Analysis
-
max time kernel
148s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23/01/2025, 21:58
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe
-
Size
528KB
-
MD5
1b6bd66c3ef82213f6c62ed41ffa7817
-
SHA1
a0415f2b2934c9b886a030f19a9c6e6eae00c472
-
SHA256
3086b7febe5940b018ccae1227a38e9637da3eab8589e0dfc59edbd974f5e09c
-
SHA512
2eac60cef48d1254837df443f3861410d4b4d4602b2d25ddfac058016bee98e91ad2b752ba2ec01853de96a082351fd53a0dae9dbe9f190c0ef73545a9141fbe
-
SSDEEP
12288:O1T9O/qYv8/iWlq0bZBZsI+oG1KsFXyeIeoUH:Ak0bNs9FtyeI+H
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 13 IoCs
resource yara_rule behavioral2/memory/4748-0-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4748-2-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4748-8-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4748-9-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4748-11-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4748-12-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4748-16-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4748-17-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4748-19-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4748-21-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4748-22-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4748-24-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4748-25-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe:*:Enabled:Windows Messanger" reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\beard.exe = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24} JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24} JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3964 set thread context of 4748 3964 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2740 reg.exe 1556 reg.exe 1412 reg.exe 1404 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeCreateTokenPrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeAssignPrimaryTokenPrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeLockMemoryPrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeIncreaseQuotaPrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeMachineAccountPrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeTcbPrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeSecurityPrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeTakeOwnershipPrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeLoadDriverPrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeSystemProfilePrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeSystemtimePrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeProfSingleProcessPrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeIncBasePriorityPrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeCreatePagefilePrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeCreatePermanentPrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeBackupPrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeRestorePrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeShutdownPrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeDebugPrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeAuditPrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeSystemEnvironmentPrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeChangeNotifyPrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeRemoteShutdownPrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeUndockPrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeSyncAgentPrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeEnableDelegationPrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeManageVolumePrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeImpersonatePrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: SeCreateGlobalPrivilege 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: 31 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: 32 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: 33 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: 34 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe Token: 35 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 3964 wrote to memory of 4748 3964 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe 83 PID 3964 wrote to memory of 4748 3964 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe 83 PID 3964 wrote to memory of 4748 3964 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe 83 PID 3964 wrote to memory of 4748 3964 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe 83 PID 3964 wrote to memory of 4748 3964 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe 83 PID 3964 wrote to memory of 4748 3964 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe 83 PID 3964 wrote to memory of 4748 3964 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe 83 PID 3964 wrote to memory of 4748 3964 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe 83 PID 4748 wrote to memory of 3812 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe 84 PID 4748 wrote to memory of 3812 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe 84 PID 4748 wrote to memory of 3812 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe 84 PID 4748 wrote to memory of 4432 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe 85 PID 4748 wrote to memory of 4432 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe 85 PID 4748 wrote to memory of 4432 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe 85 PID 4748 wrote to memory of 3336 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe 86 PID 4748 wrote to memory of 3336 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe 86 PID 4748 wrote to memory of 3336 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe 86 PID 4748 wrote to memory of 4700 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe 87 PID 4748 wrote to memory of 4700 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe 87 PID 4748 wrote to memory of 4700 4748 JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe 87 PID 3812 wrote to memory of 2740 3812 cmd.exe 92 PID 3812 wrote to memory of 2740 3812 cmd.exe 92 PID 3812 wrote to memory of 2740 3812 cmd.exe 92 PID 3336 wrote to memory of 1556 3336 cmd.exe 93 PID 3336 wrote to memory of 1556 3336 cmd.exe 93 PID 3336 wrote to memory of 1556 3336 cmd.exe 93 PID 4432 wrote to memory of 1412 4432 cmd.exe 94 PID 4432 wrote to memory of 1412 4432 cmd.exe 94 PID 4432 wrote to memory of 1412 4432 cmd.exe 94 PID 4700 wrote to memory of 1404 4700 cmd.exe 95 PID 4700 wrote to memory of 1404 4700 cmd.exe 95 PID 4700 wrote to memory of 1404 4700 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe"2⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2740
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b6bd66c3ef82213f6c62ed41ffa7817.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1412
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1556
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\beard.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\beard.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\beard.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\beard.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1404
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1