blackshades | 4c642395304d6f67fcbccef24bf566917ce78b621bb9c6612587797c2ee95709

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
01/03/2025, 15:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe
Size

524KB
MD5

39c97da0a4b3a4b56950135f61a50405
SHA1

f1b9956053aac9d5a73a59bfbcbe9671c4389c41
SHA256

4c642395304d6f67fcbccef24bf566917ce78b621bb9c6612587797c2ee95709
SHA512

f10b3670a0bfea5f5df110298aa383296feb3daa67e169a8319a2e1f2e3614faea3ea426e00b8212b5aec24e151cfc5212f33a50bfd3235baf22632abe2ba562
SSDEEP

12288:VnQQVJFKnxFwMtWw/RsigtZ6iyGzNB71lPibBWxbxUw:VnQ8FPMtWoRpgt/yGzNBZ1i0

Score

10^/10

blackshades defense_evasion discovery persistence rat upx

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 14 IoCs

resource	yara_rule
behavioral2/memory/3720-39-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackshades
behavioral2/memory/3720-46-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackshades
behavioral2/memory/3720-59-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackshades
behavioral2/memory/3720-63-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackshades
behavioral2/memory/3720-66-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackshades
behavioral2/memory/3720-68-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackshades
behavioral2/memory/3720-70-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackshades
behavioral2/memory/3720-73-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackshades
behavioral2/memory/3720-75-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackshades
behavioral2/memory/3720-77-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackshades
behavioral2/memory/3720-80-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackshades
behavioral2/memory/3720-82-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackshades
behavioral2/memory/3720-84-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackshades
behavioral2/memory/3720-89-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackshades

Modifies firewall policy service 3 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe = "C:\\Users\\Admin\\AppData\\Roaming\\..Flash\\Flaseher.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\locsrv.exe = "C:\\Users\\Admin\\AppData\\Roaming\\locsrv.exe:*:Enabled:Windows Messanger"	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\KJASDF = "C:\\Users\\Admin\\AppData\\Roaming\\locsrv.exe"	Flaseher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	Flaseher.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C7EC2EDD-BBEB-AEF7-24F9-89D93EDCFBDD}	Flaseher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C7EC2EDD-BBEB-AEF7-24F9-89D93EDCFBDD}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\locsrv.exe"	Flaseher.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{C7EC2EDD-BBEB-AEF7-24F9-89D93EDCFBDD}	Flaseher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{C7EC2EDD-BBEB-AEF7-24F9-89D93EDCFBDD}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\locsrv.exe"	Flaseher.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Control Panel\International\Geo\Nation	JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe

Executes dropped EXE 3 IoCs

pid	Process
4652	Flaseher.exe
1540	Flaseher.exe
3720	Flaseher.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.Flasfh = "C:\\Users\\Admin\\AppData\\Roaming\\..Flash\\Flaseher.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KJASDF = "C:\\Users\\Admin\\AppData\\Roaming\\locsrv.exe"	Flaseher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KJASDF = "C:\\Users\\Admin\\AppData\\Roaming\\locsrv.exe"	Flaseher.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4524 set thread context of 3696	4524	JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe	93
PID 4652 set thread context of 1540	4652	Flaseher.exe	102
PID 4652 set thread context of 3720	4652	Flaseher.exe	103

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3696-4-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/3696-6-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/3696-8-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/3696-45-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/3696-57-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/1540-58-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flaseher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flaseher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flaseher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
2540	reg.exe
2488	reg.exe
2352	reg.exe
4600	reg.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 1	3720	Flaseher.exe
Token: SeCreateTokenPrivilege	3720	Flaseher.exe
Token: SeAssignPrimaryTokenPrivilege	3720	Flaseher.exe
Token: SeLockMemoryPrivilege	3720	Flaseher.exe
Token: SeIncreaseQuotaPrivilege	3720	Flaseher.exe
Token: SeMachineAccountPrivilege	3720	Flaseher.exe
Token: SeTcbPrivilege	3720	Flaseher.exe
Token: SeSecurityPrivilege	3720	Flaseher.exe
Token: SeTakeOwnershipPrivilege	3720	Flaseher.exe
Token: SeLoadDriverPrivilege	3720	Flaseher.exe
Token: SeSystemProfilePrivilege	3720	Flaseher.exe
Token: SeSystemtimePrivilege	3720	Flaseher.exe
Token: SeProfSingleProcessPrivilege	3720	Flaseher.exe
Token: SeIncBasePriorityPrivilege	3720	Flaseher.exe
Token: SeCreatePagefilePrivilege	3720	Flaseher.exe
Token: SeCreatePermanentPrivilege	3720	Flaseher.exe
Token: SeBackupPrivilege	3720	Flaseher.exe
Token: SeRestorePrivilege	3720	Flaseher.exe
Token: SeShutdownPrivilege	3720	Flaseher.exe
Token: SeDebugPrivilege	3720	Flaseher.exe
Token: SeAuditPrivilege	3720	Flaseher.exe
Token: SeSystemEnvironmentPrivilege	3720	Flaseher.exe
Token: SeChangeNotifyPrivilege	3720	Flaseher.exe
Token: SeRemoteShutdownPrivilege	3720	Flaseher.exe
Token: SeUndockPrivilege	3720	Flaseher.exe
Token: SeSyncAgentPrivilege	3720	Flaseher.exe
Token: SeEnableDelegationPrivilege	3720	Flaseher.exe
Token: SeManageVolumePrivilege	3720	Flaseher.exe
Token: SeImpersonatePrivilege	3720	Flaseher.exe
Token: SeCreateGlobalPrivilege	3720	Flaseher.exe
Token: 31	3720	Flaseher.exe
Token: 32	3720	Flaseher.exe
Token: 33	3720	Flaseher.exe
Token: 34	3720	Flaseher.exe
Token: 35	3720	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe
Token: SeDebugPrivilege	1540	Flaseher.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4524	JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe
3696	JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe
4652	Flaseher.exe
3720	Flaseher.exe
3720	Flaseher.exe
1540	Flaseher.exe
3720	Flaseher.exe
3720	Flaseher.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 3696	4524	JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe	93
PID 4524 wrote to memory of 3696	4524	JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe	93
PID 4524 wrote to memory of 3696	4524	JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe	93
PID 4524 wrote to memory of 3696	4524	JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe	93
PID 4524 wrote to memory of 3696	4524	JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe	93
PID 4524 wrote to memory of 3696	4524	JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe	93
PID 4524 wrote to memory of 3696	4524	JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe	93
PID 4524 wrote to memory of 3696	4524	JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe	93
PID 3696 wrote to memory of 100	3696	JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe	96
PID 3696 wrote to memory of 100	3696	JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe	96
PID 3696 wrote to memory of 100	3696	JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe	96
PID 100 wrote to memory of 4788	100	cmd.exe	99
PID 100 wrote to memory of 4788	100	cmd.exe	99
PID 100 wrote to memory of 4788	100	cmd.exe	99
PID 3696 wrote to memory of 4652	3696	JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe	100
PID 3696 wrote to memory of 4652	3696	JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe	100
PID 3696 wrote to memory of 4652	3696	JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe	100
PID 4652 wrote to memory of 1540	4652	Flaseher.exe	102
PID 4652 wrote to memory of 1540	4652	Flaseher.exe	102
PID 4652 wrote to memory of 1540	4652	Flaseher.exe	102
PID 4652 wrote to memory of 1540	4652	Flaseher.exe	102
PID 4652 wrote to memory of 1540	4652	Flaseher.exe	102
PID 4652 wrote to memory of 1540	4652	Flaseher.exe	102
PID 4652 wrote to memory of 1540	4652	Flaseher.exe	102
PID 4652 wrote to memory of 1540	4652	Flaseher.exe	102
PID 4652 wrote to memory of 3720	4652	Flaseher.exe	103
PID 4652 wrote to memory of 3720	4652	Flaseher.exe	103
PID 4652 wrote to memory of 3720	4652	Flaseher.exe	103
PID 4652 wrote to memory of 3720	4652	Flaseher.exe	103
PID 4652 wrote to memory of 3720	4652	Flaseher.exe	103
PID 4652 wrote to memory of 3720	4652	Flaseher.exe	103
PID 4652 wrote to memory of 3720	4652	Flaseher.exe	103
PID 4652 wrote to memory of 3720	4652	Flaseher.exe	103
PID 3720 wrote to memory of 1528	3720	Flaseher.exe	104
PID 3720 wrote to memory of 1528	3720	Flaseher.exe	104
PID 3720 wrote to memory of 1528	3720	Flaseher.exe	104
PID 3720 wrote to memory of 644	3720	Flaseher.exe	105
PID 3720 wrote to memory of 644	3720	Flaseher.exe	105
PID 3720 wrote to memory of 644	3720	Flaseher.exe	105
PID 3720 wrote to memory of 4032	3720	Flaseher.exe	107
PID 3720 wrote to memory of 4032	3720	Flaseher.exe	107
PID 3720 wrote to memory of 4032	3720	Flaseher.exe	107
PID 3720 wrote to memory of 3980	3720	Flaseher.exe	108
PID 3720 wrote to memory of 3980	3720	Flaseher.exe	108
PID 3720 wrote to memory of 3980	3720	Flaseher.exe	108
PID 1528 wrote to memory of 2540	1528	cmd.exe	112
PID 1528 wrote to memory of 2540	1528	cmd.exe	112
PID 1528 wrote to memory of 2540	1528	cmd.exe	112
PID 3980 wrote to memory of 2488	3980	cmd.exe	113
PID 3980 wrote to memory of 2488	3980	cmd.exe	113
PID 3980 wrote to memory of 2488	3980	cmd.exe	113
PID 644 wrote to memory of 2352	644	cmd.exe	114
PID 644 wrote to memory of 2352	644	cmd.exe	114
PID 644 wrote to memory of 2352	644	cmd.exe	114
PID 4032 wrote to memory of 4600	4032	cmd.exe	115
PID 4032 wrote to memory of 4600	4032	cmd.exe	115
PID 4032 wrote to memory of 4600	4032	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_39c97da0a4b3a4b56950135f61a50405.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3696
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NBNYV.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:100
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:4788
- - C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe
    "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe
      "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1540
  - - C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe
      "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"
      4⤵
      Adds policy Run key to start application
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3720
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1528
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        6⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2540
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe:*:Enabled:Windows Messanger" /f
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:644
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe:*:Enabled:Windows Messanger" /f
        6⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2352
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4032
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        6⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4600
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\locsrv.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\locsrv.exe:*:Enabled:Windows Messanger" /f
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3980
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\locsrv.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\locsrv.exe:*:Enabled:Windows Messanger" /f
        6⤵
        Modifies firewall policy service
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NBNYV.txt

Filesize
145B

MD5
da0cbe87b720a79b294147ed6a4b98be

SHA1
ebf0dc9efd7a12cb192e355cda87546acb4ab360

SHA256
7ccfeff356fdccc9145bd1e263aa1c56360ca7b6552ed5a5665c596d02a627ed

SHA512
f55c4a3d24d2f11db5eda3c816d1cd3b8804a171a7bf715b13d60788247fbb352eafaa5bd4e0a8086c1013396be0a48c7bdb904ab0f974fa0c75e81e3d365acc

Download Submit
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe

Filesize
524KB

MD5
d8812a5db03d368b9d9fecb7a40ae60e

SHA1
e60921977e618a71340a1691f9a2bac7f7246cda

SHA256
89aad229f51fcb783098287a0aab9c74767a3755cd91bc82d029ea1001c51721

SHA512
1d95466f938197e6b66cd516a40f872ace5d06d3c4480b4ac9c4562730d74e441d2994d3754598782d14e37d9b8f3dbe0b128b0f1fa0f3e2818dea58e58cd728

Download Submit
memory/1540-58-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3696-45-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3696-4-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3696-6-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3696-8-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3696-57-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3720-68-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3720-75-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3720-46-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3720-89-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3720-84-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3720-82-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3720-80-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3720-59-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3720-63-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3720-66-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3720-77-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3720-70-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3720-73-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3720-39-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4524-2-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/4524-3-0x0000000002C80000-0x0000000002C81000-memory.dmp

Filesize
4KB

Download
memory/4652-34-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4652-52-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4652-35-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads