blackshades | 3f862357f9455d73d39216c84deb9ae7bd817207740162da46e0f9038e85a0b1

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2025, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Size 1.0MB
Sample250220-d2qccsvras
SHA256 3f862357f9455d73d39216c84deb9ae7bd817207740162da46e0f9038e85a0b1
MD5 096175198ac3f9e677270a33e3d8737c
SHA1 93166592f857693cd52b94301e1d16b81d5e8bc5
SHA512 04ca5088e6881c050487471a4e30defd6b43b6631cd4d3fe77fb10581662089a8d08eb465ab244ce376428fccdc37019b0733c4ccaede537be3b11d238056e50
SSDEEP 24576:vFiJdLLOJWNWioq0EcU0B+M40zw0lYYYRGPMjkq/m2hJcax2EOZYgUjWN9xZ:vF0d/MWNWioqbcUM+M4iwGYYYEmkq/mD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackshades defense_evasion discovery persistence rat upx

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 2 IoCs

resource	yara_rule
behavioral2/memory/2364-0-0x0000000000400000-0x000000000046B000-memory.dmp	family_blackshades
behavioral2/memory/2364-269-0x0000000000400000-0x000000000046B000-memory.dmp	family_blackshades

Modifies firewall policy service 3 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DFBB784A-AD59-A4A7-ABF9-D8FB3CF0FB2A}	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DFBB784A-AD59-A4A7-ABF9-D8FB3CF0FB2A}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Key created	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{DFBB784A-AD59-A4A7-ABF9-D8FB3CF0FB2A}	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{DFBB784A-AD59-A4A7-ABF9-D8FB3CF0FB2A}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation	C1GJEK.exe

Executes dropped EXE 3 IoCs

pid	Process
5352	C1GJEK.exe
4480	Crypted.exe
3792	Crypted.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchost.exe"	Crypted.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	Crypted.exe
File opened (read-only)	\??\U:	Crypted.exe
File opened (read-only)	\??\J:	Crypted.exe
File opened (read-only)	\??\K:	Crypted.exe
File opened (read-only)	\??\L:	Crypted.exe
File opened (read-only)	\??\R:	Crypted.exe
File opened (read-only)	\??\W:	Crypted.exe
File opened (read-only)	\??\X:	Crypted.exe
File opened (read-only)	\??\Z:	Crypted.exe
File opened (read-only)	\??\I:	Crypted.exe
File opened (read-only)	\??\O:	Crypted.exe
File opened (read-only)	\??\V:	Crypted.exe
File opened (read-only)	\??\M:	Crypted.exe
File opened (read-only)	\??\Q:	Crypted.exe
File opened (read-only)	\??\Y:	Crypted.exe
File opened (read-only)	\??\E:	Crypted.exe
File opened (read-only)	\??\G:	Crypted.exe
File opened (read-only)	\??\H:	Crypted.exe
File opened (read-only)	\??\N:	Crypted.exe
File opened (read-only)	\??\P:	Crypted.exe
File opened (read-only)	\??\S:	Crypted.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2364-0-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/memory/2364-269-0x0000000000400000-0x000000000046B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
4068	reg.exe
2220	reg.exe
1392	reg.exe
2776	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4480	Crypted.exe
4480	Crypted.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: 1	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeCreateTokenPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeAssignPrimaryTokenPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeLockMemoryPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeIncreaseQuotaPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeMachineAccountPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeTcbPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeSecurityPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeTakeOwnershipPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeLoadDriverPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeSystemProfilePrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeSystemtimePrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeProfSingleProcessPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeIncBasePriorityPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeCreatePagefilePrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeCreatePermanentPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeBackupPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeRestorePrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeShutdownPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeDebugPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeAuditPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeSystemEnvironmentPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeChangeNotifyPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeRemoteShutdownPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeUndockPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeSyncAgentPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeEnableDelegationPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeManageVolumePrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeImpersonatePrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeCreateGlobalPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: 31	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: 32	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: 33	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: 34	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: 35	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeDebugPrivilege	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
Token: SeDebugPrivilege	4480	Crypted.exe
Token: SeDebugPrivilege	4480	Crypted.exe
Token: SeDebugPrivilege	3792	Crypted.exe
Token: SeDebugPrivilege	3792	Crypted.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 5352	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe	85
PID 2364 wrote to memory of 5352	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe	85
PID 2364 wrote to memory of 1420	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe	87
PID 2364 wrote to memory of 1420	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe	87
PID 2364 wrote to memory of 1420	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe	87
PID 2364 wrote to memory of 1908	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe	88
PID 2364 wrote to memory of 1908	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe	88
PID 2364 wrote to memory of 1908	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe	88
PID 2364 wrote to memory of 2516	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe	89
PID 2364 wrote to memory of 2516	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe	89
PID 2364 wrote to memory of 2516	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe	89
PID 2364 wrote to memory of 5976	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe	90
PID 2364 wrote to memory of 5976	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe	90
PID 2364 wrote to memory of 5976	2364	JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe	90
PID 1420 wrote to memory of 4068	1420	cmd.exe	95
PID 1420 wrote to memory of 4068	1420	cmd.exe	95
PID 1420 wrote to memory of 4068	1420	cmd.exe	95
PID 2516 wrote to memory of 2220	2516	cmd.exe	96
PID 2516 wrote to memory of 2220	2516	cmd.exe	96
PID 2516 wrote to memory of 2220	2516	cmd.exe	96
PID 1908 wrote to memory of 1392	1908	cmd.exe	97
PID 1908 wrote to memory of 1392	1908	cmd.exe	97
PID 1908 wrote to memory of 1392	1908	cmd.exe	97
PID 5976 wrote to memory of 2776	5976	cmd.exe	98
PID 5976 wrote to memory of 2776	5976	cmd.exe	98
PID 5976 wrote to memory of 2776	5976	cmd.exe	98
PID 5352 wrote to memory of 4480	5352	C1GJEK.exe	99
PID 5352 wrote to memory of 4480	5352	C1GJEK.exe	99
PID 5352 wrote to memory of 4480	5352	C1GJEK.exe	99
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100
PID 4480 wrote to memory of 1944	4480	Crypted.exe	100

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe"
1⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\C1GJEK.exe
  C:\Users\Admin\AppData\Local\Temp\C1GJEK.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5352
- - C:\Users\Admin\AppData\Local\Temp\Crypted.exe
    "C:\Users\Admin\AppData\Local\Temp\Crypted.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\Crypted.exe
      C:\Users\Admin\AppData\Local\Temp\Crypted.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Enumerates connected drives
      Suspicious use of AdjustPrivilegeToken
      PID:3792
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe:*:Enabled:Windows Messanger" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_096175198ac3f9e677270a33e3d8737c.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2220
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5976
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C1GJEK.exe

Path C:\Users\Admin\AppData\Local\Temp\C1GJEK.exe
Size 607KB
SHA256 42b9011edeb0199a0a975b47b0ee824e2bf366661bf4b16b85a49e173c63b69a
MD5 70c59a5f1113b1cb3dce74262e17f838
SHA1 8382937f4f0818c89ccc21d0838a9e51627b85cd
SHA512 4caee227001132244663e12ff220afeee8d983842b444430569fbdb626350d6a6bb503e72876c808191766bc5127c7b92cc9549d60a1677b7649647cb5a8c4fb
SSDEEP 12288:FiWtq0MX5s7U0Ikd+oX404cw0EnzYDzYDzYDzY2KTGPMjkq/m2hJcax2EOZYgUjG:Fioq0EcU0B+M40zw0lYYYRGPMjkq/m2w
MD5 SHA1 SHA512 SSDEEP

Submit Download

Crypted.exe

Path C:\Users\Admin\AppData\Local\Temp\Crypted.exe
Size 76KB
SHA256 444d7d3310d53264fdf32cce6efbae93c90e19141210d1ca3861082d151a772b
MD5 44d907821184fc50a3beb12405d43bc4
SHA1 a82076d836ad2b2f099a2725eba7cb4d3b769a39
SHA512 2e0b3714876fca2e840438995eae56042ffacf35610249d9e18eda96608d464c532f62d2620e7667b6ea63bff0d3e23a3f733e807c21a16a8ec0cd23737b181c
SSDEEP 1536:Yz8mVSBJZgbN4WyZKaLZmOSyevvHOUxmnMqk:7JZgbaWyZKOTSycvH7uk
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.dat

Path C:\Users\Admin\AppData\Roaming\data.dat
Size 33B
SHA256 be88bf934bc3f33f96e37b2d4507bcfa7cf4ca50ba889a7e6a9a49dbf73327b5
MD5 d57e66bd22b3a1ae19b019fd12ebef55
SHA1 c3c41e13438e40fda958164ec97aa066acf82e84
SHA512 71527efa4c448107daac1a55f39209a54e9ffd859d5ce41e21c3c84e1d20f8dc9609229857f392b5a2b09e131221a3c70df53ed741b8e0a6dc4ecc4cf401e1fd
MD5 SHA1 SHA512

Submit Download

memory/2364-19-0x0000000077610000-0x0000000077700000-memory.dmp

Download

memory/2364-274-0x0000000077610000-0x0000000077700000-memory.dmp

Download

memory/2364-271-0x0000000077610000-0x0000000077700000-memory.dmp

Download

memory/2364-269-0x0000000000400000-0x000000000046B000-memory.dmp

Download

memory/2364-0-0x0000000000400000-0x000000000046B000-memory.dmp

Download

memory/2364-18-0x0000000077631000-0x0000000077632000-memory.dmp

Download

memory/2364-20-0x0000000077610000-0x0000000077700000-memory.dmp

Download

memory/3792-41-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/3792-40-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/4480-39-0x0000000010420000-0x0000000010430000-memory.dmp

Download

memory/4480-32-0x0000000010410000-0x0000000010420000-memory.dmp

Download

memory/4480-33-0x0000000010410000-0x0000000010420000-memory.dmp

Download

memory/5352-21-0x0000000001610000-0x0000000001620000-memory.dmp

Download

memory/5352-13-0x000000001C8C0000-0x000000001C95C000-memory.dmp

Download

memory/5352-31-0x00007FFB08740000-0x00007FFB090E1000-memory.dmp

Download

memory/5352-11-0x000000001C350000-0x000000001C81E000-memory.dmp

Download

memory/5352-14-0x0000000001740000-0x0000000001748000-memory.dmp

Download

memory/5352-15-0x000000001C9F0000-0x000000001CA3C000-memory.dmp

Download

memory/5352-12-0x00007FFB08740000-0x00007FFB090E1000-memory.dmp

Download

memory/5352-10-0x00007FFB08740000-0x00007FFB090E1000-memory.dmp

Download

memory/5352-9-0x000000001BDD0000-0x000000001BE76000-memory.dmp

Download

memory/5352-8-0x00007FFB089F5000-0x00007FFB089F6000-memory.dmp

Download