Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250207-en -
resource tags
arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2025, 14:10
Behavioral task
behavioral1
Sample
f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe
Resource
win10v2004-20250207-en
General
-
Target
f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe
-
Size
285KB
-
MD5
ec608ffb2252fc0f7a78e73af50e81d9
-
SHA1
b04c346c680966e55a71626e06aad2917d67afad
-
SHA256
f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6
-
SHA512
276e02ef0eb90fba2afb31db63d8c040bab3dc14aa9f2ae8c7eaf1465c5fd31e867de3879318b7c2339b1596277916c283b9928009f719e43faeacbf2f577223
-
SSDEEP
6144:+ZyKE4FBg+XHnZYkQGmzRrOEg0q/vjLm1AHkUm1Ys8xiV4DvtsJRlVDqa8GzNHLB:NBaBnmtOwq/+1MkU68raJRHua8G9Lcoz
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 11 IoCs
resource yara_rule behavioral2/memory/4168-36-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/4168-53-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/4168-55-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/4168-57-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/4168-60-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/4168-63-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/4168-65-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/4168-68-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/4168-72-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/4168-75-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/4168-86-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
Downloads MZ/PE file 1 IoCs
flow pid Process 55 3980 Process not Found -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\Control Panel\International\Geo\Nation f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe -
Executes dropped EXE 3 IoCs
pid Process 3264 jusched.exe 4168 jusched.exe 4204 jusched.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Machine = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3264 set thread context of 4168 3264 jusched.exe 94 PID 3264 set thread context of 4204 3264 jusched.exe 95 -
resource yara_rule behavioral2/memory/548-0-0x0000000000400000-0x00000000005A8000-memory.dmp upx behavioral2/files/0x000a000000023d28-16.dat upx behavioral2/memory/548-28-0x0000000000400000-0x00000000005A8000-memory.dmp upx behavioral2/memory/4168-31-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4168-34-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4168-36-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4204-41-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4204-45-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4204-37-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3264-50-0x0000000000400000-0x00000000005A8000-memory.dmp upx behavioral2/memory/4168-53-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4204-54-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4168-55-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4168-57-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4168-60-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4168-63-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4168-65-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4168-68-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4168-72-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4168-75-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/4168-86-0x0000000000400000-0x000000000045C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3588 MicrosoftEdgeUpdate.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 4128 reg.exe 4428 reg.exe 1920 reg.exe 756 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 4204 jusched.exe Token: 1 4168 jusched.exe Token: SeCreateTokenPrivilege 4168 jusched.exe Token: SeAssignPrimaryTokenPrivilege 4168 jusched.exe Token: SeLockMemoryPrivilege 4168 jusched.exe Token: SeIncreaseQuotaPrivilege 4168 jusched.exe Token: SeMachineAccountPrivilege 4168 jusched.exe Token: SeTcbPrivilege 4168 jusched.exe Token: SeSecurityPrivilege 4168 jusched.exe Token: SeTakeOwnershipPrivilege 4168 jusched.exe Token: SeLoadDriverPrivilege 4168 jusched.exe Token: SeSystemProfilePrivilege 4168 jusched.exe Token: SeSystemtimePrivilege 4168 jusched.exe Token: SeProfSingleProcessPrivilege 4168 jusched.exe Token: SeIncBasePriorityPrivilege 4168 jusched.exe Token: SeCreatePagefilePrivilege 4168 jusched.exe Token: SeCreatePermanentPrivilege 4168 jusched.exe Token: SeBackupPrivilege 4168 jusched.exe Token: SeRestorePrivilege 4168 jusched.exe Token: SeShutdownPrivilege 4168 jusched.exe Token: SeDebugPrivilege 4168 jusched.exe Token: SeAuditPrivilege 4168 jusched.exe Token: SeSystemEnvironmentPrivilege 4168 jusched.exe Token: SeChangeNotifyPrivilege 4168 jusched.exe Token: SeRemoteShutdownPrivilege 4168 jusched.exe Token: SeUndockPrivilege 4168 jusched.exe Token: SeSyncAgentPrivilege 4168 jusched.exe Token: SeEnableDelegationPrivilege 4168 jusched.exe Token: SeManageVolumePrivilege 4168 jusched.exe Token: SeImpersonatePrivilege 4168 jusched.exe Token: SeCreateGlobalPrivilege 4168 jusched.exe Token: 31 4168 jusched.exe Token: 32 4168 jusched.exe Token: 33 4168 jusched.exe Token: 34 4168 jusched.exe Token: 35 4168 jusched.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 548 f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe 3264 jusched.exe 4168 jusched.exe 4168 jusched.exe 4204 jusched.exe 4168 jusched.exe -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 548 wrote to memory of 4308 548 f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe 89 PID 548 wrote to memory of 4308 548 f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe 89 PID 548 wrote to memory of 4308 548 f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe 89 PID 4308 wrote to memory of 1956 4308 cmd.exe 92 PID 4308 wrote to memory of 1956 4308 cmd.exe 92 PID 4308 wrote to memory of 1956 4308 cmd.exe 92 PID 548 wrote to memory of 3264 548 f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe 93 PID 548 wrote to memory of 3264 548 f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe 93 PID 548 wrote to memory of 3264 548 f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe 93 PID 3264 wrote to memory of 4168 3264 jusched.exe 94 PID 3264 wrote to memory of 4168 3264 jusched.exe 94 PID 3264 wrote to memory of 4168 3264 jusched.exe 94 PID 3264 wrote to memory of 4168 3264 jusched.exe 94 PID 3264 wrote to memory of 4168 3264 jusched.exe 94 PID 3264 wrote to memory of 4168 3264 jusched.exe 94 PID 3264 wrote to memory of 4168 3264 jusched.exe 94 PID 3264 wrote to memory of 4168 3264 jusched.exe 94 PID 3264 wrote to memory of 4204 3264 jusched.exe 95 PID 3264 wrote to memory of 4204 3264 jusched.exe 95 PID 3264 wrote to memory of 4204 3264 jusched.exe 95 PID 3264 wrote to memory of 4204 3264 jusched.exe 95 PID 3264 wrote to memory of 4204 3264 jusched.exe 95 PID 3264 wrote to memory of 4204 3264 jusched.exe 95 PID 3264 wrote to memory of 4204 3264 jusched.exe 95 PID 3264 wrote to memory of 4204 3264 jusched.exe 95 PID 4168 wrote to memory of 5108 4168 jusched.exe 96 PID 4168 wrote to memory of 5108 4168 jusched.exe 96 PID 4168 wrote to memory of 5108 4168 jusched.exe 96 PID 4168 wrote to memory of 3724 4168 jusched.exe 97 PID 4168 wrote to memory of 3724 4168 jusched.exe 97 PID 4168 wrote to memory of 3724 4168 jusched.exe 97 PID 4168 wrote to memory of 1020 4168 jusched.exe 99 PID 4168 wrote to memory of 1020 4168 jusched.exe 99 PID 4168 wrote to memory of 1020 4168 jusched.exe 99 PID 4168 wrote to memory of 3924 4168 jusched.exe 100 PID 4168 wrote to memory of 3924 4168 jusched.exe 100 PID 4168 wrote to memory of 3924 4168 jusched.exe 100 PID 3724 wrote to memory of 4128 3724 cmd.exe 104 PID 3724 wrote to memory of 4128 3724 cmd.exe 104 PID 3724 wrote to memory of 4128 3724 cmd.exe 104 PID 3924 wrote to memory of 4428 3924 cmd.exe 105 PID 3924 wrote to memory of 4428 3924 cmd.exe 105 PID 3924 wrote to memory of 4428 3924 cmd.exe 105 PID 1020 wrote to memory of 1920 1020 cmd.exe 106 PID 1020 wrote to memory of 1920 1020 cmd.exe 106 PID 1020 wrote to memory of 1920 1020 cmd.exe 106 PID 5108 wrote to memory of 756 5108 cmd.exe 107 PID 5108 wrote to memory of 756 5108 cmd.exe 107 PID 5108 wrote to memory of 756 5108 cmd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe"C:\Users\Admin\AppData\Local\Temp\f9d92d3e6bcaf8231addfff681a847f20d93314d3af8edfcadb283e32becf9c6.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KhZEp.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java Machine" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1956
-
-
-
C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe"C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exeC:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:756
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4128
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1920
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4428
-
-
-
-
C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exeC:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4204
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RjUxQTA4RkUtNEE2Qi00OTEwLThDMDQtNDZGMTA5QTdGRTNGfSIgdXNlcmlkPSJ7Mzk5MkQwNjctNDAzNC00MjM1LThBNjQtQ0VDOEZCQ0E0Qzg1fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RDJFNUQyRjYtOEJGOS00RjI1LUFENjItRDgzMkRGQjMwODA2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI2IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY4ODkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTM2NTgwOTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTUwMTM0MzA0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3588
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
149B
MD5976ffa9a304b234c039c8739d97bb893
SHA1f70f7ede8b6e5d1b8a9b53c9bf43882485b55bd6
SHA2562b77cf051bb584aada8b9e5e07cba06e2077b42f009c33d10e31994ceec10384
SHA5121bd398b968736efbab740c81776781023a4ef0dc1c0191d6393a7582bd79b452666163691d82a27ee8989a1e293e6d6df57c303aa9b34497ae52be417f9e269c
-
Filesize
285KB
MD59902de157edfe7a63f59b7876184d0f2
SHA1ed0b60d74502bcb7b2b538d5b0723abcbf8d30d5
SHA25625c86f9d7b0840aca29572cfaa5f93eb1195d5965fe788a7e43d38eed5f9bbad
SHA51295ed1586975cdd3ce870e7c89b28848b6716a483cfca3d3ac3a1600d60dce34f9922a47dba1ba3fafe90284a56eec5b9202c5659cf1db3eb08532b6114bcc361