blackshades | 269fe1396c7ff18f950672c66093b32796f5445cc986a2237b9b8f87dc6afc7a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
11/02/2025, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
Size 487KB
Sample250211-myabeavken
SHA256 269fe1396c7ff18f950672c66093b32796f5445cc986a2237b9b8f87dc6afc7a
MD5 e5931f3edadb44983ba778efb59d16a9
SHA1 1e29390a28bd647bc11060d804a98f6527c3493e
SHA512 f7ce1424e921f2213c9478a60b7b45afea873a04ba917f60a3de714f54341cce43f2214cb73edd89244b458b2a52385beaac5ed5b3d3e721f6e3a9c9eb850950
SSDEEP 12288:FIcjLmMlrDLN6YUsViowOx8+AxrEZNs0xDakISnTzFqhE:2krhio/hAx47xDakISohE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackshades defense_evasion discovery persistence rat

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 2 IoCs

resource	yara_rule
behavioral2/memory/2620-7-0x0000000000400000-0x0000000000470000-memory.dmp	family_blackshades
behavioral2/memory/2620-9-0x0000000000400000-0x0000000000470000-memory.dmp	family_blackshades

Modifies firewall policy service 3 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\WINdefender\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\WINdefender\\svchost.exe:*:Enabled:Windows Messanger"	reg.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
46	2924	Process not Found

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1290774215-692483676-1419523182-1000\Control Panel\International\Geo\Nation	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1290774215-692483676-1419523182-1000\Control Panel\International\Geo\Nation	sysglobl.exe

Executes dropped EXE 2 IoCs

pid	Process
4716	sysglobl.exe
468	mscordbc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1290774215-692483676-1419523182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\© Windows Live Messenger Music Status Plugin Module = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sysglobl.exe"	sysglobl.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 392 set thread context of 2620	392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe	87
PID 468 set thread context of 4776	468	mscordbc.exe	104

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscordbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysglobl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4804	MicrosoftEdgeUpdate.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
4836	reg.exe
1952	reg.exe
4372	reg.exe
1296	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
4716	sysglobl.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
468	mscordbc.exe
468	mscordbc.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
468	mscordbc.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
468	mscordbc.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
468	mscordbc.exe
468	mscordbc.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
468	mscordbc.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
468	mscordbc.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
468	mscordbc.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
468	mscordbc.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
468	mscordbc.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
468	mscordbc.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
468	mscordbc.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
468	mscordbc.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
468	mscordbc.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
468	mscordbc.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
468	mscordbc.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
468	mscordbc.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
468	mscordbc.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
468	mscordbc.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
468	mscordbc.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
468	mscordbc.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
468	mscordbc.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
468	mscordbc.exe
392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
Token: 1	2620	AppLaunch.exe
Token: SeCreateTokenPrivilege	2620	AppLaunch.exe
Token: SeAssignPrimaryTokenPrivilege	2620	AppLaunch.exe
Token: SeLockMemoryPrivilege	2620	AppLaunch.exe
Token: SeIncreaseQuotaPrivilege	2620	AppLaunch.exe
Token: SeMachineAccountPrivilege	2620	AppLaunch.exe
Token: SeTcbPrivilege	2620	AppLaunch.exe
Token: SeSecurityPrivilege	2620	AppLaunch.exe
Token: SeTakeOwnershipPrivilege	2620	AppLaunch.exe
Token: SeLoadDriverPrivilege	2620	AppLaunch.exe
Token: SeSystemProfilePrivilege	2620	AppLaunch.exe
Token: SeSystemtimePrivilege	2620	AppLaunch.exe
Token: SeProfSingleProcessPrivilege	2620	AppLaunch.exe
Token: SeIncBasePriorityPrivilege	2620	AppLaunch.exe
Token: SeCreatePagefilePrivilege	2620	AppLaunch.exe
Token: SeCreatePermanentPrivilege	2620	AppLaunch.exe
Token: SeBackupPrivilege	2620	AppLaunch.exe
Token: SeRestorePrivilege	2620	AppLaunch.exe
Token: SeShutdownPrivilege	2620	AppLaunch.exe
Token: SeDebugPrivilege	2620	AppLaunch.exe
Token: SeAuditPrivilege	2620	AppLaunch.exe
Token: SeSystemEnvironmentPrivilege	2620	AppLaunch.exe
Token: SeChangeNotifyPrivilege	2620	AppLaunch.exe
Token: SeRemoteShutdownPrivilege	2620	AppLaunch.exe
Token: SeUndockPrivilege	2620	AppLaunch.exe
Token: SeSyncAgentPrivilege	2620	AppLaunch.exe
Token: SeEnableDelegationPrivilege	2620	AppLaunch.exe
Token: SeManageVolumePrivilege	2620	AppLaunch.exe
Token: SeImpersonatePrivilege	2620	AppLaunch.exe
Token: SeCreateGlobalPrivilege	2620	AppLaunch.exe
Token: 31	2620	AppLaunch.exe
Token: 32	2620	AppLaunch.exe
Token: 33	2620	AppLaunch.exe
Token: 34	2620	AppLaunch.exe
Token: 35	2620	AppLaunch.exe
Token: SeDebugPrivilege	4716	sysglobl.exe
Token: SeDebugPrivilege	468	mscordbc.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2620	AppLaunch.exe
2620	AppLaunch.exe
2620	AppLaunch.exe
4776	AppLaunch.exe
4776	AppLaunch.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 2620	392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe	87
PID 392 wrote to memory of 2620	392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe	87
PID 392 wrote to memory of 2620	392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe	87
PID 392 wrote to memory of 2620	392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe	87
PID 392 wrote to memory of 2620	392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe	87
PID 392 wrote to memory of 2620	392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe	87
PID 392 wrote to memory of 2620	392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe	87
PID 392 wrote to memory of 2620	392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe	87
PID 2620 wrote to memory of 2928	2620	AppLaunch.exe	88
PID 2620 wrote to memory of 2928	2620	AppLaunch.exe	88
PID 2620 wrote to memory of 2928	2620	AppLaunch.exe	88
PID 2620 wrote to memory of 4568	2620	AppLaunch.exe	89
PID 2620 wrote to memory of 4568	2620	AppLaunch.exe	89
PID 2620 wrote to memory of 4568	2620	AppLaunch.exe	89
PID 2620 wrote to memory of 2944	2620	AppLaunch.exe	90
PID 2620 wrote to memory of 2944	2620	AppLaunch.exe	90
PID 2620 wrote to memory of 2944	2620	AppLaunch.exe	90
PID 2620 wrote to memory of 2572	2620	AppLaunch.exe	91
PID 2620 wrote to memory of 2572	2620	AppLaunch.exe	91
PID 2620 wrote to memory of 2572	2620	AppLaunch.exe	91
PID 2944 wrote to memory of 1952	2944	cmd.exe	96
PID 2944 wrote to memory of 1952	2944	cmd.exe	96
PID 2944 wrote to memory of 1952	2944	cmd.exe	96
PID 4568 wrote to memory of 4836	4568	cmd.exe	97
PID 4568 wrote to memory of 4836	4568	cmd.exe	97
PID 4568 wrote to memory of 4836	4568	cmd.exe	97
PID 2928 wrote to memory of 4372	2928	cmd.exe	98
PID 2928 wrote to memory of 4372	2928	cmd.exe	98
PID 2928 wrote to memory of 4372	2928	cmd.exe	98
PID 2572 wrote to memory of 1296	2572	cmd.exe	99
PID 2572 wrote to memory of 1296	2572	cmd.exe	99
PID 2572 wrote to memory of 1296	2572	cmd.exe	99
PID 392 wrote to memory of 4716	392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe	102
PID 392 wrote to memory of 4716	392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe	102
PID 392 wrote to memory of 4716	392	JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe	102
PID 4716 wrote to memory of 468	4716	sysglobl.exe	103
PID 4716 wrote to memory of 468	4716	sysglobl.exe	103
PID 4716 wrote to memory of 468	4716	sysglobl.exe	103
PID 468 wrote to memory of 4776	468	mscordbc.exe	104
PID 468 wrote to memory of 4776	468	mscordbc.exe	104
PID 468 wrote to memory of 4776	468	mscordbc.exe	104
PID 468 wrote to memory of 4776	468	mscordbc.exe	104
PID 468 wrote to memory of 4776	468	mscordbc.exe	104
PID 468 wrote to memory of 4776	468	mscordbc.exe	104
PID 468 wrote to memory of 4776	468	mscordbc.exe	104
PID 468 wrote to memory of 4776	468	mscordbc.exe	104

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e5931f3edadb44983ba778efb59d16a9.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4372
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4836
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1952
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\WINdefender\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WINdefender\svchost.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\WINdefender\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WINdefender\svchost.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1296
- C:\Users\Admin\AppData\Local\Temp\sysglobl.exe
  "C:\Users\Admin\AppData\Local\Temp\sysglobl.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Users\Admin\AppData\Local\Temp\mscordbc.exe
    "C:\Users\Admin\AppData\Local\Temp\mscordbc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:468
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4776

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUU5Q0Q1OUUtN0NFQi00RUU2LUFCMTgtNUYyQzhEMUI5RUYxfSIgdXNlcmlkPSJ7RUY0ODk1NDMtODMxNy00MTEyLThGNDktNjI0NTZGQ0YyNjBGfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RDc3MkQ5REMtQkRCRC00OUIyLTk4M0EtMUU2MDY1MTczOUYzfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDQ5MjgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxNzQzMjM4OTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTEyMDE4OTAzIi8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mscordbc.exe

Path C:\Users\Admin\AppData\Local\Temp\mscordbc.exe
Size 487KB
SHA256 269fe1396c7ff18f950672c66093b32796f5445cc986a2237b9b8f87dc6afc7a
MD5 e5931f3edadb44983ba778efb59d16a9
SHA1 1e29390a28bd647bc11060d804a98f6527c3493e
SHA512 f7ce1424e921f2213c9478a60b7b45afea873a04ba917f60a3de714f54341cce43f2214cb73edd89244b458b2a52385beaac5ed5b3d3e721f6e3a9c9eb850950
SSDEEP 12288:FIcjLmMlrDLN6YUsViowOx8+AxrEZNs0xDakISnTzFqhE:2krhio/hAx47xDakISohE
MD5 SHA1 SHA512 SSDEEP

Submit Download

sysglobl.exe

Path C:\Users\Admin\AppData\Local\Temp\sysglobl.exe
Size 9KB
SHA256 0dad1a5c922fb81f4b4c1838330b6b33122d3cd8d4cd76b9770137b32e3e17fe
MD5 b3bfc1012e5c3e37e879096b8be8c930
SHA1 54b4cbb9fe8ae21517dd7cb80c1d15a661eeaaa0
SHA512 9d46861485ab0f03752b9e973977f2c7f94465c186336536b270b5ff305389fff0a87f98f47d486bdb192ff3c32e40eb475e6bfbb707e133ce64d1f05387422e
SSDEEP 192:dj0AnepCt0XcfaERkmkVd3fzJ05xaYHhC2D27NgYAyW6dYzWe:d4eeu0sfaEPG3fzJ05xC2DbYXW6WzW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/392-0-0x00000000748C2000-0x00000000748C3000-memory.dmp

Download

memory/392-1-0x00000000748C0000-0x0000000074E71000-memory.dmp

Download

memory/392-2-0x00000000748C0000-0x0000000074E71000-memory.dmp

Download

memory/392-31-0x00000000748C2000-0x00000000748C3000-memory.dmp

Download

memory/392-32-0x00000000748C0000-0x0000000074E71000-memory.dmp

Download

memory/392-33-0x00000000748C0000-0x0000000074E71000-memory.dmp

Download

memory/2620-7-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2620-9-0x0000000000400000-0x0000000000470000-memory.dmp

Download