blackshades | 887579f126ed6883f0d78f658552ff55e479a77edb9c90d986a1e73d66b08a57

Analysis

max time kernel
147s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2025, 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Size

332KB
MD5

a2a5711a9d2200a395ed21bd32d3af70
SHA1

35f5fd6f7837fde69f2bd7b598b62891721222b8
SHA256

887579f126ed6883f0d78f658552ff55e479a77edb9c90d986a1e73d66b08a57
SHA512

8729144e358228da9cccd408a86a1d42754d55d299b3008af14aed7a9159b5af9f88d5a77cddb1d2d64f1bc6a2479fe345b0233aa53807ffaa0a450008282831
SSDEEP

6144:uiu0srKxP6nVMg1FENy/V/5c6thb+lazG8a:u50srcyLjN/5c6thb+lazGr

Score

10^/10

blackshades defense_evasion discovery persistence rat

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 1 IoCs

resource	yara_rule
behavioral1/files/0x00090000000227cb-10.dat	family_blackshades

Modifies firewall policy service 3 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\RegBot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\RegBot.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe:*:Enabled:Windows Messanger"	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\WindowsLogon.exe = "C:\\Users\\Admin\\AppData\\Roaming\\RegBot.exe"	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{FCEAADF3-DCE6-5CDF-12BA-F2EBABCC6D7F}	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{FCEAADF3-DCE6-5CDF-12BA-F2EBABCC6D7F}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\RegBot.exe"	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FCEAADF3-DCE6-5CDF-12BA-F2EBABCC6D7F}	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FCEAADF3-DCE6-5CDF-12BA-F2EBABCC6D7F}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\RegBot.exe"	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe

Executes dropped EXE 64 IoCs

pid	Process
2220	RegBot.exe
6076	RegBot.exe
2012	RegBot.exe
3672	RegBot.exe
1812	RegBot.exe
2312	RegBot.exe
5900	RegBot.exe
3484	RegBot.exe
3284	RegBot.exe
3364	RegBot.exe
5464	RegBot.exe
5488	RegBot.exe
5868	RegBot.exe
1588	RegBot.exe
4412	RegBot.exe
5116	RegBot.exe
4056	RegBot.exe
5264	RegBot.exe
3616	RegBot.exe
3548	RegBot.exe
3356	RegBot.exe
2292	RegBot.exe
4560	RegBot.exe
4860	RegBot.exe
5948	RegBot.exe
2076	RegBot.exe
668	RegBot.exe
3708	RegBot.exe
3308	RegBot.exe
5988	RegBot.exe
3992	RegBot.exe
324	RegBot.exe
5840	RegBot.exe
1816	RegBot.exe
696	RegBot.exe
1436	RegBot.exe
1712	RegBot.exe
4608	RegBot.exe
4768	RegBot.exe
4436	RegBot.exe
1668	RegBot.exe
5288	RegBot.exe
5740	RegBot.exe
4788	RegBot.exe
4040	RegBot.exe
1360	RegBot.exe
4908	RegBot.exe
4936	RegBot.exe
5624	RegBot.exe
5508	RegBot.exe
5004	RegBot.exe
4824	RegBot.exe
628	RegBot.exe
5308	RegBot.exe
324	RegBot.exe
956	RegBot.exe
1020	RegBot.exe
3340	RegBot.exe
5080	RegBot.exe
4112	RegBot.exe
5996	RegBot.exe
2764	RegBot.exe
3696	RegBot.exe
3136	RegBot.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsLogon.exe = "C:\\Users\\Admin\\AppData\\Roaming\\RegBot.exe"	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsLogon.exe = "C:\\Users\\Admin\\AppData\\Roaming\\RegBot.exe"	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegBot.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1460	reg.exe
5976	reg.exe
1996	reg.exe
1768	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: 1	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeCreateTokenPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeAssignPrimaryTokenPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeLockMemoryPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeIncreaseQuotaPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeMachineAccountPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeTcbPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeSecurityPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeTakeOwnershipPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeLoadDriverPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeSystemProfilePrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeSystemtimePrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeProfSingleProcessPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeIncBasePriorityPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeCreatePagefilePrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeCreatePermanentPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeBackupPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeRestorePrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeShutdownPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeDebugPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeAuditPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeSystemEnvironmentPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeChangeNotifyPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeRemoteShutdownPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeUndockPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeSyncAgentPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeEnableDelegationPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeManageVolumePrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeImpersonatePrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeCreateGlobalPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: 31	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: 32	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: 33	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: 34	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: 35	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
Token: SeDebugPrivilege	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
2220	RegBot.exe
2220	RegBot.exe
6076	RegBot.exe
6076	RegBot.exe
3672	RegBot.exe
2012	RegBot.exe
3672	RegBot.exe
2012	RegBot.exe
1812	RegBot.exe
2312	RegBot.exe
1812	RegBot.exe
2312	RegBot.exe
3484	RegBot.exe
5900	RegBot.exe
3484	RegBot.exe
5900	RegBot.exe
3284	RegBot.exe
3284	RegBot.exe
3364	RegBot.exe
3364	RegBot.exe
5488	RegBot.exe
5464	RegBot.exe
5488	RegBot.exe
5464	RegBot.exe
5868	RegBot.exe
5868	RegBot.exe
1588	RegBot.exe
1588	RegBot.exe
4412	RegBot.exe
5116	RegBot.exe
4412	RegBot.exe
5116	RegBot.exe
4056	RegBot.exe
5264	RegBot.exe
4056	RegBot.exe
5264	RegBot.exe
3616	RegBot.exe
3548	RegBot.exe
3548	RegBot.exe
3616	RegBot.exe
3356	RegBot.exe
2292	RegBot.exe
3356	RegBot.exe
2292	RegBot.exe
4560	RegBot.exe
4560	RegBot.exe
4860	RegBot.exe
4860	RegBot.exe
5948	RegBot.exe
2076	RegBot.exe
5948	RegBot.exe
2076	RegBot.exe
668	RegBot.exe
3708	RegBot.exe
668	RegBot.exe
3708	RegBot.exe
5988	RegBot.exe
3308	RegBot.exe
5988	RegBot.exe
3308	RegBot.exe
3992	RegBot.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 5264	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe	86
PID 3976 wrote to memory of 5264	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe	86
PID 3976 wrote to memory of 5264	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe	86
PID 3976 wrote to memory of 1696	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe	87
PID 3976 wrote to memory of 1696	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe	87
PID 3976 wrote to memory of 1696	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe	87
PID 3976 wrote to memory of 1736	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe	88
PID 3976 wrote to memory of 1736	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe	88
PID 3976 wrote to memory of 1736	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe	88
PID 3976 wrote to memory of 1160	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe	89
PID 3976 wrote to memory of 1160	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe	89
PID 3976 wrote to memory of 1160	3976	JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe	89
PID 5264 wrote to memory of 5976	5264	cmd.exe	98
PID 5264 wrote to memory of 5976	5264	cmd.exe	98
PID 5264 wrote to memory of 5976	5264	cmd.exe	98
PID 5676 wrote to memory of 2220	5676	cmd.exe	99
PID 5676 wrote to memory of 2220	5676	cmd.exe	99
PID 5676 wrote to memory of 2220	5676	cmd.exe	99
PID 1736 wrote to memory of 1996	1736	cmd.exe	100
PID 1736 wrote to memory of 1996	1736	cmd.exe	100
PID 1736 wrote to memory of 1996	1736	cmd.exe	100
PID 1160 wrote to memory of 1768	1160	cmd.exe	101
PID 1160 wrote to memory of 1768	1160	cmd.exe	101
PID 1160 wrote to memory of 1768	1160	cmd.exe	101
PID 1696 wrote to memory of 1460	1696	cmd.exe	102
PID 1696 wrote to memory of 1460	1696	cmd.exe	102
PID 1696 wrote to memory of 1460	1696	cmd.exe	102
PID 5652 wrote to memory of 6076	5652	cmd.exe	103
PID 5652 wrote to memory of 6076	5652	cmd.exe	103
PID 5652 wrote to memory of 6076	5652	cmd.exe	103
PID 4940 wrote to memory of 2012	4940	cmd.exe	113
PID 4940 wrote to memory of 2012	4940	cmd.exe	113
PID 4940 wrote to memory of 2012	4940	cmd.exe	113
PID 4884 wrote to memory of 3672	4884	cmd.exe	114
PID 4884 wrote to memory of 3672	4884	cmd.exe	114
PID 4884 wrote to memory of 3672	4884	cmd.exe	114
PID 4368 wrote to memory of 1812	4368	cmd.exe	122
PID 4368 wrote to memory of 1812	4368	cmd.exe	122
PID 4368 wrote to memory of 1812	4368	cmd.exe	122
PID 1868 wrote to memory of 2312	1868	cmd.exe	123
PID 1868 wrote to memory of 2312	1868	cmd.exe	123
PID 1868 wrote to memory of 2312	1868	cmd.exe	123
PID 4580 wrote to memory of 5900	4580	cmd.exe	130
PID 4580 wrote to memory of 5900	4580	cmd.exe	130
PID 4580 wrote to memory of 5900	4580	cmd.exe	130
PID 5040 wrote to memory of 3484	5040	cmd.exe	131
PID 5040 wrote to memory of 3484	5040	cmd.exe	131
PID 5040 wrote to memory of 3484	5040	cmd.exe	131
PID 2356 wrote to memory of 3284	2356	cmd.exe	136
PID 2356 wrote to memory of 3284	2356	cmd.exe	136
PID 2356 wrote to memory of 3284	2356	cmd.exe	136
PID 1164 wrote to memory of 3364	1164	cmd.exe	137
PID 1164 wrote to memory of 3364	1164	cmd.exe	137
PID 1164 wrote to memory of 3364	1164	cmd.exe	137
PID 3580 wrote to memory of 5464	3580	cmd.exe	142
PID 3580 wrote to memory of 5464	3580	cmd.exe	142
PID 3580 wrote to memory of 5464	3580	cmd.exe	142
PID 1208 wrote to memory of 5488	1208	cmd.exe	143
PID 1208 wrote to memory of 5488	1208	cmd.exe	143
PID 1208 wrote to memory of 5488	1208	cmd.exe	143
PID 5704 wrote to memory of 5868	5704	cmd.exe	148
PID 5704 wrote to memory of 5868	5704	cmd.exe	148
PID 5704 wrote to memory of 5868	5704	cmd.exe	148
PID 1992 wrote to memory of 1588	1992	cmd.exe	149

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe"
1⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5264
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Modifies firewall policy service
    - Modifies registry key
    PID:5976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe:*:Enabled:Windows Messanger" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a2a5711a9d2200a395ed21bd32d3af70.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1460
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Modifies firewall policy service
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1996
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\RegBot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\RegBot.exe:*:Enabled:Windows Messanger" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\RegBot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\RegBot.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Modifies firewall policy service
    - Modifies registry key
    PID:1768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:5652
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:6076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:5676
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3284

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:5704
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:2452
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:640
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:5896
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:5616
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:5776
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:2824
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:5644
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:404
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:5392
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:236
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:3360
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:392
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:4508
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:1380
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:5308
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:4236
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:4492
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:4180
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:5888
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  PID:1816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:5628
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  PID:5840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:5340
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:4112
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:5616
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:1248
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:6076
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  PID:4436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:3616
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  PID:4768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:464
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:1528
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  PID:1668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:4460
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4788

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:5184
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  PID:5740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:228
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  PID:4040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:5936
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  PID:1360

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:3532
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  PID:4908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:5408
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:3232
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  PID:5508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:3176
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:4968
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:3160
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:5680
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:2324
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:5868
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:2244
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:5356
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:4168
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:5924
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  PID:4112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:5320
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  PID:5080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:2536
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:5804
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:2848
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  PID:3136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:1904
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - Executes dropped EXE
  PID:3696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:4720
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  PID:1532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:5640
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:3480
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:2132
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:3452
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:3356
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:3872
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:4788
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:4808
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:4860
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:4872
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3360

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:1812
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:1512
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:5008
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:3708
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:4832
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:5988
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:6128
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  PID:5636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:1088
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:1012
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:5788
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  PID:1104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\RegBot.exe
1⤵
PID:3992
- C:\Users\Admin\AppData\Roaming\RegBot.exe
  C:\Users\Admin\AppData\Roaming\RegBot.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\RegBot.exe

Filesize
332KB

MD5
a2a5711a9d2200a395ed21bd32d3af70

SHA1
35f5fd6f7837fde69f2bd7b598b62891721222b8

SHA256
887579f126ed6883f0d78f658552ff55e479a77edb9c90d986a1e73d66b08a57

SHA512
8729144e358228da9cccd408a86a1d42754d55d299b3008af14aed7a9159b5af9f88d5a77cddb1d2d64f1bc6a2479fe345b0233aa53807ffaa0a450008282831

Download Submit
memory/3976-7-0x00000000763F0000-0x00000000764E0000-memory.dmp

Filesize
960KB

Download
memory/3976-6-0x0000000076411000-0x0000000076412000-memory.dmp

Filesize
4KB

Download
memory/3976-8-0x00000000763F0000-0x00000000764E0000-memory.dmp

Filesize
960KB

Download
memory/3976-35-0x00000000763F0000-0x00000000764E0000-memory.dmp

Filesize
960KB

Download
memory/3976-38-0x00000000763F0000-0x00000000764E0000-memory.dmp

Filesize
960KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads