Overview

overview

10

Static

static

3

JaffaCakes...99.exe

windows7-x64

10

JaffaCakes...99.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_675eb70f089170fb76c40e3c85f6c699

  • Size

    252KB

  • Sample

    250130-2zxwesvnfv

  • MD5

    675eb70f089170fb76c40e3c85f6c699

  • SHA1

    177ebbbb375ff6d82f65ea0fb8da2ff5c7b26dbb

  • SHA256

    84e38d2cf7d2b1bcf087a7b81cefde9f4a741e9c7e54118cc976171deec17434

  • SHA512

    912e32cc44b7d81f2a50633b3c6c02930c0ff5a56d3b4493d61b70b5b3c3a3979a43ab5f7dd2909185dd42f552f727c3316438ed19a389f3ac2c6dc605701287

  • SSDEEP

    3072:q8vQB3fGcsefEnAcyiBF6v7ipOPAAnb6bQfqLxscUwZbDSfFoWXkK:nK+vZOiGfPAAbYQCNsw0

Score
10/10
blackshadesdefense_evasiondiscoverypersistenceratupx

Malware Config

Targets

    • Target

      JaffaCakes118_675eb70f089170fb76c40e3c85f6c699

    • Size

      252KB

    • MD5

      675eb70f089170fb76c40e3c85f6c699

    • SHA1

      177ebbbb375ff6d82f65ea0fb8da2ff5c7b26dbb

    • SHA256

      84e38d2cf7d2b1bcf087a7b81cefde9f4a741e9c7e54118cc976171deec17434

    • SHA512

      912e32cc44b7d81f2a50633b3c6c02930c0ff5a56d3b4493d61b70b5b3c3a3979a43ab5f7dd2909185dd42f552f727c3316438ed19a389f3ac2c6dc605701287

    • SSDEEP

      3072:q8vQB3fGcsefEnAcyiBF6v7ipOPAAnb6bQfqLxscUwZbDSfFoWXkK:nK+vZOiGfPAAbYQCNsw0

    Score
    10/10
    blackshadesdefense_evasiondiscoverypersistenceratupx

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies firewall policy service

      defense_evasion

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks