Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20250211-en -
resource tags
arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system -
submitted
12/02/2025, 16:20
Behavioral task
behavioral1
Sample
315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe
Resource
win10v2004-20250211-en
General
-
Target
315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe
-
Size
405KB
-
MD5
e6d662693685c5bfcf88a842d2853cdc
-
SHA1
817f5bb381616bf4279ccbffe884d1e8d87e078a
-
SHA256
315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546
-
SHA512
56720bfa6ea50b38cf53ee27ba43ec868931adf54dc5c069b3a1d0d8055d032844b3dbab5f1d41d223ca821d6f5985a9ae859be97dd58df6bd8a67eacb960a98
-
SSDEEP
6144:foYn9sE89XKTK/J6brj3nmHWrt63P5A9GJ6vbmF4ifKyjlKI4r3mzzrLVIo8ZJr+:ZsNDBIrCHWux6iFTJf4r2zPBv8Xi8xS1
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 11 IoCs
resource yara_rule behavioral2/memory/1344-61-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/1344-71-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/1344-75-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/1344-78-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/1344-80-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/1344-83-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/1344-86-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/1344-88-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/1344-90-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/1344-93-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral2/memory/1344-95-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\javaruntime.exe = "C:\\Windows\\javaruntime.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\winprocess.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winprocess.exe:*:Enabled:Windows Messanger" reg.exe -
Downloads MZ/PE file 1 IoCs
flow pid Process 39 1664 Process not Found -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000\Control Panel\International\Geo\Nation 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe -
Executes dropped EXE 3 IoCs
pid Process 2280 javaruntime.exe 4940 javaruntime.exe 1344 javaruntime.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3296967594-3563063956-581523229-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\javaruntime = "C:\\Windows\\javaruntime.exe" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 4312 set thread context of 4468 4312 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 92 PID 4312 set thread context of 2260 4312 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 96 PID 2280 set thread context of 3516 2280 javaruntime.exe 102 PID 2280 set thread context of 4940 2280 javaruntime.exe 105 PID 2280 set thread context of 1344 2280 javaruntime.exe 106 -
resource yara_rule behavioral2/memory/4312-0-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral2/memory/2260-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4312-12-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral2/memory/2260-13-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4312-16-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral2/memory/2260-15-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0009000000023dc5-32.dat upx behavioral2/memory/2280-43-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral2/memory/2280-42-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral2/memory/2260-45-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2280-46-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral2/memory/1344-54-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/1344-61-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/2260-69-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2280-60-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral2/memory/1344-59-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/4940-70-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/1344-71-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/1344-75-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/1344-78-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/1344-80-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/1344-83-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/1344-86-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/1344-88-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/1344-90-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/1344-93-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral2/memory/1344-95-0x0000000000400000-0x000000000047B000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\javaruntime.exe 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe File opened for modification C:\Windows\javaruntime.exe 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 4504 4468 WerFault.exe 92 4736 3516 WerFault.exe 102 -
System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaruntime.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaruntime.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaruntime.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5052 MicrosoftEdgeUpdate.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2672 reg.exe 2824 reg.exe 4036 reg.exe 980 reg.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 1 1344 javaruntime.exe Token: SeCreateTokenPrivilege 1344 javaruntime.exe Token: SeAssignPrimaryTokenPrivilege 1344 javaruntime.exe Token: SeLockMemoryPrivilege 1344 javaruntime.exe Token: SeIncreaseQuotaPrivilege 1344 javaruntime.exe Token: SeMachineAccountPrivilege 1344 javaruntime.exe Token: SeTcbPrivilege 1344 javaruntime.exe Token: SeSecurityPrivilege 1344 javaruntime.exe Token: SeTakeOwnershipPrivilege 1344 javaruntime.exe Token: SeLoadDriverPrivilege 1344 javaruntime.exe Token: SeSystemProfilePrivilege 1344 javaruntime.exe Token: SeSystemtimePrivilege 1344 javaruntime.exe Token: SeProfSingleProcessPrivilege 1344 javaruntime.exe Token: SeIncBasePriorityPrivilege 1344 javaruntime.exe Token: SeCreatePagefilePrivilege 1344 javaruntime.exe Token: SeCreatePermanentPrivilege 1344 javaruntime.exe Token: SeBackupPrivilege 1344 javaruntime.exe Token: SeRestorePrivilege 1344 javaruntime.exe Token: SeShutdownPrivilege 1344 javaruntime.exe Token: SeDebugPrivilege 1344 javaruntime.exe Token: SeAuditPrivilege 1344 javaruntime.exe Token: SeSystemEnvironmentPrivilege 1344 javaruntime.exe Token: SeChangeNotifyPrivilege 1344 javaruntime.exe Token: SeRemoteShutdownPrivilege 1344 javaruntime.exe Token: SeUndockPrivilege 1344 javaruntime.exe Token: SeSyncAgentPrivilege 1344 javaruntime.exe Token: SeEnableDelegationPrivilege 1344 javaruntime.exe Token: SeManageVolumePrivilege 1344 javaruntime.exe Token: SeImpersonatePrivilege 1344 javaruntime.exe Token: SeCreateGlobalPrivilege 1344 javaruntime.exe Token: 31 1344 javaruntime.exe Token: 32 1344 javaruntime.exe Token: 33 1344 javaruntime.exe Token: 34 1344 javaruntime.exe Token: 35 1344 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe Token: SeDebugPrivilege 4940 javaruntime.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 4312 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 2260 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 2280 javaruntime.exe 2280 javaruntime.exe 4940 javaruntime.exe 1344 javaruntime.exe 1344 javaruntime.exe 1344 javaruntime.exe 1344 javaruntime.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4312 wrote to memory of 4468 4312 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 92 PID 4312 wrote to memory of 4468 4312 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 92 PID 4312 wrote to memory of 4468 4312 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 92 PID 4312 wrote to memory of 4468 4312 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 92 PID 4312 wrote to memory of 2260 4312 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 96 PID 4312 wrote to memory of 2260 4312 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 96 PID 4312 wrote to memory of 2260 4312 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 96 PID 4312 wrote to memory of 2260 4312 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 96 PID 4312 wrote to memory of 2260 4312 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 96 PID 4312 wrote to memory of 2260 4312 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 96 PID 4312 wrote to memory of 2260 4312 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 96 PID 4312 wrote to memory of 2260 4312 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 96 PID 2260 wrote to memory of 3316 2260 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 97 PID 2260 wrote to memory of 3316 2260 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 97 PID 2260 wrote to memory of 3316 2260 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 97 PID 3316 wrote to memory of 2992 3316 cmd.exe 100 PID 3316 wrote to memory of 2992 3316 cmd.exe 100 PID 3316 wrote to memory of 2992 3316 cmd.exe 100 PID 2260 wrote to memory of 2280 2260 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 101 PID 2260 wrote to memory of 2280 2260 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 101 PID 2260 wrote to memory of 2280 2260 315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe 101 PID 2280 wrote to memory of 3516 2280 javaruntime.exe 102 PID 2280 wrote to memory of 3516 2280 javaruntime.exe 102 PID 2280 wrote to memory of 3516 2280 javaruntime.exe 102 PID 2280 wrote to memory of 3516 2280 javaruntime.exe 102 PID 2280 wrote to memory of 4940 2280 javaruntime.exe 105 PID 2280 wrote to memory of 4940 2280 javaruntime.exe 105 PID 2280 wrote to memory of 4940 2280 javaruntime.exe 105 PID 2280 wrote to memory of 4940 2280 javaruntime.exe 105 PID 2280 wrote to memory of 4940 2280 javaruntime.exe 105 PID 2280 wrote to memory of 4940 2280 javaruntime.exe 105 PID 2280 wrote to memory of 4940 2280 javaruntime.exe 105 PID 2280 wrote to memory of 4940 2280 javaruntime.exe 105 PID 2280 wrote to memory of 1344 2280 javaruntime.exe 106 PID 2280 wrote to memory of 1344 2280 javaruntime.exe 106 PID 2280 wrote to memory of 1344 2280 javaruntime.exe 106 PID 2280 wrote to memory of 1344 2280 javaruntime.exe 106 PID 2280 wrote to memory of 1344 2280 javaruntime.exe 106 PID 2280 wrote to memory of 1344 2280 javaruntime.exe 106 PID 2280 wrote to memory of 1344 2280 javaruntime.exe 106 PID 2280 wrote to memory of 1344 2280 javaruntime.exe 106 PID 1344 wrote to memory of 2880 1344 javaruntime.exe 107 PID 1344 wrote to memory of 2880 1344 javaruntime.exe 107 PID 1344 wrote to memory of 2880 1344 javaruntime.exe 107 PID 1344 wrote to memory of 2792 1344 javaruntime.exe 108 PID 1344 wrote to memory of 2792 1344 javaruntime.exe 108 PID 1344 wrote to memory of 2792 1344 javaruntime.exe 108 PID 1344 wrote to memory of 4368 1344 javaruntime.exe 109 PID 1344 wrote to memory of 4368 1344 javaruntime.exe 109 PID 1344 wrote to memory of 4368 1344 javaruntime.exe 109 PID 1344 wrote to memory of 4980 1344 javaruntime.exe 110 PID 1344 wrote to memory of 4980 1344 javaruntime.exe 110 PID 1344 wrote to memory of 4980 1344 javaruntime.exe 110 PID 2792 wrote to memory of 2672 2792 cmd.exe 115 PID 2792 wrote to memory of 2672 2792 cmd.exe 115 PID 2792 wrote to memory of 2672 2792 cmd.exe 115 PID 4368 wrote to memory of 980 4368 cmd.exe 116 PID 4368 wrote to memory of 980 4368 cmd.exe 116 PID 4368 wrote to memory of 980 4368 cmd.exe 116 PID 2880 wrote to memory of 4036 2880 cmd.exe 117 PID 2880 wrote to memory of 4036 2880 cmd.exe 117 PID 2880 wrote to memory of 4036 2880 cmd.exe 117 PID 4980 wrote to memory of 2824 4980 cmd.exe 118 PID 4980 wrote to memory of 2824 4980 cmd.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe"C:\Users\Admin\AppData\Local\Temp\315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵PID:4468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 843⤵
- Program crash
PID:4504
-
-
-
C:\Users\Admin\AppData\Local\Temp\315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe"C:\Users\Admin\AppData\Local\Temp\315daba2353427a690f4c5eab69011c4e8fe4697da2f15bfb3e4dbe4feac2546.exe"2⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WOVKU.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaruntime" /t REG_SZ /d "C:\Windows\javaruntime.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2992
-
-
-
C:\Windows\javaruntime.exe"C:\Windows\javaruntime.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵PID:3516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 845⤵
- Program crash
PID:4736
-
-
-
C:\Windows\javaruntime.exe"C:\Windows\javaruntime.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4940
-
-
C:\Windows\javaruntime.exe"C:\Windows\javaruntime.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4036
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f6⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2672
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:980
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f6⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2824
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4468 -ip 44681⤵PID:1384
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3516 -ip 35161⤵PID:1496
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTE0MkU1QUEtNTYxRi00MTFCLUE5M0QtRTQ1NjAzMDkyRjMyfSIgdXNlcmlkPSJ7Q0I4NjBFNTItNUVCRi00MjBELUI3OTQtQzU1OEJBRjA4MTY3fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NjJBNzg4NkEtN0QxNi00RDI3LThERDctOTMyMTBCNDlDRkY2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODIxNjkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1MzE4NTEwMTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NDgzNjM3Njg2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:5052
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124B
MD5163f8e838efe1d166ffff7408b814e28
SHA152fa0ccba649587e7d24d21d182657078fa6d028
SHA256dc60287c419225759aa9e1ea0423be4106337dad71aaa0cdc9d55d2b1af3edb7
SHA512b6685390029555f7d812f0d1a9f138c619555712add3e79c1c90a1a5a0c544e4a86768a626d25c6af3cec09afc0bbaf7f398114e849831bdc5666fc443a1f68d
-
Filesize
405KB
MD54a4aaca19c6f06050690a164c75a686b
SHA17fff00e52dfb0393365698af1447dc0b422f38bc
SHA25695423fb14fbdf7fe0bb0b9676af2437cca933c016a74bf52fe7b40a763ab7664
SHA512830b0fd84998b1818203fba1096178b377ac9761312d1844d5e31f9feb619d44891e01966d6780ae69851f28b557bc4843edd20db3930a72485411b1eece64e5