Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
06/03/2025, 23:01
Behavioral task
behavioral1
Sample
24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe
Resource
win10v2004-20250217-en
General
-
Target
24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe
-
Size
2.0MB
-
MD5
74559bd400d5ec38948f032fcc075ce2
-
SHA1
f72d4a67eb021c4373527d50b7a441ec34f4fb93
-
SHA256
24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d
-
SHA512
691e81266125de0ce21a408b06e69b8ca3d6d323a36dbc7d3dbae4d819eed6dece84d8d8d11bdacde192ce4376101b08bddf19712b650b472fe441407c71a95e
-
SSDEEP
49152:MsThC6TYNwUXz+JR2wjx8+X5gZ+th1aaucQPfM7cSCGDt7WWcrRhajx3l7bQonW7:MsThC6TYNwUXz+JR2wjx8+JgZ+th1aa0
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 14 IoCs
resource yara_rule behavioral1/memory/2760-53-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2760-69-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2760-71-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2760-75-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2760-78-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2760-80-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2760-82-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2760-85-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2760-87-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2760-89-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2760-92-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2760-94-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2760-96-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2760-99-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\Windowsdef.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Executes dropped EXE 3 IoCs
pid Process 2920 Windowsdef.exe 2760 Windowsdef.exe 2820 Windowsdef.exe -
Loads dropped DLL 5 IoCs
pid Process 2936 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe 2936 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe 2936 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe 2936 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe 2936 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDef = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\Windowsdef.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2920 set thread context of 2760 2920 Windowsdef.exe 33 PID 2920 set thread context of 2820 2920 Windowsdef.exe 34 -
resource yara_rule behavioral1/memory/2936-0-0x0000000000400000-0x00000000005FD000-memory.dmp upx behavioral1/files/0x0009000000019394-27.dat upx behavioral1/memory/2936-44-0x00000000030F0000-0x00000000032ED000-memory.dmp upx behavioral1/memory/2936-43-0x0000000000400000-0x00000000005FD000-memory.dmp upx behavioral1/memory/2920-47-0x0000000000400000-0x00000000005FD000-memory.dmp upx behavioral1/memory/2760-49-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2760-53-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2760-52-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2820-54-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2820-62-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2820-61-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2920-60-0x0000000000400000-0x00000000005FD000-memory.dmp upx behavioral1/memory/2820-59-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2760-69-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2820-70-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2760-71-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2760-75-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2760-78-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2760-80-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2760-82-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2760-85-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2760-87-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2760-89-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2760-92-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2760-94-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2760-96-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2760-99-0x0000000000400000-0x000000000045C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windowsdef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windowsdef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windowsdef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 432 reg.exe 2012 reg.exe 1140 reg.exe 2348 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 2760 Windowsdef.exe Token: SeCreateTokenPrivilege 2760 Windowsdef.exe Token: SeAssignPrimaryTokenPrivilege 2760 Windowsdef.exe Token: SeLockMemoryPrivilege 2760 Windowsdef.exe Token: SeIncreaseQuotaPrivilege 2760 Windowsdef.exe Token: SeMachineAccountPrivilege 2760 Windowsdef.exe Token: SeTcbPrivilege 2760 Windowsdef.exe Token: SeSecurityPrivilege 2760 Windowsdef.exe Token: SeTakeOwnershipPrivilege 2760 Windowsdef.exe Token: SeLoadDriverPrivilege 2760 Windowsdef.exe Token: SeSystemProfilePrivilege 2760 Windowsdef.exe Token: SeSystemtimePrivilege 2760 Windowsdef.exe Token: SeProfSingleProcessPrivilege 2760 Windowsdef.exe Token: SeIncBasePriorityPrivilege 2760 Windowsdef.exe Token: SeCreatePagefilePrivilege 2760 Windowsdef.exe Token: SeCreatePermanentPrivilege 2760 Windowsdef.exe Token: SeBackupPrivilege 2760 Windowsdef.exe Token: SeRestorePrivilege 2760 Windowsdef.exe Token: SeShutdownPrivilege 2760 Windowsdef.exe Token: SeDebugPrivilege 2760 Windowsdef.exe Token: SeAuditPrivilege 2760 Windowsdef.exe Token: SeSystemEnvironmentPrivilege 2760 Windowsdef.exe Token: SeChangeNotifyPrivilege 2760 Windowsdef.exe Token: SeRemoteShutdownPrivilege 2760 Windowsdef.exe Token: SeUndockPrivilege 2760 Windowsdef.exe Token: SeSyncAgentPrivilege 2760 Windowsdef.exe Token: SeEnableDelegationPrivilege 2760 Windowsdef.exe Token: SeManageVolumePrivilege 2760 Windowsdef.exe Token: SeImpersonatePrivilege 2760 Windowsdef.exe Token: SeCreateGlobalPrivilege 2760 Windowsdef.exe Token: 31 2760 Windowsdef.exe Token: 32 2760 Windowsdef.exe Token: 33 2760 Windowsdef.exe Token: 34 2760 Windowsdef.exe Token: 35 2760 Windowsdef.exe Token: SeDebugPrivilege 2820 Windowsdef.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2936 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe 2920 Windowsdef.exe 2760 Windowsdef.exe 2760 Windowsdef.exe 2820 Windowsdef.exe 2760 Windowsdef.exe -
Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 2936 wrote to memory of 640 2936 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe 29 PID 2936 wrote to memory of 640 2936 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe 29 PID 2936 wrote to memory of 640 2936 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe 29 PID 2936 wrote to memory of 640 2936 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe 29 PID 640 wrote to memory of 3008 640 cmd.exe 31 PID 640 wrote to memory of 3008 640 cmd.exe 31 PID 640 wrote to memory of 3008 640 cmd.exe 31 PID 640 wrote to memory of 3008 640 cmd.exe 31 PID 2936 wrote to memory of 2920 2936 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe 32 PID 2936 wrote to memory of 2920 2936 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe 32 PID 2936 wrote to memory of 2920 2936 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe 32 PID 2936 wrote to memory of 2920 2936 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe 32 PID 2920 wrote to memory of 2760 2920 Windowsdef.exe 33 PID 2920 wrote to memory of 2760 2920 Windowsdef.exe 33 PID 2920 wrote to memory of 2760 2920 Windowsdef.exe 33 PID 2920 wrote to memory of 2760 2920 Windowsdef.exe 33 PID 2920 wrote to memory of 2760 2920 Windowsdef.exe 33 PID 2920 wrote to memory of 2760 2920 Windowsdef.exe 33 PID 2920 wrote to memory of 2760 2920 Windowsdef.exe 33 PID 2920 wrote to memory of 2760 2920 Windowsdef.exe 33 PID 2920 wrote to memory of 2760 2920 Windowsdef.exe 33 PID 2920 wrote to memory of 2820 2920 Windowsdef.exe 34 PID 2920 wrote to memory of 2820 2920 Windowsdef.exe 34 PID 2920 wrote to memory of 2820 2920 Windowsdef.exe 34 PID 2920 wrote to memory of 2820 2920 Windowsdef.exe 34 PID 2920 wrote to memory of 2820 2920 Windowsdef.exe 34 PID 2920 wrote to memory of 2820 2920 Windowsdef.exe 34 PID 2920 wrote to memory of 2820 2920 Windowsdef.exe 34 PID 2920 wrote to memory of 2820 2920 Windowsdef.exe 34 PID 2920 wrote to memory of 2820 2920 Windowsdef.exe 34 PID 2760 wrote to memory of 944 2760 Windowsdef.exe 35 PID 2760 wrote to memory of 944 2760 Windowsdef.exe 35 PID 2760 wrote to memory of 944 2760 Windowsdef.exe 35 PID 2760 wrote to memory of 944 2760 Windowsdef.exe 35 PID 2760 wrote to memory of 2928 2760 Windowsdef.exe 36 PID 2760 wrote to memory of 2928 2760 Windowsdef.exe 36 PID 2760 wrote to memory of 2928 2760 Windowsdef.exe 36 PID 2760 wrote to memory of 2928 2760 Windowsdef.exe 36 PID 2760 wrote to memory of 2320 2760 Windowsdef.exe 38 PID 2760 wrote to memory of 2320 2760 Windowsdef.exe 38 PID 2760 wrote to memory of 2320 2760 Windowsdef.exe 38 PID 2760 wrote to memory of 2320 2760 Windowsdef.exe 38 PID 2760 wrote to memory of 388 2760 Windowsdef.exe 40 PID 2760 wrote to memory of 388 2760 Windowsdef.exe 40 PID 2760 wrote to memory of 388 2760 Windowsdef.exe 40 PID 2760 wrote to memory of 388 2760 Windowsdef.exe 40 PID 388 wrote to memory of 1140 388 cmd.exe 43 PID 388 wrote to memory of 1140 388 cmd.exe 43 PID 388 wrote to memory of 1140 388 cmd.exe 43 PID 388 wrote to memory of 1140 388 cmd.exe 43 PID 2320 wrote to memory of 2012 2320 cmd.exe 44 PID 2320 wrote to memory of 2012 2320 cmd.exe 44 PID 2320 wrote to memory of 2012 2320 cmd.exe 44 PID 2320 wrote to memory of 2012 2320 cmd.exe 44 PID 2928 wrote to memory of 432 2928 cmd.exe 45 PID 2928 wrote to memory of 432 2928 cmd.exe 45 PID 2928 wrote to memory of 432 2928 cmd.exe 45 PID 2928 wrote to memory of 432 2928 cmd.exe 45 PID 944 wrote to memory of 2348 944 cmd.exe 46 PID 944 wrote to memory of 2348 944 cmd.exe 46 PID 944 wrote to memory of 2348 944 cmd.exe 46 PID 944 wrote to memory of 2348 944 cmd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe"C:\Users\Admin\AppData\Local\Temp\24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\PKJEp.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDef" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3008
-
-
-
C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe"C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exeC:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2348
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:432
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2012
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1140
-
-
-
-
C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exeC:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2820
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5130a1ad614bfc1851533b7a02e302622
SHA16cd68d0bacb7b24ca9baedc80d90f1bfca3bb92c
SHA2564620f5f49d3f3c3fcb10d7dd83e5fdc0b2efd44ae429ee5a8dc3e64d76e6bc9a
SHA51216b5e40deb2e66287b86bbff11ac986f36b94a5849fbe2ed7124296e95d563ec0e9b00cbd6008c993c383d1610d371177faf5a9cd5da77a34a778e901f9e7a25
-
Filesize
2.0MB
MD58db977e449e59419ef7118fddb4b4851
SHA1df522e9d67fb39634e2b4f5242a2604aacdd642a
SHA25616d274209dbe882a40b76365ab7574503292066bbc22939386332864a9eb9007
SHA5122db533676dc6ba19abdc1859351d3b024119f9d6d165ef7fad573fa2ae69d82c3c77f49639208be3e85ec26b0c6ca47e689f16355b670c1baddc47aaf5e2df76