Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31-01-2025 20:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe
-
Size
348KB
-
MD5
6da81ec68a4f79e842b23dc7ce308e4d
-
SHA1
9b32ad69ada1f0e7b329e4c588031b56f6edbd91
-
SHA256
01ec53faaa8ee0c7bdb61f7db15f1fbd0d0f55e0ba92aea5cbc2832657f3eba1
-
SHA512
b153291af8805bcbd690c712c0cca4086027c86187cfc02a248c1116281477bedbc6bd3dbb2518580d1b890ded5fc0f5c0e9d8a4a57bc8c9dfad8811e0f93125
-
SSDEEP
3072:v3gHo6S249ZtoVx/qRJPLZX5KtM8cJi3APjj2DVuPgJv8kTTnzmKQnpg:vuQ6vqR5ZXSQPjeuPgpbm5pg
Score
10/10
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 15 IoCs
resource yara_rule behavioral1/memory/2628-13-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral1/memory/2628-11-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral1/memory/2628-21-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral1/memory/2628-23-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral1/memory/2628-25-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral1/memory/2628-26-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral1/memory/2628-27-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral1/memory/2628-29-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral1/memory/2628-30-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral1/memory/2628-33-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral1/memory/2628-34-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral1/memory/2628-35-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral1/memory/2628-37-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral1/memory/2628-38-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral1/memory/2628-39-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\win32.exe = "C:\\Users\\Admin\\AppData\\Roaming\\win32.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2900 set thread context of 2628 2900 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 30 -
resource yara_rule behavioral1/memory/2628-7-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral1/memory/2628-13-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral1/memory/2628-11-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral1/memory/2628-10-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral1/memory/2628-9-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral1/memory/2628-4-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral1/memory/2628-2-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral1/memory/2628-21-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral1/memory/2628-23-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral1/memory/2628-25-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral1/memory/2628-26-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral1/memory/2628-27-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral1/memory/2628-29-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral1/memory/2628-30-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral1/memory/2628-33-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral1/memory/2628-34-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral1/memory/2628-35-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral1/memory/2628-37-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral1/memory/2628-38-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral1/memory/2628-39-0x0000000000400000-0x0000000000475000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2820 reg.exe 2324 reg.exe 2000 reg.exe 2664 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeCreateTokenPrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeAssignPrimaryTokenPrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeLockMemoryPrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeIncreaseQuotaPrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeMachineAccountPrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeTcbPrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeSecurityPrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeTakeOwnershipPrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeLoadDriverPrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeSystemProfilePrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeSystemtimePrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeProfSingleProcessPrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeIncBasePriorityPrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeCreatePagefilePrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeCreatePermanentPrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeBackupPrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeRestorePrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeShutdownPrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeDebugPrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeAuditPrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeSystemEnvironmentPrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeChangeNotifyPrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeRemoteShutdownPrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeUndockPrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeSyncAgentPrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeEnableDelegationPrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeManageVolumePrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeImpersonatePrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeCreateGlobalPrivilege 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: 31 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: 32 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: 33 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: 34 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: 35 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2900 wrote to memory of 2628 2900 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 30 PID 2900 wrote to memory of 2628 2900 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 30 PID 2900 wrote to memory of 2628 2900 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 30 PID 2900 wrote to memory of 2628 2900 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 30 PID 2900 wrote to memory of 2628 2900 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 30 PID 2900 wrote to memory of 2628 2900 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 30 PID 2900 wrote to memory of 2628 2900 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 30 PID 2900 wrote to memory of 2628 2900 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 30 PID 2628 wrote to memory of 2784 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 31 PID 2628 wrote to memory of 2784 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 31 PID 2628 wrote to memory of 2784 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 31 PID 2628 wrote to memory of 2784 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 31 PID 2628 wrote to memory of 2732 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 32 PID 2628 wrote to memory of 2732 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 32 PID 2628 wrote to memory of 2732 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 32 PID 2628 wrote to memory of 2732 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 32 PID 2628 wrote to memory of 2816 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 33 PID 2628 wrote to memory of 2816 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 33 PID 2628 wrote to memory of 2816 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 33 PID 2628 wrote to memory of 2816 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 33 PID 2628 wrote to memory of 2636 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 36 PID 2628 wrote to memory of 2636 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 36 PID 2628 wrote to memory of 2636 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 36 PID 2628 wrote to memory of 2636 2628 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 36 PID 2816 wrote to memory of 2820 2816 cmd.exe 39 PID 2816 wrote to memory of 2820 2816 cmd.exe 39 PID 2816 wrote to memory of 2820 2816 cmd.exe 39 PID 2816 wrote to memory of 2820 2816 cmd.exe 39 PID 2636 wrote to memory of 2324 2636 cmd.exe 40 PID 2636 wrote to memory of 2324 2636 cmd.exe 40 PID 2636 wrote to memory of 2324 2636 cmd.exe 40 PID 2636 wrote to memory of 2324 2636 cmd.exe 40 PID 2732 wrote to memory of 2000 2732 cmd.exe 41 PID 2732 wrote to memory of 2000 2732 cmd.exe 41 PID 2732 wrote to memory of 2000 2732 cmd.exe 41 PID 2732 wrote to memory of 2000 2732 cmd.exe 41 PID 2784 wrote to memory of 2664 2784 cmd.exe 42 PID 2784 wrote to memory of 2664 2784 cmd.exe 42 PID 2784 wrote to memory of 2664 2784 cmd.exe 42 PID 2784 wrote to memory of 2664 2784 cmd.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2664
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2000
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2820
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\win32.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\win32.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\win32.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\win32.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2324
-
-
-