Malware Analysis Report

2025-05-28 17:56

Sample ID 250305-dze4lsxnt6
Target JaffaCakes118_504d832e46b462d51d3278d5a7071342
SHA256 35965c91141fb105ee30681ed1e382306d76763ccf71c884361c8a843e585af0
Tags
upx blackshades defense_evasion discovery persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

35965c91141fb105ee30681ed1e382306d76763ccf71c884361c8a843e585af0

Threat Level: Known bad

The file JaffaCakes118_504d832e46b462d51d3278d5a7071342 was found to be: Known bad.

Malicious Activity Summary

upx blackshades defense_evasion discovery persistence rat

Modifies firewall policy service

Blackshades family

Blackshades

Blackshades payload

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

UPX packed file

Suspicious use of SetThreadContext

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Modifies registry key

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-05 03:26

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-05 03:26

Reported

2025-03-05 03:29

Platform

win7-20240903-en

Max time kernel

149s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504d832e46b462d51d3278d5a7071342.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\winlogon.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\winlogon.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2764 set thread context of 2724 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 2764 set thread context of 600 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504d832e46b462d51d3278d5a7071342.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2480 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504d832e46b462d51d3278d5a7071342.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504d832e46b462d51d3278d5a7071342.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504d832e46b462d51d3278d5a7071342.exe C:\Windows\SysWOW64\cmd.exe
PID 2480 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504d832e46b462d51d3278d5a7071342.exe C:\Windows\SysWOW64\cmd.exe
PID 2420 wrote to memory of 2228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2420 wrote to memory of 2228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2420 wrote to memory of 2228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2420 wrote to memory of 2228 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2480 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504d832e46b462d51d3278d5a7071342.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 2480 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504d832e46b462d51d3278d5a7071342.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 2480 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504d832e46b462d51d3278d5a7071342.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 2480 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504d832e46b462d51d3278d5a7071342.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 2764 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 2764 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 2764 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 2764 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 2764 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 2764 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 2764 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 2764 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 2764 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 2764 wrote to memory of 600 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 2764 wrote to memory of 600 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 2764 wrote to memory of 600 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 2764 wrote to memory of 600 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 2764 wrote to memory of 600 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 2764 wrote to memory of 600 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 2764 wrote to memory of 600 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 2764 wrote to memory of 600 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 2724 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2724 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 2004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2772 wrote to memory of 2004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2772 wrote to memory of 2004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2772 wrote to memory of 2004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2656 wrote to memory of 680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2656 wrote to memory of 680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2656 wrote to memory of 680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2656 wrote to memory of 680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2596 wrote to memory of 2816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2596 wrote to memory of 2816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2596 wrote to memory of 2816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2596 wrote to memory of 2816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2644 wrote to memory of 1652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2644 wrote to memory of 1652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2644 wrote to memory of 1652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2644 wrote to memory of 1652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504d832e46b462d51d3278d5a7071342.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504d832e46b462d51d3278d5a7071342.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\APycO.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe" /f

C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe

"C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe"

C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe

C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe

C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe

C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 exray.no-ip.biz udp

Files

memory/2480-0-0x0000000000400000-0x0000000000987000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\APycO.bat

MD5 256dd6c177780c3382a971146427b339
SHA1 6cc1c2701d945e89986782f51fbc994b58c5d522
SHA256 7b4841e8b25f661db899d8de4715900334d96fc8e710caf8268af164f5cfbb0e
SHA512 9771f5864c07e18b29c41ba1c79bb59f3d69283b051504f5b92bb04b36c579f0842536807d4ad3f685cad4d2f24c3140458d0439d3e4e781d3c8cd3d081ca723

\Users\Admin\AppData\Roaming\Directory\winlogon.exe

MD5 504d832e46b462d51d3278d5a7071342
SHA1 442ec7914e788df4ec2ccd404fb6f2d6d898184f
SHA256 35965c91141fb105ee30681ed1e382306d76763ccf71c884361c8a843e585af0
SHA512 fb81c7293c5a88115384c479020e64d3d5ba2eb7d00d6db606c271698b9995defe5e4e7fd0739ec284812f4dea08e7beaeca5698ab32c0ddf987c2ffd535adc4

memory/2480-38-0x0000000004600000-0x0000000004B87000-memory.dmp

memory/2480-37-0x0000000000400000-0x0000000000987000-memory.dmp

memory/2480-36-0x0000000004600000-0x0000000004B87000-memory.dmp

memory/2480-34-0x0000000004600000-0x0000000004B87000-memory.dmp

memory/2764-40-0x0000000000400000-0x0000000000987000-memory.dmp

memory/2724-44-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2724-49-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2724-48-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2724-53-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2724-47-0x0000000000400000-0x0000000000475000-memory.dmp

memory/600-56-0x0000000000400000-0x0000000000407000-memory.dmp

memory/600-64-0x0000000000400000-0x0000000000407000-memory.dmp

memory/600-58-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2764-66-0x0000000000400000-0x0000000000987000-memory.dmp

memory/600-57-0x0000000000400000-0x0000000000407000-memory.dmp

memory/600-54-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2480-67-0x0000000004600000-0x0000000004B87000-memory.dmp

memory/2724-68-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2724-71-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2724-73-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2724-76-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2724-78-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2724-80-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2724-90-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2724-92-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2724-94-0x0000000000400000-0x0000000000475000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-03-05 03:26

Reported

2025-03-05 03:29

Platform

win10v2004-20250217-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504d832e46b462d51d3278d5a7071342.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\winlogon.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504d832e46b462d51d3278d5a7071342.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\winlogon.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1204 set thread context of 2948 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 1204 set thread context of 2156 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504d832e46b462d51d3278d5a7071342.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4600 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504d832e46b462d51d3278d5a7071342.exe C:\Windows\SysWOW64\cmd.exe
PID 4600 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504d832e46b462d51d3278d5a7071342.exe C:\Windows\SysWOW64\cmd.exe
PID 4600 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504d832e46b462d51d3278d5a7071342.exe C:\Windows\SysWOW64\cmd.exe
PID 2128 wrote to memory of 5004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2128 wrote to memory of 5004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2128 wrote to memory of 5004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4600 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504d832e46b462d51d3278d5a7071342.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 4600 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504d832e46b462d51d3278d5a7071342.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 4600 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504d832e46b462d51d3278d5a7071342.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 1204 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 1204 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 1204 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 1204 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 1204 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 1204 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 1204 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 1204 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 1204 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 1204 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 1204 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 1204 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 1204 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 1204 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 1204 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe
PID 2948 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 3304 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2544 wrote to memory of 220 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3304 wrote to memory of 4680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3304 wrote to memory of 4680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3304 wrote to memory of 4680 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1364 wrote to memory of 3272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1364 wrote to memory of 3272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1364 wrote to memory of 3272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4844 wrote to memory of 3000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4844 wrote to memory of 3000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4844 wrote to memory of 3000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504d832e46b462d51d3278d5a7071342.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504d832e46b462d51d3278d5a7071342.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oNleX.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe" /f

C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe

"C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe"

C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe

C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe

C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe

C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 exray.no-ip.biz udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/4600-0-0x0000000000400000-0x0000000000987000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\oNleX.bat

MD5 256dd6c177780c3382a971146427b339
SHA1 6cc1c2701d945e89986782f51fbc994b58c5d522
SHA256 7b4841e8b25f661db899d8de4715900334d96fc8e710caf8268af164f5cfbb0e
SHA512 9771f5864c07e18b29c41ba1c79bb59f3d69283b051504f5b92bb04b36c579f0842536807d4ad3f685cad4d2f24c3140458d0439d3e4e781d3c8cd3d081ca723

C:\Users\Admin\AppData\Roaming\Directory\winlogon.exe

MD5 504d832e46b462d51d3278d5a7071342
SHA1 442ec7914e788df4ec2ccd404fb6f2d6d898184f
SHA256 35965c91141fb105ee30681ed1e382306d76763ccf71c884361c8a843e585af0
SHA512 fb81c7293c5a88115384c479020e64d3d5ba2eb7d00d6db606c271698b9995defe5e4e7fd0739ec284812f4dea08e7beaeca5698ab32c0ddf987c2ffd535adc4

memory/4600-21-0x0000000000400000-0x0000000000987000-memory.dmp

memory/2948-22-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2948-29-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2948-26-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2948-25-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2156-35-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2156-34-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2156-33-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2156-30-0x0000000000400000-0x0000000000407000-memory.dmp

memory/1204-36-0x0000000000400000-0x0000000000987000-memory.dmp

memory/2156-38-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2156-37-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2948-45-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2156-46-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2948-47-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2948-49-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2948-51-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2948-54-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2948-56-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2948-61-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2948-68-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2948-70-0x0000000000400000-0x0000000000475000-memory.dmp