Malware Analysis Report

2025-05-06 00:11

Sample ID 250226-pkpv2szky6
Target JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80
SHA256 611534fac217fb87d8f78173a046007a8fcd04141eb1436a155438d8cdc712df
Tags
upx blackshades defense_evasion discovery persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

611534fac217fb87d8f78173a046007a8fcd04141eb1436a155438d8cdc712df

Threat Level: Known bad

The file JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80 was found to be: Known bad.

Malicious Activity Summary

upx blackshades defense_evasion discovery persistence rat

Blackshades payload

Blackshades family

Modifies firewall policy service

Blackshades

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

UPX packed file

Suspicious use of SetThreadContext

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Modifies registry key

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-26 12:23

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-26 12:23

Reported

2025-02-26 12:26

Platform

win7-20240903-en

Max time kernel

149s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Window Updates\\winupdt3.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\local.exe = "C:\\Users\\Admin\\AppData\\Roaming\\local.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdt = "C:\\Users\\Admin\\AppData\\Roaming\\Window Updates\\winupdt3.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2056 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80.exe C:\Windows\SysWOW64\cmd.exe
PID 2056 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80.exe C:\Windows\SysWOW64\cmd.exe
PID 2056 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80.exe C:\Windows\SysWOW64\cmd.exe
PID 2056 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80.exe C:\Windows\SysWOW64\cmd.exe
PID 2360 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2360 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2360 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2360 wrote to memory of 2780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2056 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 2056 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 2056 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 2056 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 484 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 484 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 484 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 484 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 484 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 484 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 484 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 484 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 484 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 484 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 484 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 484 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 484 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 484 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 484 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 484 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 484 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 484 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 2728 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 2728 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 2728 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 2728 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 2728 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 2728 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 2728 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 2728 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 2728 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 2728 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 2728 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 2728 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 2728 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 2728 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 2728 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 2728 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 1660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2740 wrote to memory of 1660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2740 wrote to memory of 1660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2740 wrote to memory of 1660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2644 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2644 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2644 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2644 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2776 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2776 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2776 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2776 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2616 wrote to memory of 2160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2616 wrote to memory of 2160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2616 wrote to memory of 2160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2616 wrote to memory of 2160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\BcPyx.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinUpdt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe" /f

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe"

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe"

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\local.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\local.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\local.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\local.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 bigmeech.no-ip.biz udp

Files

memory/2056-0-0x0000000000400000-0x00000000005B5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BcPyx.bat

MD5 deba559edd7e3c8dcc3e27362ac41cde
SHA1 a5688d69bc779c836262874f344de154ae7e7219
SHA256 49f5709cc8357f7e406ae904f54d82d476094e2e93dc93308147d8ed9a175a90
SHA512 9296532fd85f48b49802be12a8581453f84274cada2433d082d5901bd86c57c86bdcc4bd4420d2f6014d1e964f0b1234eb0d34bd23ffad22c9ae02f615847fbd

\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe

MD5 ecfd0bfa623aa24bd6a63909bc1b5bce
SHA1 542b5a4d4a088ca6f884bf448eaf40219aad3074
SHA256 7ddbc76eee493a06033cddfa0caede439320dcc57d01008458db56d9b625b310
SHA512 76aadefa2c50482279d15b7d13f16ea71979aad1ac95000eab521f2f169c959203fc77bf92c70ff375d047ff3eda456bbbfc2d1facc0c3d3581f50c1b89eb576

memory/2056-42-0x00000000032C0000-0x0000000003475000-memory.dmp

memory/2056-45-0x0000000000400000-0x00000000005B5000-memory.dmp

memory/484-46-0x0000000000400000-0x00000000005B5000-memory.dmp

memory/484-63-0x0000000000400000-0x00000000005B5000-memory.dmp

memory/2728-54-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2764-62-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2764-60-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2764-57-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2728-56-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2728-51-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2728-71-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2764-72-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2728-75-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2728-78-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2728-80-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2728-82-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2728-84-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2728-94-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2728-96-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2728-98-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2728-101-0x0000000000400000-0x000000000045C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-26 12:23

Reported

2025-02-26 12:26

Platform

win10v2004-20250217-en

Max time kernel

149s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Window Updates\\winupdt3.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\local.exe = "C:\\Users\\Admin\\AppData\\Roaming\\local.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdt = "C:\\Users\\Admin\\AppData\\Roaming\\Window Updates\\winupdt3.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4436 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80.exe C:\Windows\SysWOW64\cmd.exe
PID 4436 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80.exe C:\Windows\SysWOW64\cmd.exe
PID 4436 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80.exe C:\Windows\SysWOW64\cmd.exe
PID 4112 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4112 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4112 wrote to memory of 2344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4436 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 4436 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 4436 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 4696 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 4696 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 4696 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 4696 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 4696 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 4696 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 4696 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 4696 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 4696 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 4696 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 4696 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 4696 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 4696 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 4696 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 4696 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 4696 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe
PID 1904 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 1904 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 1904 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 1904 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 1904 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 1904 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 1904 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 1904 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 1904 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 1904 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 1904 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 1904 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 4756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2592 wrote to memory of 4756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2592 wrote to memory of 4756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4452 wrote to memory of 4884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4452 wrote to memory of 4884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4452 wrote to memory of 4884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1136 wrote to memory of 4956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1136 wrote to memory of 4956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1136 wrote to memory of 4956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4048 wrote to memory of 880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4048 wrote to memory of 880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4048 wrote to memory of 880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25e92fd1aa07db2d111cdaca3d8b2f80.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JEDnl.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinUpdt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe" /f

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe"

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe"

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe

"C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\local.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\local.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\local.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\local.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 bigmeech.no-ip.biz udp
US 150.171.28.10:443 tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/4436-0-0x0000000000400000-0x00000000005B5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\JEDnl.txt

MD5 deba559edd7e3c8dcc3e27362ac41cde
SHA1 a5688d69bc779c836262874f344de154ae7e7219
SHA256 49f5709cc8357f7e406ae904f54d82d476094e2e93dc93308147d8ed9a175a90
SHA512 9296532fd85f48b49802be12a8581453f84274cada2433d082d5901bd86c57c86bdcc4bd4420d2f6014d1e964f0b1234eb0d34bd23ffad22c9ae02f615847fbd

C:\Users\Admin\AppData\Roaming\Window Updates\winupdt3.txt

MD5 b16e489021ad0785d22542668ce80ce5
SHA1 83c659c0e4aaebd681fafef27a290cb4c14d4c15
SHA256 726390d8c95580825133cd70fdf6ba46036dc24ad0164d752a76a5b6aa64e7ba
SHA512 4ba36c0d4f36205a72a4ae897ef77872a6c1a83db5018e75ee6c5c7b8aa06bc85158db78ba2db1422af0223f3449eb10618fdcbcdd7ac3782ad7cf4a77b3f566

memory/4436-29-0x0000000000400000-0x00000000005B5000-memory.dmp

memory/1904-32-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1904-37-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1904-35-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1924-38-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1924-43-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1924-46-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4696-51-0x0000000000400000-0x00000000005B5000-memory.dmp

memory/1904-54-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1924-55-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1904-56-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1904-58-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1904-61-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1904-63-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1904-65-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1904-68-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1904-70-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1904-77-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1904-79-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1904-84-0x0000000000400000-0x000000000045C000-memory.dmp