Analysis

  • max time kernel
    93s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-01-2025 15:00

General

  • Target

    JaffaCakes118_4c2fc38376c698e985d1f16cd5ecaa1f.exe

  • Size

    681KB

  • MD5

    4c2fc38376c698e985d1f16cd5ecaa1f

  • SHA1

    0d3aecd6345ce623b494ded25b526841e93f1827

  • SHA256

    c352321f7e1d461d1d9b24d2928610b28aa780df2d24441adf800543258f7c55

  • SHA512

    b5702bdd9762d6be94de6c9f7b059198e62fee46abca591a738f038c282c4cc3cc4dde39dc50c0fd0bd6d8490d675486213df3fe44dd71197c1eedfd0390c503

  • SSDEEP

    12288:9uuNyUaTabVPyun+L3OgrXemFg4M9cEUzLX8BcdxL7:wcy/2dyjOwX5g4MqEoDCuV

Score
10/10

Malware Config

Signatures

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

  • Blackshades family
  • Blackshades payload 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4c2fc38376c698e985d1f16cd5ecaa1f.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4c2fc38376c698e985d1f16cd5ecaa1f.exe"
    1⤵
      PID:496

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/496-0-0x00007FFE08A53000-0x00007FFE08A55000-memory.dmp

      Filesize

      8KB

    • memory/496-1-0x0000000000090000-0x0000000000140000-memory.dmp

      Filesize

      704KB

    • memory/496-2-0x00000000021F0000-0x0000000002250000-memory.dmp

      Filesize

      384KB

    • memory/496-3-0x00007FFE08A50000-0x00007FFE09511000-memory.dmp

      Filesize

      10.8MB

    • memory/496-4-0x00007FFE08A50000-0x00007FFE09511000-memory.dmp

      Filesize

      10.8MB