blackshades | 63374f345942d7afa0ff9d54f360525cc1b11b1a6a78f53612973dbf646d2549

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2025, 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_9f5b73d693ce3216672d03ab07dd7ea5.exe
Size

1.1MB
MD5

9f5b73d693ce3216672d03ab07dd7ea5
SHA1

c06441d12ccc651ceb41c543553165f6561383c8
SHA256

63374f345942d7afa0ff9d54f360525cc1b11b1a6a78f53612973dbf646d2549
SHA512

4c3d87bde877eface5c5b4c5daf87cd25e271ce3d1f9bfddf02a1b51d9a320a3f1b2cb4ca06a615b2f06b6e7fcd08410d919579271ccb4cde7cbbc4c142dc6ad
SSDEEP

24576:h5Y8WP5oudlRLl3hP13iM40oh7kt3nuGz:BWP5oAlbNpii90Gz

Score

10^/10

blackshades defense_evasion discovery persistence rat

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000024022-10.dat	family_blackshades

Modifies firewall policy service 3 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\crypteda.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\crypteda.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\test.exe = "C:\\Users\\Admin\\AppData\\Roaming\\test.exe:*:Enabled:Windows Messanger"	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	crypteda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\test.exe"	crypteda.exe

Executes dropped EXE 64 IoCs

pid	Process
4324	crypteda.exe
1616	test.exe
4960	test.exe
3520	test.exe
3492	test.exe
1284	test.exe
4860	test.exe
864	test.exe
4172	test.exe
836	test.exe
2784	test.exe
1572	test.exe
1252	test.exe
2816	test.exe
5100	test.exe
2964	test.exe
3400	test.exe
3848	test.exe
2976	test.exe
2192	test.exe
3508	test.exe
2444	test.exe
216	test.exe
2432	test.exe
1540	test.exe
2324	test.exe
1840	test.exe
2464	test.exe
4688	test.exe
4896	test.exe
1952	test.exe
3088	test.exe
1144	test.exe
3704	test.exe
4344	test.exe
2420	test.exe
320	test.exe
2400	test.exe
2488	test.exe
2580	test.exe
3872	test.exe
2132	test.exe
376	test.exe
1908	test.exe
4252	test.exe
2732	test.exe
396	test.exe
3924	test.exe
4632	test.exe
1504	test.exe
2856	test.exe
2324	test.exe
3528	test.exe
4232	test.exe
2580	test.exe
3908	test.exe
1200	test.exe
2160	test.exe
4660	test.exe
1908	test.exe
1000	test.exe
4744	test.exe
4480	test.exe
3484	test.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\test.exe"	crypteda.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\test.exe"	crypteda.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1468	reg.exe
1884	reg.exe
3124	reg.exe
3308	reg.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: 1	4324	crypteda.exe
Token: SeCreateTokenPrivilege	4324	crypteda.exe
Token: SeAssignPrimaryTokenPrivilege	4324	crypteda.exe
Token: SeLockMemoryPrivilege	4324	crypteda.exe
Token: SeIncreaseQuotaPrivilege	4324	crypteda.exe
Token: SeMachineAccountPrivilege	4324	crypteda.exe
Token: SeTcbPrivilege	4324	crypteda.exe
Token: SeSecurityPrivilege	4324	crypteda.exe
Token: SeTakeOwnershipPrivilege	4324	crypteda.exe
Token: SeLoadDriverPrivilege	4324	crypteda.exe
Token: SeSystemProfilePrivilege	4324	crypteda.exe
Token: SeSystemtimePrivilege	4324	crypteda.exe
Token: SeProfSingleProcessPrivilege	4324	crypteda.exe
Token: SeIncBasePriorityPrivilege	4324	crypteda.exe
Token: SeCreatePagefilePrivilege	4324	crypteda.exe
Token: SeCreatePermanentPrivilege	4324	crypteda.exe
Token: SeBackupPrivilege	4324	crypteda.exe
Token: SeRestorePrivilege	4324	crypteda.exe
Token: SeShutdownPrivilege	4324	crypteda.exe
Token: SeDebugPrivilege	4324	crypteda.exe
Token: SeAuditPrivilege	4324	crypteda.exe
Token: SeSystemEnvironmentPrivilege	4324	crypteda.exe
Token: SeChangeNotifyPrivilege	4324	crypteda.exe
Token: SeRemoteShutdownPrivilege	4324	crypteda.exe
Token: SeUndockPrivilege	4324	crypteda.exe
Token: SeSyncAgentPrivilege	4324	crypteda.exe
Token: SeEnableDelegationPrivilege	4324	crypteda.exe
Token: SeManageVolumePrivilege	4324	crypteda.exe
Token: SeImpersonatePrivilege	4324	crypteda.exe
Token: SeCreateGlobalPrivilege	4324	crypteda.exe
Token: 31	4324	crypteda.exe
Token: 32	4324	crypteda.exe
Token: 33	4324	crypteda.exe
Token: 34	4324	crypteda.exe
Token: 35	4324	crypteda.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4324	crypteda.exe
4324	crypteda.exe
4324	crypteda.exe
4136	JaffaCakes118_9f5b73d693ce3216672d03ab07dd7ea5.exe
4136	JaffaCakes118_9f5b73d693ce3216672d03ab07dd7ea5.exe
4960	test.exe
4960	test.exe
1616	test.exe
1616	test.exe
3520	test.exe
3492	test.exe
3492	test.exe
3520	test.exe
4860	test.exe
1284	test.exe
1284	test.exe
4860	test.exe
864	test.exe
4172	test.exe
4172	test.exe
864	test.exe
2784	test.exe
836	test.exe
836	test.exe
2784	test.exe
1572	test.exe
1252	test.exe
1572	test.exe
1252	test.exe
2816	test.exe
5100	test.exe
5100	test.exe
2816	test.exe
3400	test.exe
2964	test.exe
2964	test.exe
3400	test.exe
3848	test.exe
3848	test.exe
2976	test.exe
2976	test.exe
2192	test.exe
2192	test.exe
3508	test.exe
3508	test.exe
216	test.exe
2444	test.exe
216	test.exe
2444	test.exe
1540	test.exe
1540	test.exe
2432	test.exe
2432	test.exe
2324	test.exe
1840	test.exe
1840	test.exe
2324	test.exe
2464	test.exe
4688	test.exe
2464	test.exe
4688	test.exe
1952	test.exe
1952	test.exe
4896	test.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4324	4136	JaffaCakes118_9f5b73d693ce3216672d03ab07dd7ea5.exe	91
PID 4136 wrote to memory of 4324	4136	JaffaCakes118_9f5b73d693ce3216672d03ab07dd7ea5.exe	91
PID 4136 wrote to memory of 4324	4136	JaffaCakes118_9f5b73d693ce3216672d03ab07dd7ea5.exe	91
PID 4324 wrote to memory of 4688	4324	crypteda.exe	92
PID 4324 wrote to memory of 4688	4324	crypteda.exe	92
PID 4324 wrote to memory of 4688	4324	crypteda.exe	92
PID 4324 wrote to memory of 3428	4324	crypteda.exe	93
PID 4324 wrote to memory of 3428	4324	crypteda.exe	93
PID 4324 wrote to memory of 3428	4324	crypteda.exe	93
PID 4324 wrote to memory of 3560	4324	crypteda.exe	94
PID 4324 wrote to memory of 3560	4324	crypteda.exe	94
PID 4324 wrote to memory of 3560	4324	crypteda.exe	94
PID 4324 wrote to memory of 4568	4324	crypteda.exe	95
PID 4324 wrote to memory of 4568	4324	crypteda.exe	95
PID 4324 wrote to memory of 4568	4324	crypteda.exe	95
PID 4048 wrote to memory of 1616	4048	cmd.exe	104
PID 4048 wrote to memory of 1616	4048	cmd.exe	104
PID 4048 wrote to memory of 1616	4048	cmd.exe	104
PID 4548 wrote to memory of 4960	4548	cmd.exe	105
PID 4548 wrote to memory of 4960	4548	cmd.exe	105
PID 4548 wrote to memory of 4960	4548	cmd.exe	105
PID 4688 wrote to memory of 1884	4688	cmd.exe	106
PID 4688 wrote to memory of 1884	4688	cmd.exe	106
PID 4688 wrote to memory of 1884	4688	cmd.exe	106
PID 3428 wrote to memory of 3124	3428	cmd.exe	107
PID 3428 wrote to memory of 3124	3428	cmd.exe	107
PID 3428 wrote to memory of 3124	3428	cmd.exe	107
PID 3560 wrote to memory of 1468	3560	cmd.exe	108
PID 3560 wrote to memory of 1468	3560	cmd.exe	108
PID 3560 wrote to memory of 1468	3560	cmd.exe	108
PID 4568 wrote to memory of 3308	4568	cmd.exe	109
PID 4568 wrote to memory of 3308	4568	cmd.exe	109
PID 4568 wrote to memory of 3308	4568	cmd.exe	109
PID 3272 wrote to memory of 3520	3272	cmd.exe	115
PID 3272 wrote to memory of 3520	3272	cmd.exe	115
PID 3272 wrote to memory of 3520	3272	cmd.exe	115
PID 4672 wrote to memory of 3492	4672	cmd.exe	116
PID 4672 wrote to memory of 3492	4672	cmd.exe	116
PID 4672 wrote to memory of 3492	4672	cmd.exe	116
PID 844 wrote to memory of 1284	844	cmd.exe	125
PID 844 wrote to memory of 1284	844	cmd.exe	125
PID 844 wrote to memory of 1284	844	cmd.exe	125
PID 2036 wrote to memory of 4860	2036	cmd.exe	126
PID 2036 wrote to memory of 4860	2036	cmd.exe	126
PID 2036 wrote to memory of 4860	2036	cmd.exe	126
PID 1560 wrote to memory of 864	1560	cmd.exe	132
PID 1560 wrote to memory of 864	1560	cmd.exe	132
PID 1560 wrote to memory of 864	1560	cmd.exe	132
PID 3796 wrote to memory of 4172	3796	cmd.exe	133
PID 3796 wrote to memory of 4172	3796	cmd.exe	133
PID 3796 wrote to memory of 4172	3796	cmd.exe	133
PID 4132 wrote to memory of 836	4132	cmd.exe	140
PID 4132 wrote to memory of 836	4132	cmd.exe	140
PID 4132 wrote to memory of 836	4132	cmd.exe	140
PID 4080 wrote to memory of 2784	4080	cmd.exe	141
PID 4080 wrote to memory of 2784	4080	cmd.exe	141
PID 4080 wrote to memory of 2784	4080	cmd.exe	141
PID 1960 wrote to memory of 1252	1960	cmd.exe	146
PID 1960 wrote to memory of 1252	1960	cmd.exe	146
PID 1960 wrote to memory of 1252	1960	cmd.exe	146
PID 2224 wrote to memory of 1572	2224	cmd.exe	147
PID 2224 wrote to memory of 1572	2224	cmd.exe	147
PID 2224 wrote to memory of 1572	2224	cmd.exe	147
PID 2276 wrote to memory of 5100	2276	cmd.exe	152

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9f5b73d693ce3216672d03ab07dd7ea5.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9f5b73d693ce3216672d03ab07dd7ea5.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\AppData\Local\Temp\crypteda.exe
  C:\Users\Admin\AppData\Local\Temp\\crypteda.exe
  2⤵
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1884
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\crypteda.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\crypteda.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\crypteda.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\crypteda.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:3124
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3560
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:1468
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\test.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\test.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\test.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\test.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1284

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:1408
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:1276
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:4932
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:880
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:2248
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:1000
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:1144
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:2788
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:3272
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:4736
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:1212
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:1368
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:2488
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:3356
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:3872
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:2528
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:2492
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:2328
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:4916
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:64
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  PID:4344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:3688
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:4996
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:1868
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  PID:320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:4860
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:3848
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:4496
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:4332
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:2688
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  PID:2132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:4864
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:376

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:4628
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:4588
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:5080
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  PID:396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:4460
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:3056
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:1456
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:2272
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  PID:1504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:1868
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  PID:2856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:4840
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  PID:3528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:3040
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:60
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:4844
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:532
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:4056
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:3460
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:3712
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:4548
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  PID:1000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:516
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  PID:1908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:1960
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:3508
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:4344
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:3748
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:4952
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  PID:4880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:3252
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  PID:1540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:3276
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:2600
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:1168
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:4192
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:4076
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:2464
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:4764
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:1616
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  PID:3872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:4568
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  PID:5104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:2104
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:2224
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:4564
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:3408
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:8
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:4012
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  PID:2060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:720
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  PID:3796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:2284
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:1712
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  PID:4036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:1268
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\test.exe
1⤵
PID:3740
- C:\Users\Admin\AppData\Roaming\test.exe
  C:\Users\Admin\AppData\Roaming\test.exe
  2⤵
  PID:3544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\crypteda.exe

Filesize
336KB

MD5
a1c471963337042df2e63fdc89090c1c

SHA1
b70973de41a2aa7b64169cc50fc6f4673691f061

SHA256
23fd031539704e2a635fe6a8c3f68d49cf6a4c4b24e2deaddbd7d57e556a5b79

SHA512
195df886f75182b3c4881b21208990390dd1e575979d1d6a78b98b650ddf2cac07035370eb17e73e3c51ebfb4bad8e95f41742ff4a19ab9861e2789a8b26574e

Download Submit
memory/4136-0-0x00007FF9D9E05000-0x00007FF9D9E06000-memory.dmp

Filesize
4KB

Download
memory/4136-1-0x000000001B8F0000-0x000000001B996000-memory.dmp

Filesize
664KB

Download
memory/4136-2-0x00007FF9D9B50000-0x00007FF9DA4F1000-memory.dmp

Filesize
9.6MB

Download
memory/4136-3-0x000000001BE70000-0x000000001C33E000-memory.dmp

Filesize
4.8MB

Download
memory/4136-4-0x000000001C3E0000-0x000000001C47C000-memory.dmp

Filesize
624KB

Download
memory/4136-5-0x00007FF9D9B50000-0x00007FF9DA4F1000-memory.dmp

Filesize
9.6MB

Download
memory/4136-6-0x0000000001070000-0x0000000001078000-memory.dmp

Filesize
32KB

Download
memory/4136-7-0x000000001C510000-0x000000001C55C000-memory.dmp

Filesize
304KB

Download
memory/4136-17-0x00007FF9D9B50000-0x00007FF9DA4F1000-memory.dmp

Filesize
9.6MB

Download
memory/4136-18-0x00007FF9D9B50000-0x00007FF9DA4F1000-memory.dmp

Filesize
9.6MB

Download
memory/4136-28-0x00007FF9D9B50000-0x00007FF9DA4F1000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads