Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31-01-2025 20:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe
-
Size
348KB
-
MD5
6da81ec68a4f79e842b23dc7ce308e4d
-
SHA1
9b32ad69ada1f0e7b329e4c588031b56f6edbd91
-
SHA256
01ec53faaa8ee0c7bdb61f7db15f1fbd0d0f55e0ba92aea5cbc2832657f3eba1
-
SHA512
b153291af8805bcbd690c712c0cca4086027c86187cfc02a248c1116281477bedbc6bd3dbb2518580d1b890ded5fc0f5c0e9d8a4a57bc8c9dfad8811e0f93125
-
SSDEEP
3072:v3gHo6S249ZtoVx/qRJPLZX5KtM8cJi3APjj2DVuPgJv8kTTnzmKQnpg:vuQ6vqR5ZXSQPjeuPgpbm5pg
Score
10/10
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 14 IoCs
resource yara_rule behavioral2/memory/3484-4-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral2/memory/3484-12-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral2/memory/3484-14-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral2/memory/3484-16-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral2/memory/3484-17-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral2/memory/3484-18-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral2/memory/3484-20-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral2/memory/3484-21-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral2/memory/3484-22-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral2/memory/3484-24-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral2/memory/3484-25-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral2/memory/3484-26-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral2/memory/3484-27-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades behavioral2/memory/3484-29-0x0000000000400000-0x0000000000475000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe:*:Enabled:Windows Messanger" reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\win32.exe = "C:\\Users\\Admin\\AppData\\Roaming\\win32.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3160 set thread context of 3484 3160 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 82 -
resource yara_rule behavioral2/memory/3484-0-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral2/memory/3484-2-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral2/memory/3484-4-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral2/memory/3484-12-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral2/memory/3484-14-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral2/memory/3484-16-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral2/memory/3484-17-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral2/memory/3484-18-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral2/memory/3484-20-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral2/memory/3484-21-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral2/memory/3484-22-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral2/memory/3484-24-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral2/memory/3484-25-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral2/memory/3484-26-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral2/memory/3484-27-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral2/memory/3484-29-0x0000000000400000-0x0000000000475000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 964 reg.exe 2492 reg.exe 5000 reg.exe 2196 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeCreateTokenPrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeAssignPrimaryTokenPrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeLockMemoryPrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeIncreaseQuotaPrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeMachineAccountPrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeTcbPrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeSecurityPrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeTakeOwnershipPrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeLoadDriverPrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeSystemProfilePrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeSystemtimePrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeProfSingleProcessPrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeIncBasePriorityPrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeCreatePagefilePrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeCreatePermanentPrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeBackupPrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeRestorePrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeShutdownPrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeDebugPrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeAuditPrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeSystemEnvironmentPrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeChangeNotifyPrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeRemoteShutdownPrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeUndockPrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeSyncAgentPrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeEnableDelegationPrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeManageVolumePrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeImpersonatePrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: SeCreateGlobalPrivilege 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: 31 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: 32 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: 33 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: 34 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe Token: 35 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 3160 wrote to memory of 3484 3160 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 82 PID 3160 wrote to memory of 3484 3160 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 82 PID 3160 wrote to memory of 3484 3160 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 82 PID 3160 wrote to memory of 3484 3160 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 82 PID 3160 wrote to memory of 3484 3160 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 82 PID 3160 wrote to memory of 3484 3160 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 82 PID 3160 wrote to memory of 3484 3160 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 82 PID 3160 wrote to memory of 3484 3160 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 82 PID 3484 wrote to memory of 1848 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 83 PID 3484 wrote to memory of 1848 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 83 PID 3484 wrote to memory of 1848 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 83 PID 3484 wrote to memory of 344 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 84 PID 3484 wrote to memory of 344 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 84 PID 3484 wrote to memory of 344 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 84 PID 3484 wrote to memory of 1712 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 85 PID 3484 wrote to memory of 1712 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 85 PID 3484 wrote to memory of 1712 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 85 PID 3484 wrote to memory of 4024 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 86 PID 3484 wrote to memory of 4024 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 86 PID 3484 wrote to memory of 4024 3484 JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe 86 PID 344 wrote to memory of 2492 344 cmd.exe 91 PID 344 wrote to memory of 2492 344 cmd.exe 91 PID 344 wrote to memory of 2492 344 cmd.exe 91 PID 1848 wrote to memory of 5000 1848 cmd.exe 92 PID 1848 wrote to memory of 5000 1848 cmd.exe 92 PID 1848 wrote to memory of 5000 1848 cmd.exe 92 PID 4024 wrote to memory of 2196 4024 cmd.exe 93 PID 4024 wrote to memory of 2196 4024 cmd.exe 93 PID 4024 wrote to memory of 2196 4024 cmd.exe 93 PID 1712 wrote to memory of 964 1712 cmd.exe 94 PID 1712 wrote to memory of 964 1712 cmd.exe 94 PID 1712 wrote to memory of 964 1712 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:5000
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6da81ec68a4f79e842b23dc7ce308e4d.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2492
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:964
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\win32.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\win32.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\win32.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\win32.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2196
-
-
-