blackshades | 53cf44a9a4040d6711823fb2d150a8c34c30b3e866b724ed19fc457e08dee813

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2025, 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_1350e581146ca4194581ad7a13fedd54.exe
Size

236KB
MD5

1350e581146ca4194581ad7a13fedd54
SHA1

34d23b313c25991204205c9b764353db9a6c2956
SHA256

53cf44a9a4040d6711823fb2d150a8c34c30b3e866b724ed19fc457e08dee813
SHA512

3d958d8e654ec99d37568a34c3e36013025961590ac3641950a5afb3eae1d2ab328ef211897678b9fdeb8137b75c034f619cedbda2e8e62e4da57aca0d9befcb
SSDEEP

3072:mI6LmCbpdkJUteMabF9TW1nVfvaE7bUqz9aG1IxCWagbtshigwqoz4tfye:m5bPkJUEMabFRW1VvaETaGKkO9qHtfj

Score

10^/10

blackshades defense_evasion discovery persistence rat upx

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 12 IoCs

resource	yara_rule
behavioral2/memory/4484-49-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades
behavioral2/memory/4484-57-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades
behavioral2/memory/4484-56-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades
behavioral2/memory/4484-59-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades
behavioral2/memory/4484-63-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades
behavioral2/memory/4484-66-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades
behavioral2/memory/4484-68-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades
behavioral2/memory/4484-70-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades
behavioral2/memory/4484-73-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades
behavioral2/memory/4484-75-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades
behavioral2/memory/4484-77-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades
behavioral2/memory/4484-82-0x0000000000400000-0x000000000045D000-memory.dmp	family_blackshades

Modifies firewall policy service 3 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\ModemUpdater\chost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\ModemUpdater\\chost.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	chost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Google Updates = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	chost.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0BBA3D30-AC6B-D6A7-AA17-10DAF6CA2F9C}	chost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0BBA3D30-AC6B-D6A7-AA17-10DAF6CA2F9C}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	chost.exe
Key created	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{0BBA3D30-AC6B-D6A7-AA17-10DAF6CA2F9C}	chost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{0BBA3D30-AC6B-D6A7-AA17-10DAF6CA2F9C}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	chost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation	JaffaCakes118_1350e581146ca4194581ad7a13fedd54.exe

Executes dropped EXE 3 IoCs

pid	Process
4072	chost.exe
892	chost.exe
4484	chost.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Modem Setup = "C:\\Users\\Admin\\AppData\\Roaming\\ModemUpdater\\chost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Google Updates = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	chost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Updates = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	chost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4072 set thread context of 892	4072	chost.exe	94
PID 4072 set thread context of 4484	4072	chost.exe	95

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4484-49-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4484-57-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4484-56-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4484-48-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4484-45-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4484-59-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4484-63-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4484-66-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4484-68-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4484-70-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4484-73-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4484-75-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4484-77-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral2/memory/4484-82-0x0000000000400000-0x000000000045D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1350e581146ca4194581ad7a13fedd54.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
4456	reg.exe
828	reg.exe
2184	reg.exe
3060	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	892	chost.exe
Token: 1	4484	chost.exe
Token: SeCreateTokenPrivilege	4484	chost.exe
Token: SeAssignPrimaryTokenPrivilege	4484	chost.exe
Token: SeLockMemoryPrivilege	4484	chost.exe
Token: SeIncreaseQuotaPrivilege	4484	chost.exe
Token: SeMachineAccountPrivilege	4484	chost.exe
Token: SeTcbPrivilege	4484	chost.exe
Token: SeSecurityPrivilege	4484	chost.exe
Token: SeTakeOwnershipPrivilege	4484	chost.exe
Token: SeLoadDriverPrivilege	4484	chost.exe
Token: SeSystemProfilePrivilege	4484	chost.exe
Token: SeSystemtimePrivilege	4484	chost.exe
Token: SeProfSingleProcessPrivilege	4484	chost.exe
Token: SeIncBasePriorityPrivilege	4484	chost.exe
Token: SeCreatePagefilePrivilege	4484	chost.exe
Token: SeCreatePermanentPrivilege	4484	chost.exe
Token: SeBackupPrivilege	4484	chost.exe
Token: SeRestorePrivilege	4484	chost.exe
Token: SeShutdownPrivilege	4484	chost.exe
Token: SeDebugPrivilege	4484	chost.exe
Token: SeAuditPrivilege	4484	chost.exe
Token: SeSystemEnvironmentPrivilege	4484	chost.exe
Token: SeChangeNotifyPrivilege	4484	chost.exe
Token: SeRemoteShutdownPrivilege	4484	chost.exe
Token: SeUndockPrivilege	4484	chost.exe
Token: SeSyncAgentPrivilege	4484	chost.exe
Token: SeEnableDelegationPrivilege	4484	chost.exe
Token: SeManageVolumePrivilege	4484	chost.exe
Token: SeImpersonatePrivilege	4484	chost.exe
Token: SeCreateGlobalPrivilege	4484	chost.exe
Token: 31	4484	chost.exe
Token: 32	4484	chost.exe
Token: 33	4484	chost.exe
Token: 34	4484	chost.exe
Token: 35	4484	chost.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3484	JaffaCakes118_1350e581146ca4194581ad7a13fedd54.exe
4072	chost.exe
892	chost.exe
4484	chost.exe
4484	chost.exe
4484	chost.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 1404	3484	JaffaCakes118_1350e581146ca4194581ad7a13fedd54.exe	86
PID 3484 wrote to memory of 1404	3484	JaffaCakes118_1350e581146ca4194581ad7a13fedd54.exe	86
PID 3484 wrote to memory of 1404	3484	JaffaCakes118_1350e581146ca4194581ad7a13fedd54.exe	86
PID 1404 wrote to memory of 1260	1404	cmd.exe	89
PID 1404 wrote to memory of 1260	1404	cmd.exe	89
PID 1404 wrote to memory of 1260	1404	cmd.exe	89
PID 3484 wrote to memory of 4072	3484	JaffaCakes118_1350e581146ca4194581ad7a13fedd54.exe	90
PID 3484 wrote to memory of 4072	3484	JaffaCakes118_1350e581146ca4194581ad7a13fedd54.exe	90
PID 3484 wrote to memory of 4072	3484	JaffaCakes118_1350e581146ca4194581ad7a13fedd54.exe	90
PID 4072 wrote to memory of 892	4072	chost.exe	94
PID 4072 wrote to memory of 892	4072	chost.exe	94
PID 4072 wrote to memory of 892	4072	chost.exe	94
PID 4072 wrote to memory of 892	4072	chost.exe	94
PID 4072 wrote to memory of 892	4072	chost.exe	94
PID 4072 wrote to memory of 892	4072	chost.exe	94
PID 4072 wrote to memory of 892	4072	chost.exe	94
PID 4072 wrote to memory of 4484	4072	chost.exe	95
PID 4072 wrote to memory of 4484	4072	chost.exe	95
PID 4072 wrote to memory of 4484	4072	chost.exe	95
PID 4072 wrote to memory of 4484	4072	chost.exe	95
PID 4072 wrote to memory of 4484	4072	chost.exe	95
PID 4072 wrote to memory of 4484	4072	chost.exe	95
PID 4072 wrote to memory of 4484	4072	chost.exe	95
PID 4072 wrote to memory of 4484	4072	chost.exe	95
PID 4484 wrote to memory of 1832	4484	chost.exe	96
PID 4484 wrote to memory of 1832	4484	chost.exe	96
PID 4484 wrote to memory of 1832	4484	chost.exe	96
PID 4484 wrote to memory of 3028	4484	chost.exe	97
PID 4484 wrote to memory of 3028	4484	chost.exe	97
PID 4484 wrote to memory of 3028	4484	chost.exe	97
PID 4484 wrote to memory of 4952	4484	chost.exe	99
PID 4484 wrote to memory of 4952	4484	chost.exe	99
PID 4484 wrote to memory of 4952	4484	chost.exe	99
PID 4484 wrote to memory of 972	4484	chost.exe	101
PID 4484 wrote to memory of 972	4484	chost.exe	101
PID 4484 wrote to memory of 972	4484	chost.exe	101
PID 1832 wrote to memory of 828	1832	cmd.exe	104
PID 1832 wrote to memory of 828	1832	cmd.exe	104
PID 1832 wrote to memory of 828	1832	cmd.exe	104
PID 3028 wrote to memory of 4456	3028	cmd.exe	105
PID 3028 wrote to memory of 4456	3028	cmd.exe	105
PID 3028 wrote to memory of 4456	3028	cmd.exe	105
PID 4952 wrote to memory of 2184	4952	cmd.exe	106
PID 4952 wrote to memory of 2184	4952	cmd.exe	106
PID 4952 wrote to memory of 2184	4952	cmd.exe	106
PID 972 wrote to memory of 3060	972	cmd.exe	107
PID 972 wrote to memory of 3060	972	cmd.exe	107
PID 972 wrote to memory of 3060	972	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1350e581146ca4194581ad7a13fedd54.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1350e581146ca4194581ad7a13fedd54.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240655750.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Modem Setup" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ModemUpdater\chost.exe" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1260
- C:\Users\Admin\AppData\Roaming\ModemUpdater\chost.exe
  "C:\Users\Admin\AppData\Roaming\ModemUpdater\chost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Users\Admin\AppData\Roaming\ModemUpdater\chost.exe
    "C:\Users\Admin\AppData\Roaming\ModemUpdater\chost.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:892
- - C:\Users\Admin\AppData\Roaming\ModemUpdater\chost.exe
    "C:\Users\Admin\AppData\Roaming\ModemUpdater\chost.exe"
    3⤵
    - Adds policy Run key to start application
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1832
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:828
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\ModemUpdater\chost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ModemUpdater\chost.exe:*:Enabled:Windows Messanger" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3028
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\ModemUpdater\chost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ModemUpdater\chost.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4456
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4952
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2184
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:972
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\240655750.bat

Filesize
149B

MD5
f17bccf0adf6fd4c1863027ba6354d9e

SHA1
967581e62ddf207233788896f7343f84b39165c8

SHA256
c58f6ef205ad3354c934f201035375989e53f118e151e8e73556ece955d1ff51

SHA512
d10d3b39b3ad7d8440d8627b2f27501e7624824ada9600db4cdeea8a8724b920939dafae0f2221c00c008af1b83ef74babb21dfedadf822113b1afe83c5e1d63

Download Submit
C:\Users\Admin\AppData\Roaming\ModemUpdater\chost.exe

Filesize
236KB

MD5
1350e581146ca4194581ad7a13fedd54

SHA1
34d23b313c25991204205c9b764353db9a6c2956

SHA256
53cf44a9a4040d6711823fb2d150a8c34c30b3e866b724ed19fc457e08dee813

SHA512
3d958d8e654ec99d37568a34c3e36013025961590ac3641950a5afb3eae1d2ab328ef211897678b9fdeb8137b75c034f619cedbda2e8e62e4da57aca0d9befcb

Download Submit
memory/892-36-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/892-58-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/892-40-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/892-39-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/892-43-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3484-4-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/3484-15-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

Filesize
4KB

Download
memory/3484-10-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/3484-3-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/3484-2-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/3484-13-0x0000000002B50000-0x0000000002B51000-memory.dmp

Filesize
4KB

Download
memory/3484-11-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/3484-6-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/3484-5-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/4072-31-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download
memory/4072-35-0x0000000002880000-0x0000000002881000-memory.dmp

Filesize
4KB

Download
memory/4072-44-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/4072-33-0x00000000020A0000-0x00000000020A1000-memory.dmp

Filesize
4KB

Download
memory/4072-34-0x00000000020B0000-0x00000000020B1000-memory.dmp

Filesize
4KB

Download
memory/4072-32-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/4072-30-0x00000000020B0000-0x00000000020B1000-memory.dmp

Filesize
4KB

Download
memory/4072-53-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download
memory/4072-29-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/4484-57-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4484-45-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4484-48-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4484-49-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4484-56-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4484-59-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4484-63-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4484-66-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4484-68-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4484-70-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4484-73-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4484-75-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4484-77-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4484-82-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads