Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/02/2025, 10:35

General

  • Target

    JaffaCakes118_70c9d1cd6056c6ed265dea8d413cfc97.exe

  • Size

    644KB

  • MD5

    70c9d1cd6056c6ed265dea8d413cfc97

  • SHA1

    a653507de24c71577d431a5cd4d5bbd10e613299

  • SHA256

    bcec96017b538e00d13e8836cf1f2ff922a24dd1d30a6e50b08144304476ed5a

  • SHA512

    a2eef39593ee4e752cae90d67c589caa6df22df29d70b325f26d6930e26c4d56f8b87a0f4b82b5011b9aef67151d68e8c6164ffc3bb4b29db18f21e0dfcc9aae

  • SSDEEP

    6144:B41m5vbRoTASrqzusXCOf0sTDFiE+t0nrZ7Q4Qo0SiWe6uxIHN:BZx3Srq6sXCqTDFihtIt4SNe6uxS

Malware Config

Signatures

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

  • Blackshades family
  • Blackshades payload 15 IoCs
  • Modifies firewall policy service 3 TTPs 10 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_70c9d1cd6056c6ed265dea8d413cfc97.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_70c9d1cd6056c6ed265dea8d413cfc97.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:552
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240614531.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3792
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        3⤵
        • UAC bypass
        • System Location Discovery: System Language Discovery
        PID:2016
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240620953.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3212
      • C:\Windows\SysWOW64\reg.exe
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "kluc name" /t REG_SZ /d "C:\Windows\racun\rracun.exe" /f
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:3876
    • C:\Windows\racun\rracun.exe
      "C:\Windows\racun\rracun.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2712
      • C:\Windows\racun\rracun.exe
        "C:\Windows\racun\rracun.exe"
        3⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4728
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3216
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:1328
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\racun\rracun.exe" /t REG_SZ /d "C:\Windows\racun\rracun.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1884
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\racun\rracun.exe" /t REG_SZ /d "C:\Windows\racun\rracun.exe:*:Enabled:Windows Messanger" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:2948
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3732
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:4588
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\RacunLast.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\RacunLast.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1500
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\RacunLast.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\RacunLast.exe:*:Enabled:Windows Messanger" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:5056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\240614531.bat

    Filesize

    118B

    MD5

    a7abd9bdc5677f68c18d7524eb9ec1ab

    SHA1

    948db612bae78b17e4df26d1884f9d2129e6ac9f

    SHA256

    79192d9e9ebc7f9a864fdae37e771650afe5d41b8ba7da7a6ffeaff12b32e7b7

    SHA512

    bfcbbb6f9a76457427000e05b241755c13f1a6def8f0b0afc5d491409b812bacceed8545bd3e781779b2e2cd3fe8b1c323c17d3665df868cacc063c2e38c465d

  • C:\Users\Admin\AppData\Local\Temp\240620953.bat

    Filesize

    121B

    MD5

    ee46813d644e2f3527f7332b0e55af02

    SHA1

    0db88b645364c64e942c85f3c5e4a503ba940f21

    SHA256

    9509158dad0060a9fb3cb8fbaef9957103df755a3f79d17c1029d1efc1e2aafe

    SHA512

    7da3f1c6b6ed4ceb4307c2bbd43fb9b5fb969485e4388abfe07d5488b6da76f82a55d186ee5b59f7802f10e85e7f70d2f96fb0dd1f99be6f0aab4334cfce483e

  • C:\Windows\racun\rracun.exe

    Filesize

    644KB

    MD5

    80e18361819c4f030c5e4d01fded06a3

    SHA1

    756c79f570717f7a7973d6b4b53c1e203fc00289

    SHA256

    db0fc46ff8418892ef63b42c95c88dafe659d2e7439367d9e2deaa320d329009

    SHA512

    68e7e8b8634a612cb633218ba422e59396bbeaa08caf42b8b0cbdbc37dd7439937bfa8088cef784d4766394bce7209de321a407e78d575166f323f34ee155c75

  • memory/552-6-0x0000000002300000-0x0000000002301000-memory.dmp

    Filesize

    4KB

  • memory/552-13-0x00000000022C0000-0x00000000022C1000-memory.dmp

    Filesize

    4KB

  • memory/552-7-0x0000000002240000-0x0000000002241000-memory.dmp

    Filesize

    4KB

  • memory/552-8-0x0000000002280000-0x0000000002281000-memory.dmp

    Filesize

    4KB

  • memory/552-10-0x0000000002290000-0x0000000002291000-memory.dmp

    Filesize

    4KB

  • memory/552-11-0x00000000022A0000-0x00000000022A1000-memory.dmp

    Filesize

    4KB

  • memory/552-14-0x00000000022E0000-0x00000000022E1000-memory.dmp

    Filesize

    4KB

  • memory/552-2-0x0000000002240000-0x0000000002241000-memory.dmp

    Filesize

    4KB

  • memory/552-12-0x00000000022B0000-0x00000000022B1000-memory.dmp

    Filesize

    4KB

  • memory/552-5-0x00000000022E0000-0x00000000022E1000-memory.dmp

    Filesize

    4KB

  • memory/552-18-0x00000000022F0000-0x00000000022F1000-memory.dmp

    Filesize

    4KB

  • memory/552-19-0x0000000002310000-0x0000000002311000-memory.dmp

    Filesize

    4KB

  • memory/552-21-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

    Filesize

    4KB

  • memory/552-4-0x00000000022B0000-0x00000000022B1000-memory.dmp

    Filesize

    4KB

  • memory/552-25-0x00000000036E0000-0x00000000036E1000-memory.dmp

    Filesize

    4KB

  • memory/552-3-0x0000000002290000-0x0000000002291000-memory.dmp

    Filesize

    4KB

  • memory/2712-45-0x0000000002180000-0x0000000002181000-memory.dmp

    Filesize

    4KB

  • memory/2712-41-0x0000000002160000-0x0000000002161000-memory.dmp

    Filesize

    4KB

  • memory/2712-42-0x0000000002190000-0x0000000002191000-memory.dmp

    Filesize

    4KB

  • memory/2712-43-0x00000000021C0000-0x00000000021C1000-memory.dmp

    Filesize

    4KB

  • memory/2712-44-0x0000000002160000-0x0000000002161000-memory.dmp

    Filesize

    4KB

  • memory/2712-40-0x00000000007A0000-0x00000000007A1000-memory.dmp

    Filesize

    4KB

  • memory/2712-46-0x0000000002190000-0x0000000002191000-memory.dmp

    Filesize

    4KB

  • memory/2712-47-0x00000000021A0000-0x00000000021A1000-memory.dmp

    Filesize

    4KB

  • memory/2712-52-0x00000000021D0000-0x00000000021D1000-memory.dmp

    Filesize

    4KB

  • memory/2712-51-0x00000000021C0000-0x00000000021C1000-memory.dmp

    Filesize

    4KB

  • memory/2712-50-0x0000000002B00000-0x0000000002B01000-memory.dmp

    Filesize

    4KB

  • memory/2712-49-0x00000000021B0000-0x00000000021B1000-memory.dmp

    Filesize

    4KB

  • memory/2712-53-0x0000000002F30000-0x0000000002F31000-memory.dmp

    Filesize

    4KB

  • memory/4728-59-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4728-86-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4728-54-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4728-65-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4728-69-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4728-73-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4728-76-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4728-79-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4728-83-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4728-57-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4728-89-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4728-93-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4728-96-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4728-99-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4728-103-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4728-106-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/4728-109-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB