Malware Analysis Report

2025-05-06 00:12

Sample ID 250225-zlrq5svqw4
Target JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e
SHA256 e36e36593c9d0335592f93298208298f5bcce86bad692bcc7b11ceed9c4a0ff4
Tags
blackshades defense_evasion discovery persistence rat upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e36e36593c9d0335592f93298208298f5bcce86bad692bcc7b11ceed9c4a0ff4

Threat Level: Known bad

The file JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e was found to be: Known bad.

Malicious Activity Summary

blackshades defense_evasion discovery persistence rat upx

Modifies firewall policy service

Blackshades

Blackshades payload

Blackshades family

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

UPX packed file

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Modifies registry key

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-25 20:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-25 20:48

Reported

2025-02-25 20:51

Platform

win7-20240903-en

Max time kernel

149s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\java\javaconsole.exe = "C:\\Users\\Admin\\AppData\\Roaming\\java\\javaconsole.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Nvidia.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Nvidia.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java Oy = "C:\\Users\\Admin\\AppData\\Roaming\\java\\javaconsole.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2668 set thread context of 2644 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 2668 set thread context of 2784 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2476 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2476 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2476 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2476 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2800 wrote to memory of 2628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2800 wrote to memory of 2628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2800 wrote to memory of 2628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2800 wrote to memory of 2628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2476 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 2476 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 2476 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 2476 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 2668 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 2668 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 2668 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 2668 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 2668 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 2668 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 2668 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 2668 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 2668 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 2668 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 2668 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 2668 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 2668 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 2668 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 2668 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 2668 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 2668 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 2644 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2644 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2644 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2644 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2644 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2644 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2644 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2644 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2644 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2644 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2644 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2644 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2644 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2644 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2644 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2644 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2516 wrote to memory of 1216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2516 wrote to memory of 1216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2516 wrote to memory of 1216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2516 wrote to memory of 1216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2512 wrote to memory of 300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2512 wrote to memory of 300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2512 wrote to memory of 300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2512 wrote to memory of 300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2748 wrote to memory of 1716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2748 wrote to memory of 1716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2748 wrote to memory of 1716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2748 wrote to memory of 1716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2532 wrote to memory of 1936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2532 wrote to memory of 1936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2532 wrote to memory of 1936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2532 wrote to memory of 1936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\259451409.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java Oy" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\java\javaconsole.exe" /f

C:\Users\Admin\AppData\Roaming\java\javaconsole.exe

"C:\Users\Admin\AppData\Roaming\java\javaconsole.exe"

C:\Users\Admin\AppData\Roaming\java\javaconsole.exe

"C:\Users\Admin\AppData\Roaming\java\javaconsole.exe"

C:\Users\Admin\AppData\Roaming\java\javaconsole.exe

"C:\Users\Admin\AppData\Roaming\java\javaconsole.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\java\javaconsole.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\java\javaconsole.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Nvidia.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Nvidia.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\java\javaconsole.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\java\javaconsole.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Nvidia.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Nvidia.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 olenapina169.no-ip.biz udp

Files

C:\Users\Admin\AppData\Local\Temp\259451409.bat

MD5 1deef04b0d0abe2d75154cc508a85e9c
SHA1 067668cc9de86f0a73290c1783662c5530349f7e
SHA256 2dccd725bc2d38c740fd28b627d0fb1fe3efa798ce445e80fa44c3ce0607620e
SHA512 c3466c7c6a10255a20c7e2d4e95dd6c607bed1279a3609495cde25fae210d16ef9f8f404ace7b475a0e4ae14adef3a440c551f79cbf1ccd3c56445415ec8a3c3

\Users\Admin\AppData\Roaming\java\javaconsole.exe

MD5 1d958c0ffc01bf257990ddc2f7f2a9fc
SHA1 f4b1984adaae3cdbf32c0117502079b8250831f8
SHA256 a7538a08f53b8322cff4aa26a04021ab4160baff3b960ce3e274cb4ccb481375
SHA512 5e44e9468becd88e9e37d0a97f81e46ba2fe999dcca331129e09b24bc80b10b633cbb4ca0207556020d90589bd8d1666bf2374035791fe778489bcbca1059798

memory/2644-36-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2644-40-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2784-43-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2644-42-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2784-52-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2784-54-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2784-50-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2784-49-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2644-59-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2784-60-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2644-61-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2644-63-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2644-66-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2644-68-0x0000000000400000-0x000000000045D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-25 20:48

Reported

2025-02-25 20:51

Platform

win10v2004-20250217-en

Max time kernel

150s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\java\javaconsole.exe = "C:\\Users\\Admin\\AppData\\Roaming\\java\\javaconsole.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Nvidia.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Nvidia.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Oy = "C:\\Users\\Admin\\AppData\\Roaming\\java\\javaconsole.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4520 set thread context of 2884 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 4520 set thread context of 4516 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1716 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1716 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e.exe C:\Windows\SysWOW64\cmd.exe
PID 1716 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e.exe C:\Windows\SysWOW64\cmd.exe
PID 2264 wrote to memory of 2900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2264 wrote to memory of 2900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2264 wrote to memory of 2900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1716 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 1716 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 1716 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 4520 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 4520 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 4520 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 4520 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 4520 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 4520 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 4520 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 4520 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 4520 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 4520 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 4520 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 4520 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 4520 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 4520 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 4520 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Users\Admin\AppData\Roaming\java\javaconsole.exe
PID 2884 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 1188 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2884 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\java\javaconsole.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 2968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2012 wrote to memory of 2968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2012 wrote to memory of 2968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1188 wrote to memory of 3832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1188 wrote to memory of 3832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1188 wrote to memory of 3832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3340 wrote to memory of 2204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3340 wrote to memory of 2204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3340 wrote to memory of 2204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2736 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2736 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2736 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d63921487325e68fbc7bc66dee0b3e.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240673796.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java Oy" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\java\javaconsole.exe" /f

C:\Users\Admin\AppData\Roaming\java\javaconsole.exe

"C:\Users\Admin\AppData\Roaming\java\javaconsole.exe"

C:\Users\Admin\AppData\Roaming\java\javaconsole.exe

"C:\Users\Admin\AppData\Roaming\java\javaconsole.exe"

C:\Users\Admin\AppData\Roaming\java\javaconsole.exe

"C:\Users\Admin\AppData\Roaming\java\javaconsole.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\java\javaconsole.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\java\javaconsole.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Nvidia.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Nvidia.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\java\javaconsole.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\java\javaconsole.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Nvidia.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Nvidia.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 olenapina169.no-ip.biz udp
US 8.8.8.8:53 olenapina169.no-ip.biz udp
US 8.8.8.8:53 olenapina169.no-ip.biz udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 olenapina169.no-ip.biz udp
US 8.8.8.8:53 olenapina169.no-ip.biz udp
US 8.8.8.8:53 olenapina169.no-ip.biz udp
US 8.8.8.8:53 olenapina169.no-ip.biz udp
US 8.8.8.8:53 olenapina169.no-ip.biz udp
US 8.8.8.8:53 olenapina169.no-ip.biz udp
US 8.8.8.8:53 olenapina169.no-ip.biz udp

Files

C:\Users\Admin\AppData\Local\Temp\240673796.bat

MD5 1deef04b0d0abe2d75154cc508a85e9c
SHA1 067668cc9de86f0a73290c1783662c5530349f7e
SHA256 2dccd725bc2d38c740fd28b627d0fb1fe3efa798ce445e80fa44c3ce0607620e
SHA512 c3466c7c6a10255a20c7e2d4e95dd6c607bed1279a3609495cde25fae210d16ef9f8f404ace7b475a0e4ae14adef3a440c551f79cbf1ccd3c56445415ec8a3c3

C:\Users\Admin\AppData\Roaming\java\javaconsole.exe

MD5 1d958c0ffc01bf257990ddc2f7f2a9fc
SHA1 f4b1984adaae3cdbf32c0117502079b8250831f8
SHA256 a7538a08f53b8322cff4aa26a04021ab4160baff3b960ce3e274cb4ccb481375
SHA512 5e44e9468becd88e9e37d0a97f81e46ba2fe999dcca331129e09b24bc80b10b633cbb4ca0207556020d90589bd8d1666bf2374035791fe778489bcbca1059798

memory/2884-17-0x0000000000400000-0x000000000045D000-memory.dmp

memory/4516-28-0x0000000000400000-0x0000000000407000-memory.dmp

memory/4516-29-0x0000000000400000-0x0000000000407000-memory.dmp

memory/4516-24-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2884-22-0x0000000000400000-0x000000000045D000-memory.dmp

memory/4516-31-0x0000000000400000-0x0000000000407000-memory.dmp

memory/4516-33-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2884-20-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2884-38-0x0000000000400000-0x000000000045D000-memory.dmp

memory/4516-39-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2884-40-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2884-42-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2884-45-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2884-47-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2884-52-0x0000000000400000-0x000000000045D000-memory.dmp