Malware Analysis Report

2025-05-28 17:57

Sample ID 250305-mg3avswthz
Target JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e
SHA256 6ea32525bdd7fb538e97a9ec22b4e7e8c4f3d062d04ec64224f19fef3f6b76f4
Tags
blackshades defense_evasion discovery rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6ea32525bdd7fb538e97a9ec22b4e7e8c4f3d062d04ec64224f19fef3f6b76f4

Threat Level: Known bad

The file JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e was found to be: Known bad.

Malicious Activity Summary

blackshades defense_evasion discovery rat

Blackshades payload

Blackshades

Blackshades family

Modifies firewall policy service

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Suspicious use of SetThreadContext

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Modifies registry key

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-05 10:27

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-05 10:27

Reported

2025-03-05 10:29

Platform

win7-20241023-en

Max time kernel

148s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\uncrypted.exe = "C:\\Users\\Admin\\AppData\\Roaming\\uncrypted.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\uncrypted.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uncrypted.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2596 set thread context of 2108 N/A C:\Users\Admin\AppData\Local\Temp\uncrypted.exe C:\Users\Admin\AppData\Roaming\WinSec.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\setup (2).exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\is-URSGV.tmp\setup (2).tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\uncrypted.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2604 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe C:\Users\Admin\AppData\Local\Temp\uncrypted.exe
PID 2604 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe C:\Users\Admin\AppData\Local\Temp\uncrypted.exe
PID 2604 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe C:\Users\Admin\AppData\Local\Temp\uncrypted.exe
PID 2604 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe C:\Users\Admin\AppData\Local\Temp\uncrypted.exe
PID 2604 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe C:\Users\Admin\AppData\Local\Temp\setup (2).exe
PID 2604 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe C:\Users\Admin\AppData\Local\Temp\setup (2).exe
PID 2604 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe C:\Users\Admin\AppData\Local\Temp\setup (2).exe
PID 2604 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe C:\Users\Admin\AppData\Local\Temp\setup (2).exe
PID 2604 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe C:\Users\Admin\AppData\Local\Temp\setup (2).exe
PID 2604 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe C:\Users\Admin\AppData\Local\Temp\setup (2).exe
PID 2604 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe C:\Users\Admin\AppData\Local\Temp\setup (2).exe
PID 2596 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\uncrypted.exe C:\Users\Admin\AppData\Roaming\WinSec.exe
PID 2596 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\uncrypted.exe C:\Users\Admin\AppData\Roaming\WinSec.exe
PID 2596 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\uncrypted.exe C:\Users\Admin\AppData\Roaming\WinSec.exe
PID 2596 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\uncrypted.exe C:\Users\Admin\AppData\Roaming\WinSec.exe
PID 2596 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\uncrypted.exe C:\Users\Admin\AppData\Roaming\WinSec.exe
PID 2596 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\uncrypted.exe C:\Users\Admin\AppData\Roaming\WinSec.exe
PID 2596 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\uncrypted.exe C:\Users\Admin\AppData\Roaming\WinSec.exe
PID 2596 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\uncrypted.exe C:\Users\Admin\AppData\Roaming\WinSec.exe
PID 2596 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\uncrypted.exe C:\Users\Admin\AppData\Roaming\WinSec.exe
PID 2596 wrote to memory of 2108 N/A C:\Users\Admin\AppData\Local\Temp\uncrypted.exe C:\Users\Admin\AppData\Roaming\WinSec.exe
PID 2548 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\setup (2).exe C:\Users\Admin\AppData\Local\Temp\is-URSGV.tmp\setup (2).tmp
PID 2548 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\setup (2).exe C:\Users\Admin\AppData\Local\Temp\is-URSGV.tmp\setup (2).tmp
PID 2548 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\setup (2).exe C:\Users\Admin\AppData\Local\Temp\is-URSGV.tmp\setup (2).tmp
PID 2548 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\setup (2).exe C:\Users\Admin\AppData\Local\Temp\is-URSGV.tmp\setup (2).tmp
PID 2548 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\setup (2).exe C:\Users\Admin\AppData\Local\Temp\is-URSGV.tmp\setup (2).tmp
PID 2548 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\setup (2).exe C:\Users\Admin\AppData\Local\Temp\is-URSGV.tmp\setup (2).tmp
PID 2548 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\setup (2).exe C:\Users\Admin\AppData\Local\Temp\is-URSGV.tmp\setup (2).tmp
PID 2108 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 2704 wrote to memory of 2340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2704 wrote to memory of 2340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2704 wrote to memory of 2340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2704 wrote to memory of 2340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2816 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2816 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2816 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2816 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1356 wrote to memory of 1732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1356 wrote to memory of 1732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1356 wrote to memory of 1732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1356 wrote to memory of 1732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2708 wrote to memory of 676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2708 wrote to memory of 676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2708 wrote to memory of 676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2708 wrote to memory of 676 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe"

C:\Users\Admin\AppData\Local\Temp\uncrypted.exe

"C:\Users\Admin\AppData\Local\Temp\uncrypted.exe"

C:\Users\Admin\AppData\Roaming\WinSec.exe

C:\Users\Admin\AppData\Roaming\WinSec.exe

C:\Users\Admin\AppData\Local\Temp\setup (2).exe

"C:\Users\Admin\AppData\Local\Temp\setup (2).exe"

C:\Users\Admin\AppData\Local\Temp\is-URSGV.tmp\setup (2).tmp

"C:\Users\Admin\AppData\Local\Temp\is-URSGV.tmp\setup (2).tmp" /SL5="$6015E,402752,54272,C:\Users\Admin\AppData\Local\Temp\setup (2).exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\uncrypted.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\uncrypted.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\uncrypted.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\uncrypted.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\uncrypted.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\uncrypted.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\uncrypted.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\uncrypted.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 russianmafia.no-ip.biz udp
FR 78.159.135.230:7410 russianmafia.no-ip.biz tcp
FR 78.159.135.230:7410 russianmafia.no-ip.biz tcp
US 8.8.8.8:53 1russianmafia.no-ip.biz udp
US 8.8.8.8:53 2russianmafia.no-ip.biz udp
US 8.8.8.8:53 3russianmafia.no-ip.biz udp
FR 78.159.135.230:7410 3russianmafia.no-ip.biz tcp
US 8.8.8.8:53 4russianmafia.no-ip.biz udp
US 8.8.8.8:53 5russianmafia.no-ip.biz udp
US 8.8.8.8:53 6russianmafia.no-ip.biz udp
US 8.8.8.8:53 7russianmafia.no-ip.biz udp
US 8.8.8.8:53 8russianmafia.no-ip.biz udp

Files

memory/2604-0-0x0000000074331000-0x0000000074332000-memory.dmp

memory/2604-1-0x0000000074330000-0x00000000748DB000-memory.dmp

memory/2604-2-0x0000000074330000-0x00000000748DB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\uncrypted.exe

MD5 05a388d845a9457b468e6eef880b0696
SHA1 9f5c19ba4b2ae0a4302efd0e5cc289cef8ebacc5
SHA256 304165716e3060cf31c91504432ab191604890e3c487a568a21d15eaae231a14
SHA512 7f5102543c5dbb296224b304eb2a3ef0c150171429e38780b092480a1fed0a2d541684a0f0453d5aa393221261695795e53d5f779c7ce1721cafb5fb85a89250

\Users\Admin\AppData\Roaming\WinSec.exe

MD5 ed797d8dc2c92401985d162e42ffa450
SHA1 0f02fc517c7facc4baefde4fe9467fb6488ebabe
SHA256 b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e
SHA512 e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

memory/2596-20-0x0000000074330000-0x00000000748DB000-memory.dmp

\Users\Admin\AppData\Local\Temp\setup (2).exe

MD5 2c3e4950bf80b2098dce2f57b81a6611
SHA1 bc665b0584dad1e9187d52ecc35449c299e36888
SHA256 46ca5acf36f5864c677c9ccbbdffa44f3451974283e8d645834c55f4e64b4486
SHA512 d904563c9b612d1d7c655398fac5766addde83212d6df18889f28f2864d30ad20758877418fa662f1b44eeacbbba61d379690a26e596652def911cf94d50d7fc

memory/2596-21-0x0000000074330000-0x00000000748DB000-memory.dmp

memory/2596-17-0x0000000074330000-0x00000000748DB000-memory.dmp

memory/2108-29-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2108-37-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2108-43-0x0000000000020000-0x0000000000021000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-URSGV.tmp\setup (2).tmp

MD5 c765336f0dcf4efdcc2101eed67cd30c
SHA1 fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256 c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA512 06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

\Users\Admin\AppData\Local\Temp\is-DAGSJ.tmp\isskin.dll

MD5 b31ad1bacfd7c51f35e052b8c7047d44
SHA1 ba58ae4a4a28cd2a4c2a7b85d260e105fa6e79de
SHA256 117ae53cf3e8bc95e6297a15d8365efd792da04df90744d4e244bbf72075ccc3
SHA512 2a4c0d3f7065a9272bd70e8fd121e80d9c4e3d9089285841b245790f4789704c27cb88333ddbf3bbecbc26af926b7ffd7a722352c7f418c84a9087cb1a748368

\Users\Admin\AppData\Local\Temp\is-DAGSJ.tmp\Office2007.cjstyles

MD5 663ce82c52435d68e20910f6a7252725
SHA1 ef6719db6ec6209dd832d0a336ddccef87343a4d
SHA256 b097cc6db98c456381b1c2f5e4827dde3480c2f0e9561cae81d33d5efd8104ed
SHA512 86be243024e0c055d13516c8568090f3fc5347fd0d6764be8c64f08c753c1f3cc4db00af5c2746e97c74e2f01292b5bcc855a2b94b8cb95cacfd53dd66b28fa0

memory/2812-74-0x0000000075340000-0x00000000753E0000-memory.dmp

memory/2812-73-0x0000000075540000-0x00000000755DD000-memory.dmp

memory/2812-75-0x0000000074F90000-0x000000007501F000-memory.dmp

memory/2812-77-0x0000000076910000-0x0000000076967000-memory.dmp

memory/2812-76-0x00000000753E0000-0x000000007553C000-memory.dmp

memory/2596-70-0x0000000074330000-0x00000000748DB000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-DAGSJ.tmp\_isetup\_shfoldr.dll

MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

memory/2812-85-0x0000000074F90000-0x000000007501F000-memory.dmp

memory/2812-84-0x0000000075340000-0x00000000753E0000-memory.dmp

memory/2812-98-0x0000000075340000-0x00000000753E0000-memory.dmp

memory/2812-126-0x0000000076910000-0x0000000076967000-memory.dmp

memory/2812-121-0x0000000075340000-0x00000000753E0000-memory.dmp

memory/2812-117-0x00000000724F0000-0x000000007257C000-memory.dmp

memory/2812-114-0x0000000076910000-0x0000000076967000-memory.dmp

memory/2812-111-0x0000000072760000-0x0000000072772000-memory.dmp

memory/2812-107-0x00000000724F0000-0x000000007257C000-memory.dmp

memory/2812-124-0x0000000074AE0000-0x0000000074AE9000-memory.dmp

memory/2812-123-0x0000000072760000-0x0000000072772000-memory.dmp

memory/2812-122-0x0000000074F90000-0x000000007501F000-memory.dmp

memory/2812-120-0x0000000075540000-0x00000000755DD000-memory.dmp

memory/2812-119-0x0000000010000000-0x000000001005B000-memory.dmp

memory/2812-118-0x00000000724B0000-0x00000000724E2000-memory.dmp

memory/2812-116-0x0000000076CE0000-0x0000000076D63000-memory.dmp

memory/2812-113-0x00000000727C0000-0x000000007295E000-memory.dmp

memory/2812-112-0x0000000074AE0000-0x0000000074AE9000-memory.dmp

memory/2812-110-0x0000000075340000-0x00000000753E0000-memory.dmp

memory/2812-109-0x0000000010000000-0x000000001005B000-memory.dmp

memory/2812-108-0x00000000724B0000-0x00000000724E2000-memory.dmp

memory/2812-106-0x0000000076CE0000-0x0000000076D63000-memory.dmp

memory/2812-105-0x00000000748F0000-0x0000000074903000-memory.dmp

memory/2812-103-0x0000000076D70000-0x0000000076DEB000-memory.dmp

memory/2812-101-0x00000000727C0000-0x000000007295E000-memory.dmp

memory/2812-100-0x0000000072760000-0x0000000072772000-memory.dmp

memory/2812-90-0x0000000075A50000-0x000000007669A000-memory.dmp

memory/2812-88-0x00000000727C0000-0x000000007295E000-memory.dmp

memory/2812-102-0x0000000076910000-0x0000000076967000-memory.dmp

memory/2812-99-0x0000000074F90000-0x000000007501F000-memory.dmp

memory/2812-97-0x0000000075540000-0x00000000755DD000-memory.dmp

memory/2812-96-0x0000000010000000-0x000000001005B000-memory.dmp

memory/2812-95-0x00000000724B0000-0x00000000724E2000-memory.dmp

memory/2812-94-0x0000000076CE0000-0x0000000076D63000-memory.dmp

memory/2812-91-0x0000000076D70000-0x0000000076DEB000-memory.dmp

memory/2812-89-0x0000000076910000-0x0000000076967000-memory.dmp

memory/2812-83-0x0000000010000000-0x000000001005B000-memory.dmp

memory/2812-82-0x00000000724B0000-0x00000000724E2000-memory.dmp

memory/2812-81-0x0000000075820000-0x000000007584A000-memory.dmp

memory/2812-79-0x00000000725A0000-0x00000000726BC000-memory.dmp

memory/2812-87-0x0000000074AE0000-0x0000000074AE9000-memory.dmp

memory/2812-86-0x00000000753E0000-0x000000007553C000-memory.dmp

memory/2812-78-0x0000000075A50000-0x000000007669A000-memory.dmp

memory/2812-80-0x00000000724F0000-0x000000007257C000-memory.dmp

memory/2604-56-0x0000000074330000-0x00000000748DB000-memory.dmp

memory/2108-55-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2548-39-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2108-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2108-33-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2108-31-0x0000000000400000-0x0000000000471000-memory.dmp

memory/2108-300-0x0000000000400000-0x0000000000471000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-03-05 10:27

Reported

2025-03-05 10:29

Platform

win10v2004-20250217-en

Max time kernel

148s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\uncrypted.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uncrypted.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\uncrypted.exe = "C:\\Users\\Admin\\AppData\\Roaming\\uncrypted.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 392 set thread context of 4120 N/A C:\Users\Admin\AppData\Local\Temp\uncrypted.exe C:\Users\Admin\AppData\Roaming\WinSec.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\uncrypted.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\setup (2).exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\is-CFP4K.tmp\setup (2).tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\WinSec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4244 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe C:\Users\Admin\AppData\Local\Temp\uncrypted.exe
PID 4244 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe C:\Users\Admin\AppData\Local\Temp\uncrypted.exe
PID 4244 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe C:\Users\Admin\AppData\Local\Temp\uncrypted.exe
PID 4244 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe C:\Users\Admin\AppData\Local\Temp\setup (2).exe
PID 4244 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe C:\Users\Admin\AppData\Local\Temp\setup (2).exe
PID 4244 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe C:\Users\Admin\AppData\Local\Temp\setup (2).exe
PID 392 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\uncrypted.exe C:\Users\Admin\AppData\Roaming\WinSec.exe
PID 392 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\uncrypted.exe C:\Users\Admin\AppData\Roaming\WinSec.exe
PID 392 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\uncrypted.exe C:\Users\Admin\AppData\Roaming\WinSec.exe
PID 392 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\uncrypted.exe C:\Users\Admin\AppData\Roaming\WinSec.exe
PID 392 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\uncrypted.exe C:\Users\Admin\AppData\Roaming\WinSec.exe
PID 392 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\uncrypted.exe C:\Users\Admin\AppData\Roaming\WinSec.exe
PID 392 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\uncrypted.exe C:\Users\Admin\AppData\Roaming\WinSec.exe
PID 392 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\uncrypted.exe C:\Users\Admin\AppData\Roaming\WinSec.exe
PID 392 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\uncrypted.exe C:\Users\Admin\AppData\Roaming\WinSec.exe
PID 392 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\uncrypted.exe C:\Users\Admin\AppData\Roaming\WinSec.exe
PID 1928 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\setup (2).exe C:\Users\Admin\AppData\Local\Temp\is-CFP4K.tmp\setup (2).tmp
PID 1928 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\setup (2).exe C:\Users\Admin\AppData\Local\Temp\is-CFP4K.tmp\setup (2).tmp
PID 1928 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\setup (2).exe C:\Users\Admin\AppData\Local\Temp\is-CFP4K.tmp\setup (2).tmp
PID 4120 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 112 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 112 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 112 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 744 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 744 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 744 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 4120 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Roaming\WinSec.exe C:\Windows\SysWOW64\cmd.exe
PID 744 wrote to memory of 4484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 744 wrote to memory of 4484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 744 wrote to memory of 4484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3528 wrote to memory of 4032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3528 wrote to memory of 4032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3528 wrote to memory of 4032 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4516 wrote to memory of 232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4516 wrote to memory of 232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4516 wrote to memory of 232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 112 wrote to memory of 2124 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 112 wrote to memory of 2124 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 112 wrote to memory of 2124 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51ac72aa5af11079f2c2ca22d0bf036e.exe"

C:\Users\Admin\AppData\Local\Temp\uncrypted.exe

"C:\Users\Admin\AppData\Local\Temp\uncrypted.exe"

C:\Users\Admin\AppData\Local\Temp\setup (2).exe

"C:\Users\Admin\AppData\Local\Temp\setup (2).exe"

C:\Users\Admin\AppData\Roaming\WinSec.exe

C:\Users\Admin\AppData\Roaming\WinSec.exe

C:\Users\Admin\AppData\Local\Temp\is-CFP4K.tmp\setup (2).tmp

"C:\Users\Admin\AppData\Local\Temp\is-CFP4K.tmp\setup (2).tmp" /SL5="$60236,402752,54272,C:\Users\Admin\AppData\Local\Temp\setup (2).exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\uncrypted.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\uncrypted.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\uncrypted.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\uncrypted.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\uncrypted.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\uncrypted.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\uncrypted.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\uncrypted.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 russianmafia.no-ip.biz udp
FR 78.159.135.230:7410 russianmafia.no-ip.biz tcp
FR 78.159.135.230:7410 russianmafia.no-ip.biz tcp
US 8.8.8.8:53 1russianmafia.no-ip.biz udp
US 8.8.8.8:53 2russianmafia.no-ip.biz udp
US 8.8.8.8:53 3russianmafia.no-ip.biz udp
FR 78.159.135.230:7410 3russianmafia.no-ip.biz tcp
US 8.8.8.8:53 4russianmafia.no-ip.biz udp
US 8.8.8.8:53 5russianmafia.no-ip.biz udp
US 8.8.8.8:53 6russianmafia.no-ip.biz udp
US 150.171.27.10:443 g.bing.com tcp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 7russianmafia.no-ip.biz udp
US 8.8.8.8:53 8russianmafia.no-ip.biz udp

Files

memory/4244-0-0x0000000074E62000-0x0000000074E63000-memory.dmp

memory/4244-1-0x0000000074E60000-0x0000000075411000-memory.dmp

memory/4244-2-0x0000000074E60000-0x0000000075411000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\uncrypted.exe

MD5 05a388d845a9457b468e6eef880b0696
SHA1 9f5c19ba4b2ae0a4302efd0e5cc289cef8ebacc5
SHA256 304165716e3060cf31c91504432ab191604890e3c487a568a21d15eaae231a14
SHA512 7f5102543c5dbb296224b304eb2a3ef0c150171429e38780b092480a1fed0a2d541684a0f0453d5aa393221261695795e53d5f779c7ce1721cafb5fb85a89250

C:\Users\Admin\AppData\Local\Temp\setup (2).exe

MD5 2c3e4950bf80b2098dce2f57b81a6611
SHA1 bc665b0584dad1e9187d52ecc35449c299e36888
SHA256 46ca5acf36f5864c677c9ccbbdffa44f3451974283e8d645834c55f4e64b4486
SHA512 d904563c9b612d1d7c655398fac5766addde83212d6df18889f28f2864d30ad20758877418fa662f1b44eeacbbba61d379690a26e596652def911cf94d50d7fc

memory/392-32-0x0000000074E60000-0x0000000075411000-memory.dmp

C:\Users\Admin\AppData\Roaming\WinSec.exe

MD5 e118330b4629b12368d91b9df6488be0
SHA1 ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA256 3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
SHA512 ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

memory/4120-43-0x0000000000400000-0x0000000000471000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-CFP4K.tmp\setup (2).tmp

MD5 c765336f0dcf4efdcc2101eed67cd30c
SHA1 fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256 c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA512 06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

C:\Users\Admin\AppData\Local\Temp\is-45PQJ.tmp\isskin.dll

MD5 b31ad1bacfd7c51f35e052b8c7047d44
SHA1 ba58ae4a4a28cd2a4c2a7b85d260e105fa6e79de
SHA256 117ae53cf3e8bc95e6297a15d8365efd792da04df90744d4e244bbf72075ccc3
SHA512 2a4c0d3f7065a9272bd70e8fd121e80d9c4e3d9089285841b245790f4789704c27cb88333ddbf3bbecbc26af926b7ffd7a722352c7f418c84a9087cb1a748368

memory/116-87-0x00000000758A0000-0x0000000075E53000-memory.dmp

memory/116-90-0x0000000010000000-0x000000001005B000-memory.dmp

memory/116-126-0x00000000758A0000-0x0000000075E53000-memory.dmp

memory/116-124-0x0000000072A40000-0x0000000072B64000-memory.dmp

memory/116-125-0x0000000010000000-0x000000001005B000-memory.dmp

memory/116-120-0x00000000758A0000-0x0000000075E53000-memory.dmp

memory/116-123-0x0000000073BE0000-0x0000000073C54000-memory.dmp

memory/116-122-0x00000000725A0000-0x00000000727B0000-memory.dmp

memory/116-121-0x0000000076B90000-0x0000000076C3F000-memory.dmp

memory/116-119-0x00000000768D0000-0x00000000769B3000-memory.dmp

memory/116-114-0x00000000725A0000-0x00000000727B0000-memory.dmp

memory/116-118-0x0000000077120000-0x00000000771FC000-memory.dmp

memory/116-117-0x0000000010000000-0x000000001005B000-memory.dmp

memory/116-116-0x0000000072A40000-0x0000000072B64000-memory.dmp

memory/116-115-0x0000000073BE0000-0x0000000073C54000-memory.dmp

memory/116-112-0x00000000758A0000-0x0000000075E53000-memory.dmp

memory/116-111-0x0000000010000000-0x000000001005B000-memory.dmp

memory/116-110-0x0000000072A40000-0x0000000072B64000-memory.dmp

memory/116-109-0x0000000073BE0000-0x0000000073C54000-memory.dmp

memory/116-108-0x00000000775A0000-0x00000000775C5000-memory.dmp

memory/116-106-0x0000000076B90000-0x0000000076C3F000-memory.dmp

memory/116-105-0x00000000758A0000-0x0000000075E53000-memory.dmp

memory/116-104-0x0000000010000000-0x000000001005B000-memory.dmp

memory/116-103-0x0000000072A40000-0x0000000072B64000-memory.dmp

memory/116-102-0x0000000073BE0000-0x0000000073C54000-memory.dmp

memory/116-101-0x00000000725A0000-0x00000000727B0000-memory.dmp

memory/116-100-0x0000000076B90000-0x0000000076C3F000-memory.dmp

memory/116-99-0x00000000758A0000-0x0000000075E53000-memory.dmp

memory/116-98-0x0000000010000000-0x000000001005B000-memory.dmp

memory/116-97-0x0000000072A40000-0x0000000072B64000-memory.dmp

memory/116-96-0x0000000073BE0000-0x0000000073C54000-memory.dmp

memory/116-95-0x00000000725A0000-0x00000000727B0000-memory.dmp

memory/116-94-0x0000000076B90000-0x0000000076C3F000-memory.dmp

memory/116-93-0x00000000758A0000-0x0000000075E53000-memory.dmp

memory/116-92-0x00000000768D0000-0x00000000769B3000-memory.dmp

memory/116-91-0x0000000077120000-0x00000000771FC000-memory.dmp

memory/116-89-0x00000000725A0000-0x00000000727B0000-memory.dmp

memory/116-127-0x00000000725A0000-0x00000000727B0000-memory.dmp

memory/116-113-0x0000000076B90000-0x0000000076C3F000-memory.dmp

memory/116-107-0x00000000725A0000-0x00000000727B0000-memory.dmp

memory/116-88-0x0000000076B90000-0x0000000076C3F000-memory.dmp

memory/116-86-0x00000000768D0000-0x00000000769B3000-memory.dmp

memory/116-85-0x0000000010000000-0x000000001005B000-memory.dmp

memory/116-84-0x0000000072A40000-0x0000000072B64000-memory.dmp

memory/116-83-0x0000000010000000-0x000000001005B000-memory.dmp

memory/116-82-0x00000000775A0000-0x00000000775C5000-memory.dmp

memory/116-81-0x0000000010000000-0x000000001005B000-memory.dmp

memory/116-80-0x0000000010000000-0x000000001005B000-memory.dmp

memory/116-79-0x00000000775A0000-0x00000000775C5000-memory.dmp

memory/116-78-0x0000000076FB0000-0x000000007702A000-memory.dmp

memory/116-77-0x0000000010000000-0x000000001005B000-memory.dmp

memory/116-76-0x00000000775A0000-0x00000000775C5000-memory.dmp

memory/116-75-0x0000000076FB0000-0x000000007702A000-memory.dmp

memory/116-74-0x0000000010000000-0x000000001005B000-memory.dmp

memory/116-72-0x0000000010000000-0x000000001005B000-memory.dmp

memory/116-71-0x0000000076FB0000-0x000000007702A000-memory.dmp

memory/116-70-0x0000000010000000-0x000000001005B000-memory.dmp

memory/116-69-0x0000000076FB0000-0x000000007702A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-45PQJ.tmp\Office2007.cjstyles

MD5 663ce82c52435d68e20910f6a7252725
SHA1 ef6719db6ec6209dd832d0a336ddccef87343a4d
SHA256 b097cc6db98c456381b1c2f5e4827dde3480c2f0e9561cae81d33d5efd8104ed
SHA512 86be243024e0c055d13516c8568090f3fc5347fd0d6764be8c64f08c753c1f3cc4db00af5c2746e97c74e2f01292b5bcc855a2b94b8cb95cacfd53dd66b28fa0

memory/116-73-0x0000000076FB0000-0x000000007702A000-memory.dmp

memory/392-49-0x0000000074E60000-0x0000000075411000-memory.dmp

memory/4120-39-0x0000000000400000-0x0000000000471000-memory.dmp

memory/1928-38-0x0000000000401000-0x000000000040B000-memory.dmp

memory/4244-34-0x0000000074E60000-0x0000000075411000-memory.dmp

memory/1928-30-0x0000000000400000-0x0000000000414000-memory.dmp

memory/392-26-0x0000000074E60000-0x0000000075411000-memory.dmp

memory/4120-209-0x0000000000400000-0x0000000000471000-memory.dmp