Analysis
-
max time kernel
147s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
28-01-2025 02:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
1.exe
-
Size
161KB
-
MD5
bf02618151732457deb7958ddddb9443
-
SHA1
90dc4a4770360fa3ec2de7d7c76750db25e031fa
-
SHA256
c3018b35a3bb6be4e8735792ef9ea54a940e2fe2e48aabd43f9353347a475b71
-
SHA512
b0c2809f34c84f85977a9f962b54f6640745cfb33038a3a27453c22712e68475920b4b2de3e2b39825591488589fd1b2f58a9c69e5a63ad74208dc6e73d67c29
-
SSDEEP
3072:/yBojsneMpW0tblWiOxjUB3A4/i/iM8Axo+349znjY:NjseX0TWVxgdjtvAi+3GbU
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 18 IoCs
resource yara_rule behavioral2/memory/4988-7-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4988-6-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4988-12-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4988-11-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4988-15-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4988-16-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4988-17-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4988-21-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4988-25-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4988-28-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4988-31-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4988-35-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4988-38-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4988-41-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4988-44-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4988-51-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4988-55-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral2/memory/4988-58-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\BAV55TWINA.exe = "C:\\Users\\Admin\\AppData\\Roaming\\BAV55TWINA.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\BAV55TWINA.exe" 1.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C8ABE2B-DCC4-EB32-737D-C0A99EACCB89}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\BAV55TWINA.exe" 1.exe Key created \REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{7C8ABE2B-DCC4-EB32-737D-C0A99EACCB89} 1.exe Set value (str) \REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{7C8ABE2B-DCC4-EB32-737D-C0A99EACCB89}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\BAV55TWINA.exe" 1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C8ABE2B-DCC4-EB32-737D-C0A99EACCB89} 1.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\BAV55TWINA.exe" 1.exe Set value (str) \REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\BAV55TWINA.exe" 1.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1852 set thread context of 4988 1852 1.exe 79 -
resource yara_rule behavioral2/memory/4988-2-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4988-7-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4988-6-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4988-5-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4988-12-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4988-11-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4988-15-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4988-16-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4988-17-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4988-21-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4988-25-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4988-28-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4988-31-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4988-35-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4988-38-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4988-41-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4988-44-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4988-51-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4988-55-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4988-58-0x0000000000400000-0x000000000045D000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2724 reg.exe 2740 reg.exe 916 reg.exe 740 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 4988 1.exe Token: SeCreateTokenPrivilege 4988 1.exe Token: SeAssignPrimaryTokenPrivilege 4988 1.exe Token: SeLockMemoryPrivilege 4988 1.exe Token: SeIncreaseQuotaPrivilege 4988 1.exe Token: SeMachineAccountPrivilege 4988 1.exe Token: SeTcbPrivilege 4988 1.exe Token: SeSecurityPrivilege 4988 1.exe Token: SeTakeOwnershipPrivilege 4988 1.exe Token: SeLoadDriverPrivilege 4988 1.exe Token: SeSystemProfilePrivilege 4988 1.exe Token: SeSystemtimePrivilege 4988 1.exe Token: SeProfSingleProcessPrivilege 4988 1.exe Token: SeIncBasePriorityPrivilege 4988 1.exe Token: SeCreatePagefilePrivilege 4988 1.exe Token: SeCreatePermanentPrivilege 4988 1.exe Token: SeBackupPrivilege 4988 1.exe Token: SeRestorePrivilege 4988 1.exe Token: SeShutdownPrivilege 4988 1.exe Token: SeDebugPrivilege 4988 1.exe Token: SeAuditPrivilege 4988 1.exe Token: SeSystemEnvironmentPrivilege 4988 1.exe Token: SeChangeNotifyPrivilege 4988 1.exe Token: SeRemoteShutdownPrivilege 4988 1.exe Token: SeUndockPrivilege 4988 1.exe Token: SeSyncAgentPrivilege 4988 1.exe Token: SeEnableDelegationPrivilege 4988 1.exe Token: SeManageVolumePrivilege 4988 1.exe Token: SeImpersonatePrivilege 4988 1.exe Token: SeCreateGlobalPrivilege 4988 1.exe Token: 31 4988 1.exe Token: 32 4988 1.exe Token: 33 4988 1.exe Token: 34 4988 1.exe Token: 35 4988 1.exe Token: SeDebugPrivilege 4988 1.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1852 1.exe 4988 1.exe 4988 1.exe 4988 1.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1852 wrote to memory of 4988 1852 1.exe 79 PID 1852 wrote to memory of 4988 1852 1.exe 79 PID 1852 wrote to memory of 4988 1852 1.exe 79 PID 1852 wrote to memory of 4988 1852 1.exe 79 PID 1852 wrote to memory of 4988 1852 1.exe 79 PID 1852 wrote to memory of 4988 1852 1.exe 79 PID 1852 wrote to memory of 4988 1852 1.exe 79 PID 1852 wrote to memory of 4988 1852 1.exe 79 PID 4988 wrote to memory of 4876 4988 1.exe 80 PID 4988 wrote to memory of 4876 4988 1.exe 80 PID 4988 wrote to memory of 4876 4988 1.exe 80 PID 4988 wrote to memory of 5088 4988 1.exe 81 PID 4988 wrote to memory of 5088 4988 1.exe 81 PID 4988 wrote to memory of 5088 4988 1.exe 81 PID 4988 wrote to memory of 548 4988 1.exe 82 PID 4988 wrote to memory of 548 4988 1.exe 82 PID 4988 wrote to memory of 548 4988 1.exe 82 PID 4988 wrote to memory of 2152 4988 1.exe 83 PID 4988 wrote to memory of 2152 4988 1.exe 83 PID 4988 wrote to memory of 2152 4988 1.exe 83 PID 4876 wrote to memory of 2724 4876 cmd.exe 88 PID 4876 wrote to memory of 2724 4876 cmd.exe 88 PID 4876 wrote to memory of 2724 4876 cmd.exe 88 PID 2152 wrote to memory of 2740 2152 cmd.exe 89 PID 2152 wrote to memory of 2740 2152 cmd.exe 89 PID 2152 wrote to memory of 2740 2152 cmd.exe 89 PID 548 wrote to memory of 916 548 cmd.exe 90 PID 548 wrote to memory of 916 548 cmd.exe 90 PID 548 wrote to memory of 916 548 cmd.exe 90 PID 5088 wrote to memory of 740 5088 cmd.exe 91 PID 5088 wrote to memory of 740 5088 cmd.exe 91 PID 5088 wrote to memory of 740 5088 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\1.exeC:\Users\Admin\AppData\Local\Temp\1.exe2⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2724
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:740
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:916
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\BAV55TWINA.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\BAV55TWINA.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\BAV55TWINA.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\BAV55TWINA.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2740
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1