Malware Analysis Report

2025-04-03 10:13

Sample ID 250212-nrq61szjhp
Target JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861
SHA256 41e156c3eba9e2e9963e10180f40a2fbe44dd078c853254563a824c2c2ff979f
Tags
blackshades defense_evasion discovery persistence rat upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

41e156c3eba9e2e9963e10180f40a2fbe44dd078c853254563a824c2c2ff979f

Threat Level: Known bad

The file JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861 was found to be: Known bad.

Malicious Activity Summary

blackshades defense_evasion discovery persistence rat upx

Blackshades

Blackshades payload

Blackshades family

Modifies firewall policy service

Downloads MZ/PE file

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

UPX packed file

Suspicious use of SetThreadContext

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

System Network Configuration Discovery: Internet Connection Discovery

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Modifies registry key

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-12 11:38

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-12 11:38

Reported

2025-02-12 11:40

Platform

win7-20240903-en

Max time kernel

150s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\dofus1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dofus1.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lsasrv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\msadrh10.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\lsasrv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
Token: 1 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 31 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 32 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\lsasrv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2420 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2420 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2420 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2420 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2420 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2420 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2420 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2420 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2420 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2420 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2420 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 2720 wrote to memory of 2760 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2760 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2760 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2760 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2760 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2760 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2760 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2740 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2740 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2740 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2740 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2740 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2740 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2740 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2776 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2776 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2776 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2776 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2776 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2776 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2776 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2440 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2440 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2440 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2440 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2440 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2440 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2440 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 2420 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe
PID 2420 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe
PID 2420 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe
PID 2420 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe
PID 2440 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2440 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2440 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2440 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2440 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2440 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2440 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2740 wrote to memory of 2224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2740 wrote to memory of 2224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2740 wrote to memory of 2224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2740 wrote to memory of 2224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2740 wrote to memory of 2224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2740 wrote to memory of 2224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2740 wrote to memory of 2224 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2776 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2776 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2776 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2776 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2776 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2776 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2776 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\dofus1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\dofus1.exe:*:Enabled:Windows Messanger" /f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\dofus1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\dofus1.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Users\Admin\AppData\Local\Temp\lsasrv.exe

"C:\Users\Admin\AppData\Local\Temp\lsasrv.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 poiree554.no-ip.biz udp
FR 78.159.135.230:3333 poiree554.no-ip.biz tcp
FR 78.159.135.230:3333 poiree554.no-ip.biz tcp
US 8.8.8.8:53 1poiree554.no-ip.biz udp
ES 94.73.33.36:3333 1poiree554.no-ip.biz tcp
US 8.8.8.8:53 2poiree554.no-ip.biz udp
US 8.8.8.8:53 3poiree554.no-ip.biz udp
FR 78.159.135.230:3333 3poiree554.no-ip.biz tcp
US 8.8.8.8:53 4poiree554.no-ip.biz udp
ES 94.73.36.254:3333 4poiree554.no-ip.biz tcp
US 8.8.8.8:53 5poiree554.no-ip.biz udp
US 8.8.8.8:53 6poiree554.no-ip.biz udp

Files

memory/2420-0-0x0000000074E21000-0x0000000074E22000-memory.dmp

memory/2420-1-0x0000000074E20000-0x00000000753CB000-memory.dmp

memory/2420-6-0x0000000074E20000-0x00000000753CB000-memory.dmp

memory/2420-7-0x0000000074E20000-0x00000000753CB000-memory.dmp

memory/2720-15-0x0000000000400000-0x000000000047B000-memory.dmp

memory/2720-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2720-11-0x0000000000400000-0x000000000047B000-memory.dmp

memory/2720-10-0x0000000000400000-0x000000000047B000-memory.dmp

memory/2720-8-0x0000000000400000-0x000000000047B000-memory.dmp

memory/2720-17-0x0000000000400000-0x000000000047B000-memory.dmp

memory/2720-21-0x0000000000400000-0x000000000047B000-memory.dmp

memory/2720-20-0x0000000000400000-0x000000000047B000-memory.dmp

memory/2720-19-0x0000000000400000-0x000000000047B000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe

MD5 a289f9e85e5f59fe882766cc239b50f2
SHA1 8ebf0bf6dfc02166409a300c15b9ebae97a47fd3
SHA256 f02603a39bbe9323efe0b71b616d760011d0f64dc4ee02a1a80f46ba5c2c5bb4
SHA512 bddb139e9f1632c62c5d0621404d07202bca6cb3a16a495bca71e9d4e531d3d835c2186bd19ac97ff2640c7fbbe2494ba4d18ac7d73e3b0b7549e48074eb8b2d

C:\Users\Admin\AppData\Local\Temp\lsasrv.exe

MD5 effb5008476ec1632fe9ec17cb2e0861
SHA1 ac7f379ff94b8c4dcd7839fd81028ddf8a693fe3
SHA256 41e156c3eba9e2e9963e10180f40a2fbe44dd078c853254563a824c2c2ff979f
SHA512 a30093e6efeaa372eaae1875f7b3aabced78433a2d642053c7af04f1f6909242649b67279d086ea35628a9f996c4be4c7db325d569a6fdcaf1f418135fd8761d

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-12 11:38

Reported

2025-02-12 11:40

Platform

win10v2004-20250211-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\dofus1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dofus1.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Downloads MZ/PE file

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2508704002-2325818048-3575902788-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2508704002-2325818048-3575902788-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lsasrv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2508704002-2325818048-3575902788-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\msadrh10.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\lsasrv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe N/A
Token: 1 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 31 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 32 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 33 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 34 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: 35 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\lsasrv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3024 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3024 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3024 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3024 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3024 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3024 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3024 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3024 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3408 wrote to memory of 452 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 3408 wrote to memory of 452 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 3408 wrote to memory of 452 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 3408 wrote to memory of 4852 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 3408 wrote to memory of 4852 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 3408 wrote to memory of 4852 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 3408 wrote to memory of 2072 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 3408 wrote to memory of 2072 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 3408 wrote to memory of 2072 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 3408 wrote to memory of 3612 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 3408 wrote to memory of 3612 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 3408 wrote to memory of 3612 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe C:\Windows\SysWOW64\cmd.exe
PID 4852 wrote to memory of 5100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4852 wrote to memory of 5100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4852 wrote to memory of 5100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 452 wrote to memory of 4784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 452 wrote to memory of 4784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 452 wrote to memory of 4784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3612 wrote to memory of 4856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3612 wrote to memory of 4856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3612 wrote to memory of 4856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2072 wrote to memory of 4464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2072 wrote to memory of 4464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2072 wrote to memory of 4464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3024 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe
PID 3024 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe
PID 2956 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe C:\Users\Admin\AppData\Local\Temp\lsasrv.exe
PID 2956 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe C:\Users\Admin\AppData\Local\Temp\lsasrv.exe
PID 2956 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe C:\Users\Admin\AppData\Local\Temp\lsasrv.exe
PID 3876 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\lsasrv.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3876 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\lsasrv.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3876 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\lsasrv.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3876 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\lsasrv.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3876 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\lsasrv.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3876 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\lsasrv.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3876 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\lsasrv.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
PID 3876 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\lsasrv.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_effb5008476ec1632fe9ec17cb2e0861.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MjAwQUI4NjItRjExRi00QzdDLUI3NTItNzVBQzgyN0M2RDA1fSIgdXNlcmlkPSJ7NThCOEIyMkQtRkI0NS00Njk3LTgwQ0YtNjlGOUVBRDAyNEE1fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MTJGRkNFMUItQUI3Qy00OUU2LUFFQTgtNjczNERDNzY1QTg5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODMyMzYiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NDI1MTE0ODAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NjE5NDU4MTAzIi8-PC9hcHA-PC9yZXF1ZXN0Pg

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\dofus1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\dofus1.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\dofus1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\dofus1.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe"

C:\Users\Admin\AppData\Local\Temp\lsasrv.exe

"C:\Users\Admin\AppData\Local\Temp\lsasrv.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 poiree554.no-ip.biz udp
FR 78.159.135.230:3333 poiree554.no-ip.biz tcp
US 8.8.8.8:53 msedge.api.cdp.microsoft.com udp
US 4.151.228.221:443 msedge.api.cdp.microsoft.com tcp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 199.232.210.172:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp
FR 78.159.135.230:3333 poiree554.no-ip.biz tcp
US 8.8.8.8:53 1poiree554.no-ip.biz udp
ES 94.73.33.36:3333 1poiree554.no-ip.biz tcp
US 150.171.27.10:443 g.bing.com tcp
US 150.171.27.10:443 g.bing.com tcp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 2poiree554.no-ip.biz udp
US 8.8.8.8:53 3poiree554.no-ip.biz udp
FR 78.159.135.230:3333 3poiree554.no-ip.biz tcp
US 8.8.8.8:53 4poiree554.no-ip.biz udp
ES 94.73.36.254:3333 4poiree554.no-ip.biz tcp
US 8.8.8.8:53 5poiree554.no-ip.biz udp
US 8.8.8.8:53 6poiree554.no-ip.biz udp

Files

memory/3024-0-0x0000000073FB2000-0x0000000073FB3000-memory.dmp

memory/3024-1-0x0000000073FB0000-0x0000000074561000-memory.dmp

memory/3024-2-0x0000000073FB0000-0x0000000074561000-memory.dmp

memory/3024-7-0x0000000073FB2000-0x0000000073FB3000-memory.dmp

memory/3024-8-0x0000000073FB0000-0x0000000074561000-memory.dmp

memory/3408-9-0x0000000000400000-0x000000000047B000-memory.dmp

memory/3408-11-0x0000000000400000-0x000000000047B000-memory.dmp

memory/3408-12-0x0000000000400000-0x000000000047B000-memory.dmp

memory/3408-13-0x0000000000400000-0x000000000047B000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe

MD5 a289f9e85e5f59fe882766cc239b50f2
SHA1 8ebf0bf6dfc02166409a300c15b9ebae97a47fd3
SHA256 f02603a39bbe9323efe0b71b616d760011d0f64dc4ee02a1a80f46ba5c2c5bb4
SHA512 bddb139e9f1632c62c5d0621404d07202bca6cb3a16a495bca71e9d4e531d3d835c2186bd19ac97ff2640c7fbbe2494ba4d18ac7d73e3b0b7549e48074eb8b2d

C:\Users\Admin\AppData\Local\Temp\lsasrv.exe

MD5 effb5008476ec1632fe9ec17cb2e0861
SHA1 ac7f379ff94b8c4dcd7839fd81028ddf8a693fe3
SHA256 41e156c3eba9e2e9963e10180f40a2fbe44dd078c853254563a824c2c2ff979f
SHA512 a30093e6efeaa372eaae1875f7b3aabced78433a2d642053c7af04f1f6909242649b67279d086ea35628a9f996c4be4c7db325d569a6fdcaf1f418135fd8761d