blackshades | 6a5b4981a7cd40b05bb466188315201082910b32134ccdf23012747264bb6603

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07/02/2025, 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_b39c74780c2d2bbf7974fc1f138ba2c5.exe
Size

5.5MB
MD5

b39c74780c2d2bbf7974fc1f138ba2c5
SHA1

ade02c6dcd09289a9e9ffb4425f74bd687ea2aef
SHA256

6a5b4981a7cd40b05bb466188315201082910b32134ccdf23012747264bb6603
SHA512

6db667ab5c2e6c5edfb2e3460667ccf37341f956f514f4d43eee414b893623d1147a6fb1f56a22055af8398d3b36c91d4e456621d46c8421dae9e087717a8f44
SSDEEP

49152:edq+YWfznMv72HP7moIKmfa1tYRGvM7gO70C:WPYWfe2HDiKmfaXYRB7j7F

Score

10^/10

blackshades defense_evasion discovery persistence rat upx

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 15 IoCs

resource	yara_rule
behavioral1/memory/2768-51-0x0000000000400000-0x0000000000475000-memory.dmp	family_blackshades
behavioral1/memory/2768-67-0x0000000000400000-0x0000000000475000-memory.dmp	family_blackshades
behavioral1/memory/2768-70-0x0000000000400000-0x0000000000475000-memory.dmp	family_blackshades
behavioral1/memory/2768-72-0x0000000000400000-0x0000000000475000-memory.dmp	family_blackshades
behavioral1/memory/2768-75-0x0000000000400000-0x0000000000475000-memory.dmp	family_blackshades
behavioral1/memory/2768-77-0x0000000000400000-0x0000000000475000-memory.dmp	family_blackshades
behavioral1/memory/2768-79-0x0000000000400000-0x0000000000475000-memory.dmp	family_blackshades
behavioral1/memory/2768-82-0x0000000000400000-0x0000000000475000-memory.dmp	family_blackshades
behavioral1/memory/2768-84-0x0000000000400000-0x0000000000475000-memory.dmp	family_blackshades
behavioral1/memory/2768-86-0x0000000000400000-0x0000000000475000-memory.dmp	family_blackshades
behavioral1/memory/2768-89-0x0000000000400000-0x0000000000475000-memory.dmp	family_blackshades
behavioral1/memory/2768-91-0x0000000000400000-0x0000000000475000-memory.dmp	family_blackshades
behavioral1/memory/2768-93-0x0000000000400000-0x0000000000475000-memory.dmp	family_blackshades
behavioral1/memory/2768-96-0x0000000000400000-0x0000000000475000-memory.dmp	family_blackshades
behavioral1/memory/2768-98-0x0000000000400000-0x0000000000475000-memory.dmp	family_blackshades

Modifies firewall policy service 3 TTPs 8 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\system32\xxx.exe = "C:\\Users\\Admin\\AppData\\Roaming\\system32\\xxx.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\shit2.exe = "C:\\Users\\Admin\\AppData\\Roaming\\shit2.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe

Executes dropped EXE 3 IoCs

pid	Process
2652	xxx.exe
2768	xxx.exe
2856	xxx.exe

Loads dropped DLL 6 IoCs

pid	Process
2320	JaffaCakes118_b39c74780c2d2bbf7974fc1f138ba2c5.exe
2320	JaffaCakes118_b39c74780c2d2bbf7974fc1f138ba2c5.exe
2320	JaffaCakes118_b39c74780c2d2bbf7974fc1f138ba2c5.exe
2320	JaffaCakes118_b39c74780c2d2bbf7974fc1f138ba2c5.exe
2320	JaffaCakes118_b39c74780c2d2bbf7974fc1f138ba2c5.exe
2652	xxx.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\xxx.exe = "C:\\Users\\Admin\\AppData\\Roaming\\system32\\xxx.exe"	reg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2652 set thread context of 2768	2652	xxx.exe	35
PID 2652 set thread context of 2856	2652	xxx.exe	36

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2320-2-0x0000000000400000-0x000000000098A000-memory.dmp	upx
behavioral1/files/0x000700000001907c-20.dat	upx
behavioral1/memory/2320-40-0x0000000000400000-0x000000000098A000-memory.dmp	upx
behavioral1/memory/2768-51-0x0000000000400000-0x0000000000475000-memory.dmp	upx
behavioral1/memory/2768-49-0x0000000000400000-0x0000000000475000-memory.dmp	upx
behavioral1/memory/2768-46-0x0000000000400000-0x0000000000475000-memory.dmp	upx
behavioral1/memory/2652-64-0x0000000000400000-0x000000000098A000-memory.dmp	upx
behavioral1/memory/2768-67-0x0000000000400000-0x0000000000475000-memory.dmp	upx
behavioral1/memory/2768-70-0x0000000000400000-0x0000000000475000-memory.dmp	upx
behavioral1/memory/2768-72-0x0000000000400000-0x0000000000475000-memory.dmp	upx
behavioral1/memory/2768-75-0x0000000000400000-0x0000000000475000-memory.dmp	upx
behavioral1/memory/2768-77-0x0000000000400000-0x0000000000475000-memory.dmp	upx
behavioral1/memory/2768-79-0x0000000000400000-0x0000000000475000-memory.dmp	upx
behavioral1/memory/2768-82-0x0000000000400000-0x0000000000475000-memory.dmp	upx
behavioral1/memory/2768-84-0x0000000000400000-0x0000000000475000-memory.dmp	upx
behavioral1/memory/2768-86-0x0000000000400000-0x0000000000475000-memory.dmp	upx
behavioral1/memory/2768-89-0x0000000000400000-0x0000000000475000-memory.dmp	upx
behavioral1/memory/2768-91-0x0000000000400000-0x0000000000475000-memory.dmp	upx
behavioral1/memory/2768-93-0x0000000000400000-0x0000000000475000-memory.dmp	upx
behavioral1/memory/2768-96-0x0000000000400000-0x0000000000475000-memory.dmp	upx
behavioral1/memory/2768-98-0x0000000000400000-0x0000000000475000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xxx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_b39c74780c2d2bbf7974fc1f138ba2c5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xxx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xxx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
2100	reg.exe
992	reg.exe
320	reg.exe
3064	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: 1	2768	xxx.exe
Token: SeCreateTokenPrivilege	2768	xxx.exe
Token: SeAssignPrimaryTokenPrivilege	2768	xxx.exe
Token: SeLockMemoryPrivilege	2768	xxx.exe
Token: SeIncreaseQuotaPrivilege	2768	xxx.exe
Token: SeMachineAccountPrivilege	2768	xxx.exe
Token: SeTcbPrivilege	2768	xxx.exe
Token: SeSecurityPrivilege	2768	xxx.exe
Token: SeTakeOwnershipPrivilege	2768	xxx.exe
Token: SeLoadDriverPrivilege	2768	xxx.exe
Token: SeSystemProfilePrivilege	2768	xxx.exe
Token: SeSystemtimePrivilege	2768	xxx.exe
Token: SeProfSingleProcessPrivilege	2768	xxx.exe
Token: SeIncBasePriorityPrivilege	2768	xxx.exe
Token: SeCreatePagefilePrivilege	2768	xxx.exe
Token: SeCreatePermanentPrivilege	2768	xxx.exe
Token: SeBackupPrivilege	2768	xxx.exe
Token: SeRestorePrivilege	2768	xxx.exe
Token: SeShutdownPrivilege	2768	xxx.exe
Token: SeDebugPrivilege	2768	xxx.exe
Token: SeAuditPrivilege	2768	xxx.exe
Token: SeSystemEnvironmentPrivilege	2768	xxx.exe
Token: SeChangeNotifyPrivilege	2768	xxx.exe
Token: SeRemoteShutdownPrivilege	2768	xxx.exe
Token: SeUndockPrivilege	2768	xxx.exe
Token: SeSyncAgentPrivilege	2768	xxx.exe
Token: SeEnableDelegationPrivilege	2768	xxx.exe
Token: SeManageVolumePrivilege	2768	xxx.exe
Token: SeImpersonatePrivilege	2768	xxx.exe
Token: SeCreateGlobalPrivilege	2768	xxx.exe
Token: 31	2768	xxx.exe
Token: 32	2768	xxx.exe
Token: 33	2768	xxx.exe
Token: 34	2768	xxx.exe
Token: 35	2768	xxx.exe
Token: SeDebugPrivilege	2856	xxx.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	JaffaCakes118_b39c74780c2d2bbf7974fc1f138ba2c5.exe
2652	xxx.exe
2768	xxx.exe
2768	xxx.exe
2768	xxx.exe
2856	xxx.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 608	2320	JaffaCakes118_b39c74780c2d2bbf7974fc1f138ba2c5.exe	31
PID 2320 wrote to memory of 608	2320	JaffaCakes118_b39c74780c2d2bbf7974fc1f138ba2c5.exe	31
PID 2320 wrote to memory of 608	2320	JaffaCakes118_b39c74780c2d2bbf7974fc1f138ba2c5.exe	31
PID 2320 wrote to memory of 608	2320	JaffaCakes118_b39c74780c2d2bbf7974fc1f138ba2c5.exe	31
PID 608 wrote to memory of 2192	608	cmd.exe	33
PID 608 wrote to memory of 2192	608	cmd.exe	33
PID 608 wrote to memory of 2192	608	cmd.exe	33
PID 608 wrote to memory of 2192	608	cmd.exe	33
PID 2320 wrote to memory of 2652	2320	JaffaCakes118_b39c74780c2d2bbf7974fc1f138ba2c5.exe	34
PID 2320 wrote to memory of 2652	2320	JaffaCakes118_b39c74780c2d2bbf7974fc1f138ba2c5.exe	34
PID 2320 wrote to memory of 2652	2320	JaffaCakes118_b39c74780c2d2bbf7974fc1f138ba2c5.exe	34
PID 2320 wrote to memory of 2652	2320	JaffaCakes118_b39c74780c2d2bbf7974fc1f138ba2c5.exe	34
PID 2652 wrote to memory of 2768	2652	xxx.exe	35
PID 2652 wrote to memory of 2768	2652	xxx.exe	35
PID 2652 wrote to memory of 2768	2652	xxx.exe	35
PID 2652 wrote to memory of 2768	2652	xxx.exe	35
PID 2652 wrote to memory of 2768	2652	xxx.exe	35
PID 2652 wrote to memory of 2768	2652	xxx.exe	35
PID 2652 wrote to memory of 2768	2652	xxx.exe	35
PID 2652 wrote to memory of 2768	2652	xxx.exe	35
PID 2652 wrote to memory of 2768	2652	xxx.exe	35
PID 2652 wrote to memory of 2856	2652	xxx.exe	36
PID 2652 wrote to memory of 2856	2652	xxx.exe	36
PID 2652 wrote to memory of 2856	2652	xxx.exe	36
PID 2652 wrote to memory of 2856	2652	xxx.exe	36
PID 2652 wrote to memory of 2856	2652	xxx.exe	36
PID 2652 wrote to memory of 2856	2652	xxx.exe	36
PID 2652 wrote to memory of 2856	2652	xxx.exe	36
PID 2768 wrote to memory of 2708	2768	xxx.exe	37
PID 2768 wrote to memory of 2708	2768	xxx.exe	37
PID 2768 wrote to memory of 2708	2768	xxx.exe	37
PID 2768 wrote to memory of 2708	2768	xxx.exe	37
PID 2652 wrote to memory of 2856	2652	xxx.exe	36
PID 2768 wrote to memory of 2716	2768	xxx.exe	38
PID 2768 wrote to memory of 2716	2768	xxx.exe	38
PID 2768 wrote to memory of 2716	2768	xxx.exe	38
PID 2768 wrote to memory of 2716	2768	xxx.exe	38
PID 2768 wrote to memory of 2592	2768	xxx.exe	39
PID 2768 wrote to memory of 2592	2768	xxx.exe	39
PID 2768 wrote to memory of 2592	2768	xxx.exe	39
PID 2768 wrote to memory of 2592	2768	xxx.exe	39
PID 2768 wrote to memory of 2600	2768	xxx.exe	40
PID 2768 wrote to memory of 2600	2768	xxx.exe	40
PID 2768 wrote to memory of 2600	2768	xxx.exe	40
PID 2768 wrote to memory of 2600	2768	xxx.exe	40
PID 2592 wrote to memory of 320	2592	cmd.exe	44
PID 2592 wrote to memory of 320	2592	cmd.exe	44
PID 2592 wrote to memory of 320	2592	cmd.exe	44
PID 2592 wrote to memory of 320	2592	cmd.exe	44
PID 2708 wrote to memory of 3064	2708	cmd.exe	45
PID 2708 wrote to memory of 3064	2708	cmd.exe	45
PID 2708 wrote to memory of 3064	2708	cmd.exe	45
PID 2708 wrote to memory of 3064	2708	cmd.exe	45
PID 2716 wrote to memory of 2100	2716	cmd.exe	46
PID 2716 wrote to memory of 2100	2716	cmd.exe	46
PID 2716 wrote to memory of 2100	2716	cmd.exe	46
PID 2716 wrote to memory of 2100	2716	cmd.exe	46
PID 2600 wrote to memory of 992	2600	cmd.exe	48
PID 2600 wrote to memory of 992	2600	cmd.exe	48
PID 2600 wrote to memory of 992	2600	cmd.exe	48
PID 2600 wrote to memory of 992	2600	cmd.exe	48

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b39c74780c2d2bbf7974fc1f138ba2c5.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b39c74780c2d2bbf7974fc1f138ba2c5.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\hFVET.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:608
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "xxx.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system32\xxx.exe" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2192
- C:\Users\Admin\AppData\Roaming\system32\xxx.exe
  "C:\Users\Admin\AppData\Roaming\system32\xxx.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Users\Admin\AppData\Roaming\system32\xxx.exe
    C:\Users\Admin\AppData\Roaming\system32\xxx.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2708
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3064
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\system32\xxx.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system32\xxx.exe:*:Enabled:Windows Messanger" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2716
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\system32\xxx.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system32\xxx.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2100
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2592
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:320
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\shit2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\shit2.exe:*:Enabled:Windows Messanger" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2600
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\shit2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\shit2.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:992
- - C:\Users\Admin\AppData\Roaming\system32\xxx.exe
    C:\Users\Admin\AppData\Roaming\system32\xxx.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hFVET.bat

Filesize
139B

MD5
650665586f07db42c925008801b3275c

SHA1
e79fe2127a3a837bd1eb832fcc157e81048f0954

SHA256
1463ba97685fb5bc10bed12a727110c2803bd0c592aa3ccd7070cffbccbad8ef

SHA512
d483edd5805f0ffd7c19ee6b26153d77ab9ff273841bbd9bcb9ff1cb467d7e0f283d80601097ec412277d85e23e794e92ab503059212706e0f79377ad8186fb2

Download Submit
\Users\Admin\AppData\Roaming\system32\xxx.exe

Filesize
5.5MB

MD5
b39c74780c2d2bbf7974fc1f138ba2c5

SHA1
ade02c6dcd09289a9e9ffb4425f74bd687ea2aef

SHA256
6a5b4981a7cd40b05bb466188315201082910b32134ccdf23012747264bb6603

SHA512
6db667ab5c2e6c5edfb2e3460667ccf37341f956f514f4d43eee414b893623d1147a6fb1f56a22055af8398d3b36c91d4e456621d46c8421dae9e087717a8f44

Download Submit
memory/2320-35-0x0000000003C30000-0x00000000041BA000-memory.dmp

Filesize
5.5MB

Download
memory/2320-34-0x0000000003C30000-0x00000000041BA000-memory.dmp

Filesize
5.5MB

Download
memory/2320-36-0x0000000003C30000-0x00000000041BA000-memory.dmp

Filesize
5.5MB

Download
memory/2320-40-0x0000000000400000-0x000000000098A000-memory.dmp

Filesize
5.5MB

Download
memory/2320-38-0x0000000003C30000-0x00000000041BA000-memory.dmp

Filesize
5.5MB

Download
memory/2320-37-0x0000000003C30000-0x00000000041BA000-memory.dmp

Filesize
5.5MB

Download
memory/2320-2-0x0000000000400000-0x000000000098A000-memory.dmp

Filesize
5.5MB

Download
memory/2652-64-0x0000000000400000-0x000000000098A000-memory.dmp

Filesize
5.5MB

Download
memory/2652-45-0x0000000002EC0000-0x000000000344A000-memory.dmp

Filesize
5.5MB

Download
memory/2768-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-72-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-49-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-67-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-46-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-51-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2856-69-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2856-63-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2856-60-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2856-61-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2856-62-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2856-55-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads