Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2025, 06:19
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe
-
Size
219KB
-
MD5
1eb486fa6291baa043d8558201f6a3aa
-
SHA1
b5da2ab73ed9c1fd7b19925b4ed5475500139a71
-
SHA256
e27926aab5635abff5cc672148cd58c991bbf9867e51ac49d0fadd22afe7242c
-
SHA512
aa38a937c2c16b344025e6360fe993d73b9388902abf62df2d7d675cdb86d30b5105b2c3078dcf844438f35d1a06610bbcfa578b3abd1abb3e78026a9ae27ab4
-
SSDEEP
6144:Md8pFzq0dWhT0DWo6PJVslRNxHibgzym:o8po9JGlRNpw
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 2 IoCs
resource yara_rule behavioral2/memory/1748-7-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral2/memory/1748-8-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Adobe\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\svchost.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Adobe Update Manager = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\svchost.exe" JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AAFA00DE-F7F2-AFA9-383C-F4B9B4BE5EC6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\svchost.exe" JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{AAFA00DE-F7F2-AFA9-383C-F4B9B4BE5EC6} JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{AAFA00DE-F7F2-AFA9-383C-F4B9B4BE5EC6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\svchost.exe" JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AAFA00DE-F7F2-AFA9-383C-F4B9B4BE5EC6} JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe Update Manager = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\svchost.exe" JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe Update Manager = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\svchost.exe" JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2872 set thread context of 1748 2872 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 83 -
resource yara_rule behavioral2/memory/1748-3-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/1748-6-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/1748-7-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/1748-8-0x0000000000400000-0x0000000000473000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 1612 reg.exe 2888 reg.exe 916 reg.exe 624 reg.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 2872 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: 1 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeCreateTokenPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeAssignPrimaryTokenPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeLockMemoryPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeIncreaseQuotaPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeMachineAccountPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeTcbPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeSecurityPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeTakeOwnershipPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeLoadDriverPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeSystemProfilePrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeSystemtimePrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeProfSingleProcessPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeIncBasePriorityPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeCreatePagefilePrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeCreatePermanentPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeBackupPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeRestorePrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeShutdownPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeDebugPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeAuditPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeSystemEnvironmentPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeChangeNotifyPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeRemoteShutdownPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeUndockPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeSyncAgentPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeEnableDelegationPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeManageVolumePrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeImpersonatePrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeCreateGlobalPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: 31 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: 32 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: 33 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: 34 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: 35 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe Token: SeDebugPrivilege 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2872 wrote to memory of 1748 2872 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 83 PID 2872 wrote to memory of 1748 2872 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 83 PID 2872 wrote to memory of 1748 2872 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 83 PID 2872 wrote to memory of 1748 2872 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 83 PID 2872 wrote to memory of 1748 2872 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 83 PID 2872 wrote to memory of 1748 2872 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 83 PID 2872 wrote to memory of 1748 2872 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 83 PID 2872 wrote to memory of 1748 2872 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 83 PID 1748 wrote to memory of 4100 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 84 PID 1748 wrote to memory of 4100 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 84 PID 1748 wrote to memory of 4100 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 84 PID 1748 wrote to memory of 1856 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 85 PID 1748 wrote to memory of 1856 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 85 PID 1748 wrote to memory of 1856 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 85 PID 1748 wrote to memory of 2364 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 86 PID 1748 wrote to memory of 2364 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 86 PID 1748 wrote to memory of 2364 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 86 PID 1748 wrote to memory of 348 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 87 PID 1748 wrote to memory of 348 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 87 PID 1748 wrote to memory of 348 1748 JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe 87 PID 1856 wrote to memory of 1612 1856 cmd.exe 92 PID 1856 wrote to memory of 1612 1856 cmd.exe 92 PID 1856 wrote to memory of 1612 1856 cmd.exe 92 PID 348 wrote to memory of 2888 348 cmd.exe 93 PID 348 wrote to memory of 2888 348 cmd.exe 93 PID 348 wrote to memory of 2888 348 cmd.exe 93 PID 4100 wrote to memory of 916 4100 cmd.exe 94 PID 4100 wrote to memory of 916 4100 cmd.exe 94 PID 4100 wrote to memory of 916 4100 cmd.exe 94 PID 2364 wrote to memory of 624 2364 cmd.exe 95 PID 2364 wrote to memory of 624 2364 cmd.exe 95 PID 2364 wrote to memory of 624 2364 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe2⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:916
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1eb486fa6291baa043d8558201f6a3aa.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1612
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:624
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Adobe\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Adobe\svchost.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Adobe\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Adobe\svchost.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2888
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1