb89533c2f48e9277e8637401874c8ad9e0a0ecc3a0d2495764cf3b03a928372768914c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\n7n9cqnk.0.cs

Filesize
4KB

MD5
0afd1bbd9af7844607f71d543d4de02f

SHA1
5137e9ca4ec9bb312312d388fb01dd246dd08178

SHA256
e404b75539ea4a5ea3b2b0a8daf3d62c5eb2253fb9e50a75feb0fd771c8ed629

SHA512
d09f6f37bc8d972f5856ddfc8ce53f2bc54d26fbfe3bd8414b0136a2708dc3bc07cbf5242c79648dabab3d655462edc86cbad29751863f0296a135ac71cfd4c1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\n7n9cqnk.cmdline

Filesize
321B

MD5
b2477c30cf42bb1fa8d4281f7c9d277e

SHA1
6c6df6dc37797b61f8aeb8267774e490bbbc8867

SHA256
8ed4326332cff3a696456dc2214873b68a303dbe60c9de5445aae5c4e8252d79

SHA512
f9f2457ad52f2a39b20aad01565acef9fa14de6427554abfc6c21a0f50ad6cf345dd8d3cbc6edc357aa89df8f3d7fe69c0ff3cea3c9f36b749e5539e42e7f490

Download Submit
memory/1152-51-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/1152-56-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/1152-66-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/1152-65-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/1152-61-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/1152-58-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/1152-57-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/1152-32-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/1152-35-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/1152-36-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/1152-54-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/1152-53-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/1152-49-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/1152-48-0x0000000000400000-0x00000000005AC000-memory.dmp

Filesize
1.7MB

Download
memory/3268-47-0x00000000747E0000-0x0000000074D91000-memory.dmp

Filesize
5.7MB

Download
memory/3268-25-0x00000000747E0000-0x0000000074D91000-memory.dmp

Filesize
5.7MB

Download
memory/3268-24-0x00000000747E0000-0x0000000074D91000-memory.dmp

Filesize
5.7MB

Download
memory/4416-15-0x00000000747E0000-0x0000000074D91000-memory.dmp

Filesize
5.7MB

Download
memory/4416-11-0x00000000747E0000-0x0000000074D91000-memory.dmp

Filesize
5.7MB

Download
memory/4476-46-0x00000000747E0000-0x0000000074D91000-memory.dmp

Filesize
5.7MB

Download
memory/4476-0-0x00000000747E2000-0x00000000747E3000-memory.dmp

Filesize
4KB

Download
memory/4476-43-0x00000000747E0000-0x0000000074D91000-memory.dmp

Filesize
5.7MB

Download
memory/4476-42-0x00000000747E2000-0x00000000747E3000-memory.dmp

Filesize
4KB

Download
memory/4476-1-0x00000000747E0000-0x0000000074D91000-memory.dmp

Filesize
5.7MB

Download
memory/4476-2-0x00000000747E0000-0x0000000074D91000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads