blackshades | 379c236657df94f4b7b43050986c2f8a2a088c3d57c9f3083d856372c9aab273

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2025, 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_95e34fa0f492ecf553ed7eff7ebbc49d.exe
Size

355KB
MD5

95e34fa0f492ecf553ed7eff7ebbc49d
SHA1

54ae756a8953dc634a1c5c2dc046600ae6b9198a
SHA256

379c236657df94f4b7b43050986c2f8a2a088c3d57c9f3083d856372c9aab273
SHA512

6881d40be60c075e9b0530fe42a13e1523bd177f5eaaf9c9d7868985f23bf132f006c37f7ad8d3b7aa65644c2991f9d33cc036344a8fb40369b9f070b33b3fea
SSDEEP

6144:TU7DRHFiJ/mDE1P9XCHrCh4NX/jsF65P6AlV/5/pdSOwb3j19PMB:o7DVu/mDELXCHrCh4xwF65P6AlVR/pc+

Score

10^/10

blackshades defense_evasion discovery persistence rat upx

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 16 IoCs

resource	yara_rule
behavioral2/memory/3132-15-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/3132-21-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/3132-20-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/3132-45-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/3132-48-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/3132-68-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/3132-77-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/3132-86-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/3132-96-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/3132-105-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/3132-112-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/3132-121-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/3132-131-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/3132-139-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/3132-142-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/3132-145-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades

Modifies firewall policy service 3 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\svchost.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe"	svchost.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FC1A2C5-D7E7-DAAF-BFBA-0B771DB236C8}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FC1A2C5-D7E7-DAAF-BFBA-0B771DB236C8}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{5FC1A2C5-D7E7-DAAF-BFBA-0B771DB236C8}	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{5FC1A2C5-D7E7-DAAF-BFBA-0B771DB236C8}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	JaffaCakes118_95e34fa0f492ecf553ed7eff7ebbc49d.exe

Executes dropped EXE 64 IoCs

pid	Process
3132	svchost.exe
2420	RSPinGenerator.exe
4620	bot.exe
2104	bot.exe
1732	bot.exe
2468	bot.exe
4836	bot.exe
4012	bot.exe
748	bot.exe
1492	bot.exe
5084	bot.exe
2268	bot.exe
1348	bot.exe
2340	bot.exe
2020	bot.exe
4732	bot.exe
3272	bot.exe
1472	bot.exe
4432	bot.exe
4692	bot.exe
1468	bot.exe
1788	bot.exe
1728	bot.exe
4636	bot.exe
4916	bot.exe
748	bot.exe
3944	bot.exe
1508	bot.exe
4016	bot.exe
516	bot.exe
232	bot.exe
3112	bot.exe
1304	bot.exe
4060	bot.exe
3140	bot.exe
4472	bot.exe
4836	bot.exe
1292	bot.exe
4296	bot.exe
1040	bot.exe
2396	bot.exe
5092	bot.exe
4932	bot.exe
632	bot.exe
4732	bot.exe
116	bot.exe
1472	bot.exe
1384	bot.exe
3664	bot.exe
4868	bot.exe
2324	bot.exe
1352	bot.exe
4296	bot.exe
4064	bot.exe
3900	bot.exe
216	bot.exe
4468	bot.exe
2776	bot.exe
2512	bot.exe
4068	bot.exe
2988	bot.exe
4368	bot.exe
2104	bot.exe
2120	bot.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe"	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2356 set thread context of 3132	2356	JaffaCakes118_95e34fa0f492ecf553ed7eff7ebbc49d.exe	89

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3132-12-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3132-6-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3132-15-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3132-21-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3132-20-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3132-45-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3132-48-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3132-68-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3132-77-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3132-86-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3132-96-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3132-105-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3132-112-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3132-121-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3132-131-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3132-139-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3132-142-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3132-145-0x0000000000400000-0x000000000047B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95e34fa0f492ecf553ed7eff7ebbc49d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RSPinGenerator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2420	RSPinGenerator.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1492	reg.exe
2016	reg.exe
1356	reg.exe
2628	reg.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	2356	JaffaCakes118_95e34fa0f492ecf553ed7eff7ebbc49d.exe
Token: 1	3132	svchost.exe
Token: SeCreateTokenPrivilege	3132	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3132	svchost.exe
Token: SeLockMemoryPrivilege	3132	svchost.exe
Token: SeIncreaseQuotaPrivilege	3132	svchost.exe
Token: SeMachineAccountPrivilege	3132	svchost.exe
Token: SeTcbPrivilege	3132	svchost.exe
Token: SeSecurityPrivilege	3132	svchost.exe
Token: SeTakeOwnershipPrivilege	3132	svchost.exe
Token: SeLoadDriverPrivilege	3132	svchost.exe
Token: SeSystemProfilePrivilege	3132	svchost.exe
Token: SeSystemtimePrivilege	3132	svchost.exe
Token: SeProfSingleProcessPrivilege	3132	svchost.exe
Token: SeIncBasePriorityPrivilege	3132	svchost.exe
Token: SeCreatePagefilePrivilege	3132	svchost.exe
Token: SeCreatePermanentPrivilege	3132	svchost.exe
Token: SeBackupPrivilege	3132	svchost.exe
Token: SeRestorePrivilege	3132	svchost.exe
Token: SeShutdownPrivilege	3132	svchost.exe
Token: SeDebugPrivilege	3132	svchost.exe
Token: SeAuditPrivilege	3132	svchost.exe
Token: SeSystemEnvironmentPrivilege	3132	svchost.exe
Token: SeChangeNotifyPrivilege	3132	svchost.exe
Token: SeRemoteShutdownPrivilege	3132	svchost.exe
Token: SeUndockPrivilege	3132	svchost.exe
Token: SeSyncAgentPrivilege	3132	svchost.exe
Token: SeEnableDelegationPrivilege	3132	svchost.exe
Token: SeManageVolumePrivilege	3132	svchost.exe
Token: SeImpersonatePrivilege	3132	svchost.exe
Token: SeCreateGlobalPrivilege	3132	svchost.exe
Token: 31	3132	svchost.exe
Token: 32	3132	svchost.exe
Token: 33	3132	svchost.exe
Token: 34	3132	svchost.exe
Token: 35	3132	svchost.exe
Token: SeDebugPrivilege	3132	svchost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3132	svchost.exe
3132	svchost.exe
3132	svchost.exe
3132	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 3132	2356	JaffaCakes118_95e34fa0f492ecf553ed7eff7ebbc49d.exe	89
PID 2356 wrote to memory of 3132	2356	JaffaCakes118_95e34fa0f492ecf553ed7eff7ebbc49d.exe	89
PID 2356 wrote to memory of 3132	2356	JaffaCakes118_95e34fa0f492ecf553ed7eff7ebbc49d.exe	89
PID 2356 wrote to memory of 3132	2356	JaffaCakes118_95e34fa0f492ecf553ed7eff7ebbc49d.exe	89
PID 2356 wrote to memory of 3132	2356	JaffaCakes118_95e34fa0f492ecf553ed7eff7ebbc49d.exe	89
PID 2356 wrote to memory of 3132	2356	JaffaCakes118_95e34fa0f492ecf553ed7eff7ebbc49d.exe	89
PID 2356 wrote to memory of 3132	2356	JaffaCakes118_95e34fa0f492ecf553ed7eff7ebbc49d.exe	89
PID 2356 wrote to memory of 3132	2356	JaffaCakes118_95e34fa0f492ecf553ed7eff7ebbc49d.exe	89
PID 3132 wrote to memory of 4128	3132	svchost.exe	90
PID 3132 wrote to memory of 4128	3132	svchost.exe	90
PID 3132 wrote to memory of 4128	3132	svchost.exe	90
PID 3132 wrote to memory of 2312	3132	svchost.exe	91
PID 3132 wrote to memory of 2312	3132	svchost.exe	91
PID 3132 wrote to memory of 2312	3132	svchost.exe	91
PID 3132 wrote to memory of 3536	3132	svchost.exe	92
PID 3132 wrote to memory of 3536	3132	svchost.exe	92
PID 3132 wrote to memory of 3536	3132	svchost.exe	92
PID 3132 wrote to memory of 3116	3132	svchost.exe	93
PID 3132 wrote to memory of 3116	3132	svchost.exe	93
PID 3132 wrote to memory of 3116	3132	svchost.exe	93
PID 2312 wrote to memory of 1492	2312	cmd.exe	102
PID 2312 wrote to memory of 1492	2312	cmd.exe	102
PID 2312 wrote to memory of 1492	2312	cmd.exe	102
PID 2356 wrote to memory of 2420	2356	JaffaCakes118_95e34fa0f492ecf553ed7eff7ebbc49d.exe	103
PID 2356 wrote to memory of 2420	2356	JaffaCakes118_95e34fa0f492ecf553ed7eff7ebbc49d.exe	103
PID 2356 wrote to memory of 2420	2356	JaffaCakes118_95e34fa0f492ecf553ed7eff7ebbc49d.exe	103
PID 4128 wrote to memory of 2016	4128	cmd.exe	104
PID 4128 wrote to memory of 2016	4128	cmd.exe	104
PID 4128 wrote to memory of 2016	4128	cmd.exe	104
PID 3408 wrote to memory of 4620	3408	cmd.exe	105
PID 3408 wrote to memory of 4620	3408	cmd.exe	105
PID 3408 wrote to memory of 4620	3408	cmd.exe	105
PID 3116 wrote to memory of 1356	3116	cmd.exe	106
PID 3116 wrote to memory of 1356	3116	cmd.exe	106
PID 3116 wrote to memory of 1356	3116	cmd.exe	106
PID 5084 wrote to memory of 2104	5084	cmd.exe	107
PID 5084 wrote to memory of 2104	5084	cmd.exe	107
PID 5084 wrote to memory of 2104	5084	cmd.exe	107
PID 3536 wrote to memory of 2628	3536	cmd.exe	108
PID 3536 wrote to memory of 2628	3536	cmd.exe	108
PID 3536 wrote to memory of 2628	3536	cmd.exe	108
PID 1304 wrote to memory of 1732	1304	cmd.exe	113
PID 1304 wrote to memory of 1732	1304	cmd.exe	113
PID 1304 wrote to memory of 1732	1304	cmd.exe	113
PID 2764 wrote to memory of 2468	2764	cmd.exe	114
PID 2764 wrote to memory of 2468	2764	cmd.exe	114
PID 2764 wrote to memory of 2468	2764	cmd.exe	114
PID 4124 wrote to memory of 4012	4124	cmd.exe	123
PID 4124 wrote to memory of 4012	4124	cmd.exe	123
PID 4124 wrote to memory of 4012	4124	cmd.exe	123
PID 5020 wrote to memory of 4836	5020	cmd.exe	124
PID 5020 wrote to memory of 4836	5020	cmd.exe	124
PID 5020 wrote to memory of 4836	5020	cmd.exe	124
PID 2056 wrote to memory of 748	2056	cmd.exe	130
PID 2056 wrote to memory of 748	2056	cmd.exe	130
PID 2056 wrote to memory of 748	2056	cmd.exe	130
PID 552 wrote to memory of 1492	552	cmd.exe	131
PID 552 wrote to memory of 1492	552	cmd.exe	131
PID 552 wrote to memory of 1492	552	cmd.exe	131
PID 1480 wrote to memory of 5084	1480	cmd.exe	138
PID 1480 wrote to memory of 5084	1480	cmd.exe	138
PID 1480 wrote to memory of 5084	1480	cmd.exe	138
PID 232 wrote to memory of 2268	232	cmd.exe	139
PID 232 wrote to memory of 2268	232	cmd.exe	139

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95e34fa0f492ecf553ed7eff7ebbc49d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95e34fa0f492ecf553ed7eff7ebbc49d.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\svchost.exe
  2⤵
  - Adds policy Run key to start application
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4128
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:2016
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1492
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3536
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:2628
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3116
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1356
- C:\Users\Admin\AppData\Local\Temp\RSPinGenerator.exe
  "C:\Users\Admin\AppData\Local\Temp\RSPinGenerator.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  PID:2468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  PID:4836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  PID:748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:552
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  PID:1492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  PID:5084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:232
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:3116
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  PID:1348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:3536
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  PID:2340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:1992
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:2800
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:1908
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:5096
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:2920
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  PID:4692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:880
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:4436
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  PID:1468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:4124
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1788

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:516
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:1752
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:4724
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:728
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  PID:4916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:3828
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:3992
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:4704
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:4020
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:3536
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:1700
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:3860
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  PID:4060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:2468
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:2936
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:4956
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:3168
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:3888
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:3044
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:4840
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:4548
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:4728
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  PID:5092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:1612
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:4864
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:2404
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  PID:4732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:888
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:2800
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:2024
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:4892
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:4984
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:4736
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  PID:1352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:892
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  PID:2324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:4924
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  PID:4064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:2732
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:4504
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:3696
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:4420
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  PID:4468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:3932
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:4952
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:4016
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  PID:4068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:4680
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  PID:2988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:2392
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  PID:4368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:1304
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  PID:2120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:1864
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:1432
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:2820
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:3740
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  PID:224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:564
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  PID:4696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:3192
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  PID:3120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:2996
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  PID:2260

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:3240
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:892
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:1788
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  PID:728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:3940
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:4840
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:3180
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:2552
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:2044
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:2144
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:1524
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  PID:628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:3692
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:4144
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:888
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  PID:968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:4732
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:3336
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  PID:3264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:3728
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  PID:1232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:1384
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bot.exe
1⤵
PID:3208
- C:\Users\Admin\AppData\Roaming\bot.exe
  C:\Users\Admin\AppData\Roaming\bot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RSPinGenerator.exe

Filesize
34KB

MD5
7561bc2a2877ce2848d805d4b31fffb9

SHA1
de8cbc7778e62651e487dfc6a9ae5634b55ad13c

SHA256
d24e2ce5367fcf2b82b3eec2acc0875b07215db00aaaa0d6dc9b0a4c0dc3809e

SHA512
3120aaafcc9d0dc01ecd7e2fc7d33ef7bfdf1efb3bf3080c1d6a494aa3d95b0692f36e40aad087aab96721853cd1829f2ffcd66b905faf580b953fcfbf45d02b

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
34KB

MD5
e118330b4629b12368d91b9df6488be0

SHA1
ce90218c7e3b90df2a3409ec253048bb6472c2fd

SHA256
3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9

SHA512
ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

Download Submit
memory/2356-33-0x0000000074620000-0x0000000074BD1000-memory.dmp

Filesize
5.7MB

Download
memory/2356-1-0x0000000074620000-0x0000000074BD1000-memory.dmp

Filesize
5.7MB

Download
memory/2356-2-0x0000000074620000-0x0000000074BD1000-memory.dmp

Filesize
5.7MB

Download
memory/2356-3-0x0000000074620000-0x0000000074BD1000-memory.dmp

Filesize
5.7MB

Download
memory/2356-0-0x0000000074622000-0x0000000074623000-memory.dmp

Filesize
4KB

Download
memory/2420-42-0x0000000004D60000-0x0000000004D6A000-memory.dmp

Filesize
40KB

Download
memory/2420-41-0x0000000004DA0000-0x0000000004E32000-memory.dmp

Filesize
584KB

Download
memory/2420-39-0x0000000005350000-0x00000000058F4000-memory.dmp

Filesize
5.6MB

Download
memory/2420-34-0x00000000004B0000-0x00000000004BE000-memory.dmp

Filesize
56KB

Download
memory/3132-15-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3132-86-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3132-21-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3132-6-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3132-12-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3132-45-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3132-48-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3132-68-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3132-77-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3132-20-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3132-96-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3132-105-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3132-112-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3132-121-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3132-131-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3132-139-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3132-142-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3132-145-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads