Analysis
-
max time kernel
148s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24/01/2025, 06:19
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe
-
Size
219KB
-
MD5
1eb486fa6291baa043d8558201f6a3aa
-
SHA1
b5da2ab73ed9c1fd7b19925b4ed5475500139a71
-
SHA256
e27926aab5635abff5cc672148cd58c991bbf9867e51ac49d0fadd22afe7242c
-
SHA512
aa38a937c2c16b344025e6360fe993d73b9388902abf62df2d7d675cdb86d30b5105b2c3078dcf844438f35d1a06610bbcfa578b3abd1abb3e78026a9ae27ab4
-
SSDEEP
6144:Md8pFzq0dWhT0DWo6PJVslRNxHibgzym:o8po9JGlRNpw
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 3 IoCs
resource yara_rule behavioral1/memory/1708-18-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/1708-14-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/1708-24-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Adobe\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\svchost.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Adobe Update Manager = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\svchost.exe" JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AAFA00DE-F7F2-AFA9-383C-F4B9B4BE5EC6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\svchost.exe" JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{AAFA00DE-F7F2-AFA9-383C-F4B9B4BE5EC6} JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Active Setup\Installed Components\{AAFA00DE-F7F2-AFA9-383C-F4B9B4BE5EC6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\svchost.exe" JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AAFA00DE-F7F2-AFA9-383C-F4B9B4BE5EC6} JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe Update Manager = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\svchost.exe" JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe Update Manager = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\svchost.exe" JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2892 set thread context of 1708 2892 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 30 -
resource yara_rule behavioral1/memory/1708-11-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/1708-7-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/1708-5-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/1708-13-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/1708-18-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/1708-14-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/1708-24-0x0000000000400000-0x0000000000473000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2580 reg.exe 2876 reg.exe 2560 reg.exe 2564 reg.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 2892 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: 1 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeCreateTokenPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeAssignPrimaryTokenPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeLockMemoryPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeIncreaseQuotaPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeMachineAccountPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeTcbPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeSecurityPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeTakeOwnershipPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeLoadDriverPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeSystemProfilePrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeSystemtimePrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeProfSingleProcessPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeIncBasePriorityPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeCreatePagefilePrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeCreatePermanentPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeBackupPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeRestorePrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeShutdownPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeDebugPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeAuditPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeSystemEnvironmentPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeChangeNotifyPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeRemoteShutdownPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeUndockPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeSyncAgentPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeEnableDelegationPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeManageVolumePrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeImpersonatePrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeCreateGlobalPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: 31 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: 32 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: 33 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: 34 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: 35 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeDebugPrivilege 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2892 wrote to memory of 1708 2892 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 30 PID 2892 wrote to memory of 1708 2892 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 30 PID 2892 wrote to memory of 1708 2892 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 30 PID 2892 wrote to memory of 1708 2892 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 30 PID 2892 wrote to memory of 1708 2892 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 30 PID 2892 wrote to memory of 1708 2892 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 30 PID 2892 wrote to memory of 1708 2892 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 30 PID 2892 wrote to memory of 1708 2892 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 30 PID 1708 wrote to memory of 2572 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 31 PID 1708 wrote to memory of 2572 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 31 PID 1708 wrote to memory of 2572 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 31 PID 1708 wrote to memory of 2572 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 31 PID 1708 wrote to memory of 2188 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 32 PID 1708 wrote to memory of 2188 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 32 PID 1708 wrote to memory of 2188 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 32 PID 1708 wrote to memory of 2188 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 32 PID 1708 wrote to memory of 2976 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 33 PID 1708 wrote to memory of 2976 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 33 PID 1708 wrote to memory of 2976 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 33 PID 1708 wrote to memory of 2976 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 33 PID 1708 wrote to memory of 2872 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 35 PID 1708 wrote to memory of 2872 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 35 PID 1708 wrote to memory of 2872 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 35 PID 1708 wrote to memory of 2872 1708 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 35 PID 2976 wrote to memory of 2580 2976 cmd.exe 41 PID 2976 wrote to memory of 2580 2976 cmd.exe 41 PID 2976 wrote to memory of 2580 2976 cmd.exe 41 PID 2976 wrote to memory of 2580 2976 cmd.exe 41 PID 2188 wrote to memory of 2564 2188 cmd.exe 39 PID 2188 wrote to memory of 2564 2188 cmd.exe 39 PID 2188 wrote to memory of 2564 2188 cmd.exe 39 PID 2188 wrote to memory of 2564 2188 cmd.exe 39 PID 2872 wrote to memory of 2876 2872 cmd.exe 42 PID 2872 wrote to memory of 2876 2872 cmd.exe 42 PID 2872 wrote to memory of 2876 2872 cmd.exe 42 PID 2872 wrote to memory of 2876 2872 cmd.exe 42 PID 2572 wrote to memory of 2560 2572 cmd.exe 40 PID 2572 wrote to memory of 2560 2572 cmd.exe 40 PID 2572 wrote to memory of 2560 2572 cmd.exe 40 PID 2572 wrote to memory of 2560 2572 cmd.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe2⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2560
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2564
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2580
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Adobe\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Adobe\svchost.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Adobe\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Adobe\svchost.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2876
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1