Malware Analysis Report

2025-05-28 17:56

Sample ID 250307-z8wcvaxsgt
Target 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700
SHA256 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700
Tags
blackshades defense_evasion discovery persistence rat upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700

Threat Level: Known bad

The file 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700 was found to be: Known bad.

Malicious Activity Summary

blackshades defense_evasion discovery persistence rat upx

Blackshades payload

Blackshades

Blackshades family

Modifies firewall policy service

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

UPX packed file

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Modifies registry key

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-07 21:23

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-07 21:23

Reported

2025-03-07 21:26

Platform

win7-20240903-en

Max time kernel

149s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java Machine = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2764 set thread context of 2996 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2764 set thread context of 2636 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1908 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe C:\Windows\SysWOW64\cmd.exe
PID 1908 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe C:\Windows\SysWOW64\cmd.exe
PID 1908 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe C:\Windows\SysWOW64\cmd.exe
PID 1908 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe C:\Windows\SysWOW64\cmd.exe
PID 2704 wrote to memory of 2812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2704 wrote to memory of 2812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2704 wrote to memory of 2812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2704 wrote to memory of 2812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1908 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 1908 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 1908 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 1908 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2764 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2764 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2764 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2764 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2764 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2764 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2764 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2764 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2764 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2764 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2764 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2764 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2764 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2764 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2764 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2764 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2764 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2764 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2996 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 1928 wrote to memory of 2932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1928 wrote to memory of 2932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1928 wrote to memory of 2932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1928 wrote to memory of 2932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2040 wrote to memory of 1724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2040 wrote to memory of 1724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2040 wrote to memory of 1724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2040 wrote to memory of 1724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2608 wrote to memory of 632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2608 wrote to memory of 632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2608 wrote to memory of 632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2608 wrote to memory of 632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2684 wrote to memory of 868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2684 wrote to memory of 868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2684 wrote to memory of 868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2684 wrote to memory of 868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe

"C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\HdBRi.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java Machine" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /f

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

"C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe"

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 jingerred2.no-ip.biz udp

Files

memory/1908-0-0x0000000000400000-0x00000000005A4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HdBRi.bat

MD5 976ffa9a304b234c039c8739d97bb893
SHA1 f70f7ede8b6e5d1b8a9b53c9bf43882485b55bd6
SHA256 2b77cf051bb584aada8b9e5e07cba06e2077b42f009c33d10e31994ceec10384
SHA512 1bd398b968736efbab740c81776781023a4ef0dc1c0191d6393a7582bd79b452666163691d82a27ee8989a1e293e6d6df57c303aa9b34497ae52be417f9e269c

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

MD5 41f0d9417a430f30151b330e602291af
SHA1 519c71155317ce8e5d71bfcd02381f3633f5d4c6
SHA256 c494c916ffc7a7e2c33bc50a0af228e5520c591c9544a20c4953f2388e7fbedd
SHA512 d3976fe175331072ee5fa14d03788edb70210f405401dfaff6aa7f6800af7229d5aa6a7623813a5bd4d62ee92256a88d4fdd9aaa6d2a4e40ce4a5fad19495e7e

memory/2636-67-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2636-62-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2636-61-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2996-58-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2636-54-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2996-53-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2996-52-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2996-51-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2996-68-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2636-69-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2996-70-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2996-72-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2996-74-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2996-77-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2996-79-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2996-86-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2996-88-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2996-96-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2996-100-0x0000000000400000-0x000000000045C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-03-07 21:23

Reported

2025-03-07 21:26

Platform

win10v2004-20250217-en

Max time kernel

149s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Machine = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2240 set thread context of 2192 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2240 set thread context of 4932 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3836 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe C:\Windows\SysWOW64\cmd.exe
PID 3836 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe C:\Windows\SysWOW64\cmd.exe
PID 3836 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe C:\Windows\SysWOW64\cmd.exe
PID 1844 wrote to memory of 208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1844 wrote to memory of 208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1844 wrote to memory of 208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3836 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3836 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 3836 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2240 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2240 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2240 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2240 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2240 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2240 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2240 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2240 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2240 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2240 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2240 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2240 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2192 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 3828 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Windows\SysWOW64\cmd.exe
PID 2240 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2240 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2240 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 2240 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe
PID 4964 wrote to memory of 624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4964 wrote to memory of 624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4964 wrote to memory of 624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4800 wrote to memory of 4048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4800 wrote to memory of 4048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4800 wrote to memory of 4048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2100 wrote to memory of 5024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2100 wrote to memory of 5024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2100 wrote to memory of 5024 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3828 wrote to memory of 4816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3828 wrote to memory of 4816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3828 wrote to memory of 4816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe

"C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oreXV.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java Machine" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /f

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

"C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe"

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 jingerred2.no-ip.biz udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
US 8.8.8.8:53 jingerred2.no-ip.biz udp
US 8.8.8.8:53 jingerred2.no-ip.biz udp

Files

memory/3836-0-0x0000000000400000-0x00000000005A4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\oreXV.txt

MD5 976ffa9a304b234c039c8739d97bb893
SHA1 f70f7ede8b6e5d1b8a9b53c9bf43882485b55bd6
SHA256 2b77cf051bb584aada8b9e5e07cba06e2077b42f009c33d10e31994ceec10384
SHA512 1bd398b968736efbab740c81776781023a4ef0dc1c0191d6393a7582bd79b452666163691d82a27ee8989a1e293e6d6df57c303aa9b34497ae52be417f9e269c

C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe

MD5 9eb49daf1f4eaf52a6089c646bacdff8
SHA1 690d78c269574dc5298a61c5bf5dcd3f2bcefc7d
SHA256 ea50cde9cf336cb348a12107fb4fbbb7bcacd4ce154089f0188f60c072398329
SHA512 42659f2b7bb06c2fc81f3acf479901d269f274a8631742c0f7257c460c81a5e9c346408c8828a842a303dbbcbec3ea19b397416f35feeaf17f2685440c70675c

memory/2192-31-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2192-36-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2192-34-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4932-42-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4932-45-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4932-47-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2192-50-0x0000000000400000-0x000000000045C000-memory.dmp

memory/4932-51-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2192-52-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2192-54-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2192-57-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2192-59-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2192-61-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2192-64-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2192-66-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2192-73-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2192-75-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2192-78-0x0000000000400000-0x000000000045C000-memory.dmp