Malware Analysis Report

2025-05-28 17:56

Sample ID 250306-amltvaszfs
Target JaffaCakes118_54347d438e99d2e5621ee7672408cab7
SHA256 538de94c4dad655940b02a4e72896f1ae09bb99e6ae1e61c4ced7f74a1f52b41
Tags
blackshades defense_evasion discovery persistence rat upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

538de94c4dad655940b02a4e72896f1ae09bb99e6ae1e61c4ced7f74a1f52b41

Threat Level: Known bad

The file JaffaCakes118_54347d438e99d2e5621ee7672408cab7 was found to be: Known bad.

Malicious Activity Summary

blackshades defense_evasion discovery persistence rat upx

Blackshades payload

Blackshades

Modifies firewall policy service

Blackshades family

Boot or Logon Autostart Execution: Active Setup

Adds policy Run key to start application

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

UPX packed file

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Modifies registry key

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-06 00:19

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-06 00:19

Reported

2025-03-06 00:22

Platform

win7-20240903-en

Max time kernel

148s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe = "C:\\Users\\Admin\\AppData\\Roaming\\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows Host = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C5F2732F-D7CA-FFF9-FBDD-E3DFA6BD85C8} C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C5F2732F-D7CA-FFF9-FBDD-E3DFA6BD85C8}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{C5F2732F-D7CA-FFF9-FBDD-E3DFA6BD85C8} C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Active Setup\Installed Components\{C5F2732F-D7CA-FFF9-FBDD-E3DFA6BD85C8}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Host = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1644 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe
PID 1644 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe
PID 1644 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe
PID 1644 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe
PID 1644 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe
PID 1644 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe
PID 1644 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe
PID 1644 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe
PID 2956 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 2956 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 2956 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 2956 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 2956 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 2956 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 2956 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 2956 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 2956 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 2956 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 2956 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 2956 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 2956 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 2956 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 2956 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 2956 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 2860 wrote to memory of 2732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2860 wrote to memory of 2732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2860 wrote to memory of 2732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2860 wrote to memory of 2732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2164 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2164 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2164 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2164 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2692 wrote to memory of 356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2692 wrote to memory of 356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2692 wrote to memory of 356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2692 wrote to memory of 356 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2688 wrote to memory of 2616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2688 wrote to memory of 2616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2688 wrote to memory of 2616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2688 wrote to memory of 2616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe"

C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe

C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 tahsifah.no-ip.biz udp
ES 94.73.32.191:83 tahsifah.no-ip.biz tcp
ES 94.73.32.191:83 tahsifah.no-ip.biz tcp
ES 94.73.32.191:83 tahsifah.no-ip.biz tcp
ES 94.73.32.191:83 tahsifah.no-ip.biz tcp
US 8.8.8.8:53 tahsifah.no-ip.biz udp
ES 94.73.32.191:83 tahsifah.no-ip.biz tcp
ES 94.73.32.191:83 tahsifah.no-ip.biz tcp
ES 94.73.32.191:83 tahsifah.no-ip.biz tcp
ES 94.73.32.191:83 tahsifah.no-ip.biz tcp
US 8.8.8.8:53 tahsifah.no-ip.biz udp
ES 94.73.32.191:83 tahsifah.no-ip.biz tcp
ES 94.73.32.191:83 tahsifah.no-ip.biz tcp

Files

memory/1644-0-0x0000000074A51000-0x0000000074A52000-memory.dmp

memory/1644-1-0x0000000074A50000-0x0000000074FFB000-memory.dmp

memory/1644-2-0x0000000074A50000-0x0000000074FFB000-memory.dmp

\Users\Admin\AppData\Local\Temp\GetProcAddress.dll

MD5 d0c1a1acb3c657b797fce8cffc9b5f63
SHA1 005f864733bb63d5088353b19caa32dd866ecd14
SHA256 56be4e8a1c29a65357c5605086846d509c8334e98e222e9bd2c67c8f9b366a77
SHA512 dcdd37665d67e5df572c769c6ff5b9b398ba09edbb72d6760fdd9a1ad20602f458bb087cc8ebb34c1ebe197c9c0108ee9bc3f2a46de6848f163e8d414b12632a

\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe

MD5 f61119f1902f9efe5fb2220c07de4996
SHA1 3672fead82153ef60ff34c0360a1fb346770f644
SHA256 c0c87c3574d34126c5e6572d87bbb122c7eb62118d6bce2a3f71c63c9627759c
SHA512 a1ebc317625639c14d4223fc2dea8955e6c7d35c8404a80a855af6dd25c11564148cb49b6a41ae190814b4d904d87c0558ddc47c37f290811666df105ae84c9f

memory/2956-18-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2956-30-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2956-29-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1644-28-0x0000000000710000-0x000000000076C000-memory.dmp

memory/2956-27-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1644-26-0x0000000000710000-0x000000000076C000-memory.dmp

memory/2956-23-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2956-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2956-20-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2956-19-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1644-32-0x0000000074A50000-0x0000000074FFB000-memory.dmp

memory/2956-39-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2956-40-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2956-41-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2956-43-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2956-45-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2956-46-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2956-48-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2956-49-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2956-50-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2956-51-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2956-52-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2956-53-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2956-54-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2956-55-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2956-56-0x0000000000400000-0x000000000045C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-03-06 00:19

Reported

2025-03-06 00:22

Platform

win10v2004-20250217-en

Max time kernel

148s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe = "C:\\Users\\Admin\\AppData\\Roaming\\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows Host = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C5F2732F-D7CA-FFF9-FBDD-E3DFA6BD85C8} C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C5F2732F-D7CA-FFF9-FBDD-E3DFA6BD85C8}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{C5F2732F-D7CA-FFF9-FBDD-E3DFA6BD85C8} C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{C5F2732F-D7CA-FFF9-FBDD-E3DFA6BD85C8}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Host = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Host = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2352 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe
PID 2352 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe
PID 2352 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe
PID 2352 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe
PID 2352 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe
PID 2352 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe
PID 2352 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe
PID 2352 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe
PID 4092 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 4092 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 4092 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 4092 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 4092 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 4092 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 4092 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 4092 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 4092 wrote to memory of 1824 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 4092 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 4092 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 4092 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe C:\Windows\SysWOW64\cmd.exe
PID 1692 wrote to memory of 5012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1692 wrote to memory of 5012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1692 wrote to memory of 5012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2944 wrote to memory of 3596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2944 wrote to memory of 3596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2944 wrote to memory of 3596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1824 wrote to memory of 4132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1824 wrote to memory of 4132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1824 wrote to memory of 4132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2452 wrote to memory of 4172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2452 wrote to memory of 4172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2452 wrote to memory of 4172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe"

C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe

C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 tahsifah.no-ip.biz udp
ES 94.73.32.191:83 tahsifah.no-ip.biz tcp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
ES 94.73.32.191:83 tahsifah.no-ip.biz tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
ES 94.73.32.191:83 tahsifah.no-ip.biz tcp
ES 94.73.32.191:83 tahsifah.no-ip.biz tcp
US 8.8.8.8:53 tahsifah.no-ip.biz udp
ES 94.73.32.191:83 tahsifah.no-ip.biz tcp
ES 94.73.32.191:83 tahsifah.no-ip.biz tcp
ES 94.73.32.191:83 tahsifah.no-ip.biz tcp
ES 94.73.32.191:83 tahsifah.no-ip.biz tcp
US 8.8.8.8:53 tahsifah.no-ip.biz udp
ES 94.73.32.191:83 tahsifah.no-ip.biz tcp
ES 94.73.32.191:83 tahsifah.no-ip.biz tcp

Files

memory/2352-0-0x00000000746E2000-0x00000000746E3000-memory.dmp

memory/2352-1-0x00000000746E0000-0x0000000074C91000-memory.dmp

memory/2352-2-0x00000000746E0000-0x0000000074C91000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\GetProcAddress.dll

MD5 d0c1a1acb3c657b797fce8cffc9b5f63
SHA1 005f864733bb63d5088353b19caa32dd866ecd14
SHA256 56be4e8a1c29a65357c5605086846d509c8334e98e222e9bd2c67c8f9b366a77
SHA512 dcdd37665d67e5df572c769c6ff5b9b398ba09edbb72d6760fdd9a1ad20602f458bb087cc8ebb34c1ebe197c9c0108ee9bc3f2a46de6848f163e8d414b12632a

C:\Users\Admin\AppData\Roaming\JaffaCakes118_54347d438e99d2e5621ee7672408cab7.exe

MD5 f61119f1902f9efe5fb2220c07de4996
SHA1 3672fead82153ef60ff34c0360a1fb346770f644
SHA256 c0c87c3574d34126c5e6572d87bbb122c7eb62118d6bce2a3f71c63c9627759c
SHA512 a1ebc317625639c14d4223fc2dea8955e6c7d35c8404a80a855af6dd25c11564148cb49b6a41ae190814b4d904d87c0558ddc47c37f290811666df105ae84c9f

memory/4092-15-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4092-20-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4092-21-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2352-25-0x00000000746E0000-0x0000000074C91000-memory.dmp

memory/4092-24-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4092-31-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4092-30-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4092-32-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4092-33-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4092-37-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4092-41-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4092-44-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4092-47-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4092-50-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4092-53-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4092-56-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4092-59-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4092-62-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4092-65-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4092-68-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4092-71-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4092-74-0x0000000000400000-0x000000000045C000-memory.dmp