blackshades | a3fc5c91f6a1cc5733a897e9339590cf7158c3d23a317a204ac68552de612c10

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/09/2026, 16:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
Size 225KB
Sample260915-t37wsszglb
SHA256 a3fc5c91f6a1cc5733a897e9339590cf7158c3d23a317a204ac68552de612c10
MD5 e6980903dc716e72db1d675b7836d14f
SHA1 044dc4cac4b532fc6414d0114bbfbc4460bf57e4
SHA512 200ce338977e2e6234361c47b95bd66a03590c9997843cfc6a936e9932c4546dfcee3b2e97b9e485b060a10b6ef3cda07b3478c1ed159abdfef1a0e93a0137fb
SSDEEP 6144:fYcweU0/dCG5K19/MNVhePtXG2kSlHhHFjqMMdhq:ADehU9/MNVktXG2kABvMv
TLSH
T15E34014893E5D513FDDE897A135BCD002213BBD3DF1D92ABCA9CAA2716037C388A9751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution blackshades persistence rat upx

Malware Config

Signatures

Family: Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades

Blackshades payload 2 IoCs

resource	yara_rule
behavioral2/memory/5260-10-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades
behavioral2/memory/5260-9-0x0000000000400000-0x000000000047B000-memory.dmp	family_blackshades

Modifies firewall policy service 3 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

Executes dropped EXE 3 IoCs

pid	Process
5848	mscormmc.exe
2152	sbscmp10.exe
5644	mscormmc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\mscormmc.exe"	mscormmc.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3856 set thread context of 5260	3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe	87
PID 2152 set thread context of 1488	2152	sbscmp10.exe	105

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5260-6-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/5260-8-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/5260-10-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/5260-9-0x0000000000400000-0x000000000047B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5104	cmd.exe
2452	cmd.exe
4316	cmd.exe
4696	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscormmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sbscmp10.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscormmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1676	reg.exe
2696	reg.exe
2572	reg.exe
5064	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeDebugPrivilege	3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
Token: 1	5260	AppLaunch.exe
Token: SeCreateTokenPrivilege	5260	AppLaunch.exe
Token: SeAssignPrimaryTokenPrivilege	5260	AppLaunch.exe
Token: SeLockMemoryPrivilege	5260	AppLaunch.exe
Token: SeIncreaseQuotaPrivilege	5260	AppLaunch.exe
Token: SeMachineAccountPrivilege	5260	AppLaunch.exe
Token: SeTcbPrivilege	5260	AppLaunch.exe
Token: SeSecurityPrivilege	5260	AppLaunch.exe
Token: SeTakeOwnershipPrivilege	5260	AppLaunch.exe
Token: SeLoadDriverPrivilege	5260	AppLaunch.exe
Token: SeSystemProfilePrivilege	5260	AppLaunch.exe
Token: SeSystemtimePrivilege	5260	AppLaunch.exe
Token: SeProfSingleProcessPrivilege	5260	AppLaunch.exe
Token: SeIncBasePriorityPrivilege	5260	AppLaunch.exe
Token: SeCreatePagefilePrivilege	5260	AppLaunch.exe
Token: SeCreatePermanentPrivilege	5260	AppLaunch.exe
Token: SeBackupPrivilege	5260	AppLaunch.exe
Token: SeRestorePrivilege	5260	AppLaunch.exe
Token: SeShutdownPrivilege	5260	AppLaunch.exe
Token: SeDebugPrivilege	5260	AppLaunch.exe
Token: SeAuditPrivilege	5260	AppLaunch.exe
Token: SeSystemEnvironmentPrivilege	5260	AppLaunch.exe
Token: SeChangeNotifyPrivilege	5260	AppLaunch.exe
Token: SeRemoteShutdownPrivilege	5260	AppLaunch.exe
Token: SeUndockPrivilege	5260	AppLaunch.exe
Token: SeSyncAgentPrivilege	5260	AppLaunch.exe
Token: SeEnableDelegationPrivilege	5260	AppLaunch.exe
Token: SeManageVolumePrivilege	5260	AppLaunch.exe
Token: SeImpersonatePrivilege	5260	AppLaunch.exe
Token: SeCreateGlobalPrivilege	5260	AppLaunch.exe
Token: 31	5260	AppLaunch.exe
Token: 32	5260	AppLaunch.exe
Token: 33	5260	AppLaunch.exe
Token: 34	5260	AppLaunch.exe
Token: 35	5260	AppLaunch.exe
Token: SeDebugPrivilege	5848	mscormmc.exe
Token: SeDebugPrivilege	2152	sbscmp10.exe
Token: SeDebugPrivilege	5644	mscormmc.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5260	AppLaunch.exe
5260	AppLaunch.exe
5260	AppLaunch.exe
5260	AppLaunch.exe
1488	AppLaunch.exe
1488	AppLaunch.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 5260	3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe	87
PID 3856 wrote to memory of 5260	3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe	87
PID 3856 wrote to memory of 5260	3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe	87
PID 3856 wrote to memory of 5260	3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe	87
PID 5260 wrote to memory of 4316	5260	AppLaunch.exe	88
PID 5260 wrote to memory of 4696	5260	AppLaunch.exe	89
PID 5260 wrote to memory of 2452	5260	AppLaunch.exe	90
PID 5260 wrote to memory of 5104	5260	AppLaunch.exe	91
PID 4696 wrote to memory of 2572	4696	cmd.exe	96
PID 2452 wrote to memory of 1676	2452	cmd.exe	97
PID 4316 wrote to memory of 2696	4316	cmd.exe	98
PID 5104 wrote to memory of 5064	5104	cmd.exe	99
PID 3856 wrote to memory of 5848	3856	jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe	100
PID 5848 wrote to memory of 2152	5848	mscormmc.exe	102
PID 2152 wrote to memory of 1488	2152	sbscmp10.exe	105
PID 2152 wrote to memory of 1488	2152	sbscmp10.exe	105
PID 2152 wrote to memory of 1488	2152	sbscmp10.exe	105
PID 2152 wrote to memory of 1488	2152	sbscmp10.exe	105

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e6980903dc716e72db1d675b7836d14f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5260
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2696
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2572
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2452
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1676
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:5064
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\mscormmc.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\mscormmc.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5848
- - C:\Users\Admin\AppData\Local\Temp\sbscmp10.exe
    C:\Users\Admin\AppData\Local\Temp\\sbscmp10.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1488

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\mscormmc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\mscormmc.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sbscmp10.exe

Path C:\Users\Admin\AppData\Local\Temp\sbscmp10.exe
Size 225KB
SHA256 a3fc5c91f6a1cc5733a897e9339590cf7158c3d23a317a204ac68552de612c10
MD5 e6980903dc716e72db1d675b7836d14f
SHA1 044dc4cac4b532fc6414d0114bbfbc4460bf57e4
SHA512 200ce338977e2e6234361c47b95bd66a03590c9997843cfc6a936e9932c4546dfcee3b2e97b9e485b060a10b6ef3cda07b3478c1ed159abdfef1a0e93a0137fb
SSDEEP 6144:fYcweU0/dCG5K19/MNVhePtXG2kSlHhHFjqMMdhq:ADehU9/MNVktXG2kABvMv
TLSH
T15E34014893E5D513FDDE897A135BCD002213BBD3DF1D92ABCA9CAA2716037C388A9751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mscormmc.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\mscormmc.exe
Size 9KB
SHA256 5db638ce5aaef711c16fa1459e0712426c70aabbcd26b1cbe17cf0396a63d04a
MD5 a9c263f463aa341cb82c895e3cc74a8e
SHA1 a3822a2402e7b4ab127fb3057dd2181288912067
SHA512 2d862a509061c98d75010efeccd32c31b5474ce62970139f56c6a603e210faae96b604868d3ccabe2b476244f9e17cfe821c8fe2c30a6f8da0c89dd49f771fda
SSDEEP 96:ABNeBTIi82I/mse/eg3Tv+mB4cTchORFSPh74hg9Ej4MD0bNtD9HDsCbWUWNUIG+:nyPemg3Tvb4XeS2Fs40bPbWUSfW8
TLSH
T19F120915E3E9CB3AE9B70F325C536610667AFB41AD378B2F98C8120E1D326C48662771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3856-0-0x0000000001980000-0x0000000001990000-memory.dmp

Download

memory/3856-1-0x0000000074C72000-0x0000000074C74000-memory.dmp

Download

memory/3856-4-0x0000000001980000-0x0000000001990000-memory.dmp

Download

memory/3856-5-0x0000000074C72000-0x0000000074C74000-memory.dmp

Download

memory/5260-6-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/5260-8-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/5260-10-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/5260-9-0x0000000000400000-0x000000000047B000-memory.dmp

Download