Malware Analysis Report

2025-04-03 10:12

Sample ID 250214-re517ayrhx
Target f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6
SHA256 f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6
Tags
blackshades defense_evasion discovery persistence rat upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6

Threat Level: Known bad

The file f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6 was found to be: Known bad.

Malicious Activity Summary

blackshades defense_evasion discovery persistence rat upx

Blackshades payload

Blackshades family

Blackshades

Modifies firewall policy service

Downloads MZ/PE file

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

UPX packed file

Enumerates physical storage devices

Unsigned PE

System Network Configuration Discovery: Internet Connection Discovery

System Location Discovery: System Language Discovery

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Modifies registry key

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-14 14:07

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-14 14:07

Reported

2025-02-14 14:09

Platform

win7-20250207-en

Max time kernel

149s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java Machine = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3004 set thread context of 2544 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3004 set thread context of 2884 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1704 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe C:\Windows\SysWOW64\cmd.exe
PID 1704 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe C:\Windows\SysWOW64\cmd.exe
PID 1704 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe C:\Windows\SysWOW64\cmd.exe
PID 1704 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe C:\Windows\SysWOW64\cmd.exe
PID 3036 wrote to memory of 2240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3036 wrote to memory of 2240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3036 wrote to memory of 2240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3036 wrote to memory of 2240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1704 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 1704 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 1704 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 1704 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3004 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3004 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3004 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3004 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3004 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3004 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3004 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3004 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3004 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3004 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3004 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3004 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3004 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3004 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3004 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3004 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3004 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3004 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2544 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2784 wrote to memory of 808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2784 wrote to memory of 808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2784 wrote to memory of 808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2784 wrote to memory of 808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2288 wrote to memory of 2908 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2288 wrote to memory of 2908 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2288 wrote to memory of 2908 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2288 wrote to memory of 2908 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2116 wrote to memory of 2236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2116 wrote to memory of 2236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2116 wrote to memory of 2236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2116 wrote to memory of 2236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1968 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1968 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1968 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1968 wrote to memory of 1980 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe

"C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\cqJZh.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java Machine" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /f

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

"C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe"

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 jingerred2.no-ip.biz udp

Files

memory/1704-0-0x0000000000400000-0x00000000005A8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\cqJZh.bat

MD5 976ffa9a304b234c039c8739d97bb893
SHA1 f70f7ede8b6e5d1b8a9b53c9bf43882485b55bd6
SHA256 2b77cf051bb584aada8b9e5e07cba06e2077b42f009c33d10e31994ceec10384
SHA512 1bd398b968736efbab740c81776781023a4ef0dc1c0191d6393a7582bd79b452666163691d82a27ee8989a1e293e6d6df57c303aa9b34497ae52be417f9e269c

\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

MD5 33367a589aacc8bb1818bfc678272374
SHA1 f55447ccf35e862a0b83ce5a0e85fabace795b50
SHA256 9320cc78bdcd26c0b04b4bcb9ee2ad0767e8e3a7ffe009d74c2942bbd760fc3e
SHA512 f212bf1df474ec8e39e76344fa2e71c84113b22ace31fa7059754dc8b99e444cf500765dfe06657cda09ff39c3c12c07ff1291c90fd0ac511b8c90c5cae85eae

memory/3004-44-0x0000000000400000-0x00000000005A8000-memory.dmp

memory/1704-42-0x0000000003100000-0x00000000032A8000-memory.dmp

memory/1704-46-0x0000000000400000-0x00000000005A8000-memory.dmp

memory/3004-51-0x0000000002A40000-0x0000000002BE8000-memory.dmp

memory/2884-70-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2544-55-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2544-69-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3004-64-0x0000000000400000-0x00000000005A8000-memory.dmp

memory/2884-62-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2884-61-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2884-58-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2544-52-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2544-57-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2544-74-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2884-75-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2544-78-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2544-81-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2544-83-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2544-85-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2544-87-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2544-92-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2544-97-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2544-101-0x0000000000400000-0x000000000045C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-14 14:07

Reported

2025-02-14 14:09

Platform

win10v2004-20250211-en

Max time kernel

149s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Downloads MZ/PE file

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1318997816-2171176372-1451785247-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1318997816-2171176372-1451785247-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Machine = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1896 set thread context of 3956 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 1896 set thread context of 4000 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 708 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe C:\Windows\SysWOW64\cmd.exe
PID 708 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe C:\Windows\SysWOW64\cmd.exe
PID 708 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe C:\Windows\SysWOW64\cmd.exe
PID 5088 wrote to memory of 1344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5088 wrote to memory of 1344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5088 wrote to memory of 1344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 708 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 708 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 708 wrote to memory of 1896 N/A C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 1896 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 1896 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 1896 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 1896 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 1896 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 1896 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 1896 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 1896 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 1896 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 1896 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 1896 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 1896 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 1896 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 1896 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 1896 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 1896 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3956 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3956 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3956 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3956 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3956 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3956 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3956 wrote to memory of 4228 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3956 wrote to memory of 4228 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3956 wrote to memory of 4228 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3956 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3956 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 3956 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 1140 wrote to memory of 376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1140 wrote to memory of 376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1140 wrote to memory of 376 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4068 wrote to memory of 3448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4068 wrote to memory of 3448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4068 wrote to memory of 3448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4760 wrote to memory of 3600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4760 wrote to memory of 3600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4760 wrote to memory of 3600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4228 wrote to memory of 464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4228 wrote to memory of 464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4228 wrote to memory of 464 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe

"C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xhZTS.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java Machine" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /f

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

"C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe"

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTYxMDk3MDItQUVGQi00NjE3LTk5QkQtRjQ4NDVEMDk1QUJFfSIgdXNlcmlkPSJ7QjhFRjVDMkUtN0E0OC00MjNDLUEyMEMtQkQ3OEQzMjVENjJBfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MjRDREE3QTAtNUU0Qi00RDM0LTg5RDItODUyREIwOThDMDg2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODMzNzEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NDE5Mjc1MzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzQwODM4NTY0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg

Network

Country Destination Domain Proto
GB 2.16.153.11:80 tcp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
GB 104.86.110.113:443 www.bing.com tcp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
GB 2.16.153.11:80 tcp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
FR 51.11.192.50:443 tcp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
US 8.8.8.8:53 msedge.api.cdp.microsoft.com udp
US 4.155.164.36:443 msedge.api.cdp.microsoft.com tcp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
GB 96.17.178.169:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
US 8.8.8.8:53 jingerred2.no-ip.biz udp

Files

memory/708-0-0x0000000000400000-0x00000000005A8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\xhZTS.txt

MD5 976ffa9a304b234c039c8739d97bb893
SHA1 f70f7ede8b6e5d1b8a9b53c9bf43882485b55bd6
SHA256 2b77cf051bb584aada8b9e5e07cba06e2077b42f009c33d10e31994ceec10384
SHA512 1bd398b968736efbab740c81776781023a4ef0dc1c0191d6393a7582bd79b452666163691d82a27ee8989a1e293e6d6df57c303aa9b34497ae52be417f9e269c

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.txt

MD5 590cc5b3a47ee4488ecca9681f071aee
SHA1 f98e50b7e9603f7408b459cd5f077165cbd2deed
SHA256 e170ba99c87c227efed746ba42bf715eb6ccc3709be71dbf571c3fca00f8e017
SHA512 eee8b4f2bca09f8bea05880b853c5966f706878d69ae9b79235e5e83f52b92ef8d90cf2a75933ee46515d420e291c27f45d5f1664eace95bd22c49f0f7199293

memory/708-31-0x0000000000400000-0x00000000005A8000-memory.dmp

memory/3956-35-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3956-37-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4000-38-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4000-43-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3956-32-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4000-44-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1896-49-0x0000000000400000-0x00000000005A8000-memory.dmp

memory/3956-53-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4000-54-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3956-55-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3956-57-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3956-60-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3956-62-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3956-64-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3956-67-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3956-70-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3956-72-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3956-77-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3956-79-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3956-81-0x0000000000400000-0x000000000045C000-memory.dmp

memory/3956-86-0x0000000000400000-0x000000000045C000-memory.dmp