blackshades | 902dd6c3f7d699ae5fe651e9e5889ca2574bfc765f559ced1eb44553dfb92d44

Analysis

max time kernel
148s
max time network
140s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
26/02/2025, 18:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_27dc34502ddd2b8fc2a33592154f4a54.exe
Size

714KB
MD5

27dc34502ddd2b8fc2a33592154f4a54
SHA1

08b89cd4607dd9c3832c9678fa8f5ab50b089dbd
SHA256

902dd6c3f7d699ae5fe651e9e5889ca2574bfc765f559ced1eb44553dfb92d44
SHA512

5bf3fc950a3ec3baabb636c92be09cf42e760fb32b1d501bba46eadc32f3fe171d3fc914f32db4e72bc703efea0cc4068fb9227d03f658b39abf8a4669b19c56
SSDEEP

12288:lwaGGmMtAONTKIKv3kYpDm2gh+EAck42ueKb1wGOyTx7yXH49N4rcWLqB:2aGGmifKBkYBm2Ek42BK4OzN4rcWg

Score

10^/10

blackshades defense_evasion discovery persistence rat upx

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 12 IoCs

resource	yara_rule
behavioral1/memory/2912-71-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/2912-78-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/2912-79-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/2912-81-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/2912-82-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/2912-83-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/2912-85-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/2912-86-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/2912-87-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/2912-89-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/2912-90-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades
behavioral1/memory/2912-91-0x0000000000400000-0x0000000000471000-memory.dmp	family_blackshades

Modifies firewall policy service 3 TTPs 8 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\dllhost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\dllhost.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Microsoft\dllhost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\dllhost.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe

Executes dropped EXE 4 IoCs

pid	Process
1476	MeTube.exe
2000	dllhost.exe
1556	dllhost.exe
2912	dllhost.exe

Loads dropped DLL 20 IoCs

pid	Process
1172	JaffaCakes118_27dc34502ddd2b8fc2a33592154f4a54.exe
1172	JaffaCakes118_27dc34502ddd2b8fc2a33592154f4a54.exe
1172	JaffaCakes118_27dc34502ddd2b8fc2a33592154f4a54.exe
1476	MeTube.exe
1476	MeTube.exe
2000	dllhost.exe
2000	dllhost.exe
2000	dllhost.exe
2000	dllhost.exe
2000	dllhost.exe
2000	dllhost.exe
2000	dllhost.exe
2000	dllhost.exe
1556	dllhost.exe
1556	dllhost.exe
1556	dllhost.exe
1556	dllhost.exe
2912	dllhost.exe
2912	dllhost.exe
2912	dllhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dynamic Link Library Host Application = "C:\\Users\\Admin\\AppData\\Roaming\\dllhost.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1556 set thread context of 2912	1556	dllhost.exe	37

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2912-66-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2912-71-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2912-70-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2912-64-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2912-78-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2912-79-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2912-81-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2912-82-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2912-83-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2912-85-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2912-86-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2912-87-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2912-89-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2912-90-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/2912-91-0x0000000000400000-0x0000000000471000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_27dc34502ddd2b8fc2a33592154f4a54.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MeTube.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1592	reg.exe
2884	reg.exe
2304	reg.exe
1848	reg.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: 1	2912	dllhost.exe
Token: SeCreateTokenPrivilege	2912	dllhost.exe
Token: SeAssignPrimaryTokenPrivilege	2912	dllhost.exe
Token: SeLockMemoryPrivilege	2912	dllhost.exe
Token: SeIncreaseQuotaPrivilege	2912	dllhost.exe
Token: SeMachineAccountPrivilege	2912	dllhost.exe
Token: SeTcbPrivilege	2912	dllhost.exe
Token: SeSecurityPrivilege	2912	dllhost.exe
Token: SeTakeOwnershipPrivilege	2912	dllhost.exe
Token: SeLoadDriverPrivilege	2912	dllhost.exe
Token: SeSystemProfilePrivilege	2912	dllhost.exe
Token: SeSystemtimePrivilege	2912	dllhost.exe
Token: SeProfSingleProcessPrivilege	2912	dllhost.exe
Token: SeIncBasePriorityPrivilege	2912	dllhost.exe
Token: SeCreatePagefilePrivilege	2912	dllhost.exe
Token: SeCreatePermanentPrivilege	2912	dllhost.exe
Token: SeBackupPrivilege	2912	dllhost.exe
Token: SeRestorePrivilege	2912	dllhost.exe
Token: SeShutdownPrivilege	2912	dllhost.exe
Token: SeDebugPrivilege	2912	dllhost.exe
Token: SeAuditPrivilege	2912	dllhost.exe
Token: SeSystemEnvironmentPrivilege	2912	dllhost.exe
Token: SeChangeNotifyPrivilege	2912	dllhost.exe
Token: SeRemoteShutdownPrivilege	2912	dllhost.exe
Token: SeUndockPrivilege	2912	dllhost.exe
Token: SeSyncAgentPrivilege	2912	dllhost.exe
Token: SeEnableDelegationPrivilege	2912	dllhost.exe
Token: SeManageVolumePrivilege	2912	dllhost.exe
Token: SeImpersonatePrivilege	2912	dllhost.exe
Token: SeCreateGlobalPrivilege	2912	dllhost.exe
Token: 31	2912	dllhost.exe
Token: 32	2912	dllhost.exe
Token: 33	2912	dllhost.exe
Token: 34	2912	dllhost.exe
Token: 35	2912	dllhost.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2000	dllhost.exe
1556	dllhost.exe
2912	dllhost.exe
2912	dllhost.exe
2912	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 1476	1172	JaffaCakes118_27dc34502ddd2b8fc2a33592154f4a54.exe	30
PID 1172 wrote to memory of 1476	1172	JaffaCakes118_27dc34502ddd2b8fc2a33592154f4a54.exe	30
PID 1172 wrote to memory of 1476	1172	JaffaCakes118_27dc34502ddd2b8fc2a33592154f4a54.exe	30
PID 1172 wrote to memory of 1476	1172	JaffaCakes118_27dc34502ddd2b8fc2a33592154f4a54.exe	30
PID 1172 wrote to memory of 1476	1172	JaffaCakes118_27dc34502ddd2b8fc2a33592154f4a54.exe	30
PID 1172 wrote to memory of 1476	1172	JaffaCakes118_27dc34502ddd2b8fc2a33592154f4a54.exe	30
PID 1172 wrote to memory of 1476	1172	JaffaCakes118_27dc34502ddd2b8fc2a33592154f4a54.exe	30
PID 1172 wrote to memory of 2000	1172	JaffaCakes118_27dc34502ddd2b8fc2a33592154f4a54.exe	31
PID 1172 wrote to memory of 2000	1172	JaffaCakes118_27dc34502ddd2b8fc2a33592154f4a54.exe	31
PID 1172 wrote to memory of 2000	1172	JaffaCakes118_27dc34502ddd2b8fc2a33592154f4a54.exe	31
PID 1172 wrote to memory of 2000	1172	JaffaCakes118_27dc34502ddd2b8fc2a33592154f4a54.exe	31
PID 1172 wrote to memory of 2000	1172	JaffaCakes118_27dc34502ddd2b8fc2a33592154f4a54.exe	31
PID 1172 wrote to memory of 2000	1172	JaffaCakes118_27dc34502ddd2b8fc2a33592154f4a54.exe	31
PID 1172 wrote to memory of 2000	1172	JaffaCakes118_27dc34502ddd2b8fc2a33592154f4a54.exe	31
PID 2000 wrote to memory of 2752	2000	dllhost.exe	33
PID 2000 wrote to memory of 2752	2000	dllhost.exe	33
PID 2000 wrote to memory of 2752	2000	dllhost.exe	33
PID 2000 wrote to memory of 2752	2000	dllhost.exe	33
PID 2000 wrote to memory of 2752	2000	dllhost.exe	33
PID 2000 wrote to memory of 2752	2000	dllhost.exe	33
PID 2000 wrote to memory of 2752	2000	dllhost.exe	33
PID 2752 wrote to memory of 2268	2752	cmd.exe	35
PID 2752 wrote to memory of 2268	2752	cmd.exe	35
PID 2752 wrote to memory of 2268	2752	cmd.exe	35
PID 2752 wrote to memory of 2268	2752	cmd.exe	35
PID 2752 wrote to memory of 2268	2752	cmd.exe	35
PID 2752 wrote to memory of 2268	2752	cmd.exe	35
PID 2752 wrote to memory of 2268	2752	cmd.exe	35
PID 2000 wrote to memory of 1556	2000	dllhost.exe	36
PID 2000 wrote to memory of 1556	2000	dllhost.exe	36
PID 2000 wrote to memory of 1556	2000	dllhost.exe	36
PID 2000 wrote to memory of 1556	2000	dllhost.exe	36
PID 2000 wrote to memory of 1556	2000	dllhost.exe	36
PID 2000 wrote to memory of 1556	2000	dllhost.exe	36
PID 2000 wrote to memory of 1556	2000	dllhost.exe	36
PID 1556 wrote to memory of 2912	1556	dllhost.exe	37
PID 1556 wrote to memory of 2912	1556	dllhost.exe	37
PID 1556 wrote to memory of 2912	1556	dllhost.exe	37
PID 1556 wrote to memory of 2912	1556	dllhost.exe	37
PID 1556 wrote to memory of 2912	1556	dllhost.exe	37
PID 1556 wrote to memory of 2912	1556	dllhost.exe	37
PID 1556 wrote to memory of 2912	1556	dllhost.exe	37
PID 1556 wrote to memory of 2912	1556	dllhost.exe	37
PID 1556 wrote to memory of 2912	1556	dllhost.exe	37
PID 1556 wrote to memory of 2912	1556	dllhost.exe	37
PID 1556 wrote to memory of 2912	1556	dllhost.exe	37
PID 1556 wrote to memory of 2912	1556	dllhost.exe	37
PID 2912 wrote to memory of 2924	2912	dllhost.exe	38
PID 2912 wrote to memory of 2924	2912	dllhost.exe	38
PID 2912 wrote to memory of 2924	2912	dllhost.exe	38
PID 2912 wrote to memory of 2924	2912	dllhost.exe	38
PID 2912 wrote to memory of 2924	2912	dllhost.exe	38
PID 2912 wrote to memory of 2924	2912	dllhost.exe	38
PID 2912 wrote to memory of 2924	2912	dllhost.exe	38
PID 2912 wrote to memory of 3036	2912	dllhost.exe	39
PID 2912 wrote to memory of 3036	2912	dllhost.exe	39
PID 2912 wrote to memory of 3036	2912	dllhost.exe	39
PID 2912 wrote to memory of 3036	2912	dllhost.exe	39
PID 2912 wrote to memory of 3036	2912	dllhost.exe	39
PID 2912 wrote to memory of 3036	2912	dllhost.exe	39
PID 2912 wrote to memory of 3036	2912	dllhost.exe	39
PID 2912 wrote to memory of 2136	2912	dllhost.exe	41
PID 2912 wrote to memory of 2136	2912	dllhost.exe	41
PID 2912 wrote to memory of 2136	2912	dllhost.exe	41

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27dc34502ddd2b8fc2a33592154f4a54.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27dc34502ddd2b8fc2a33592154f4a54.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Users\Admin\AppData\Local\Temp\MeTube.exe
  "C:\Users\Admin\AppData\Local\Temp\MeTube.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1476
- C:\Users\Admin\AppData\Local\Temp\dllhost.exe
  "C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\259505806.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Dynamic Link Library Host Application" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\dllhost.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2268
- - C:\Users\Admin\AppData\Roaming\dllhost.exe
    "C:\Users\Admin\AppData\Roaming\dllhost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1556
  - - C:\Users\Admin\AppData\Roaming\dllhost.exe
      C:\Users\Admin\AppData\Roaming\dllhost.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2912
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2924
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        6⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1848
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\dllhost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\dllhost.exe:*:Enabled:Windows Messanger" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3036
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\dllhost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\dllhost.exe:*:Enabled:Windows Messanger" /f
        6⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2304
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2136
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        6⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2884
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Microsoft\dllhost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\dllhost.exe:*:Enabled:Windows Messanger" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1948
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Microsoft\dllhost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\dllhost.exe:*:Enabled:Windows Messanger" /f
        6⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\259505806.bat

Filesize
164B

MD5
b9704bf428b27bd87e5ae473a01b74c5

SHA1
7c866d6ab4b427e3a98a02c393bcece54330948f

SHA256
88cc264bb711f3b783e5a77e907470ac068806a6e8b893a3ed1191bd32a45ba6

SHA512
b7eba47bef65b06d09fcfb7bf9a6a0b7080b2e231edd9b45ad2ace29aafeeae2129f488a01ac140ea1434788fdd804a316b69bfa45a575fa10748a4ea98418a8

Download Submit
\Users\Admin\AppData\Local\Temp\MeTube.exe

Filesize
832KB

MD5
b0950b5dfa21732d042c41c539f00e95

SHA1
0a16d588b930380d03b8d04df1047430c6b5e589

SHA256
b95db549a97977f4ef413d5ce66e25e12328bd8cb807400eaefa3619b32a1f8d

SHA512
b5d2b2edb41604cddd7001fba16d75801dffa0bda63cbf6fe7ca0ed28355637d6facec372dfbea2b8b929d8417f034896d332bc1ee6ac8e6e7630584c150e166

Download Submit
\Users\Admin\AppData\Local\Temp\dllhost.exe

Filesize
260KB

MD5
ebd4d45d8e851f771e036dd04e7d7fba

SHA1
0c3ab59a6cae1a5a69f87dcd545a72ed81446bee

SHA256
dc70917774ea5f98d9f8ee7b8a7e5d4a62827ff042f9c656d68cc8d71fbd1128

SHA512
861820282abc758f7f7fb599bdddf8f97ae0c9f211f4b978c9e607f66862f89e17b75b36ec806a54cdbca7c3cd72801d5283d6f17d0209808745f0164b7b0176

Download Submit
\Users\Admin\AppData\Roaming\dllhost.exe

Filesize
260KB

MD5
a805b839564f87cf4df5bb412bdddf33

SHA1
897aaaefce07e64c4178b792b941b6578c8d5a7d

SHA256
7cc48825f8bce1350b1f10f231c921234d2ecfdf917fd65b8de60742665df004

SHA512
28a64177af601f7d7bc56952ccc91733115adc4ba2a9a9884a73281652a02f41c400a736dc91af8236581fcc96ba7432ce96ce4965b964e9b4ad3da984647309

Download Submit
memory/2912-78-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2912-82-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2912-70-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2912-64-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2912-66-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2912-79-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2912-81-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2912-71-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2912-83-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2912-85-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2912-86-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2912-87-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2912-89-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2912-90-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2912-91-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads