Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
01/02/2025, 18:09
Static task
static1
Behavioral task
behavioral1
Sample
ef6c9658469390acda49a7d2d29d0e21e4af8c69721bb253d7090c1308dcc655.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
ef6c9658469390acda49a7d2d29d0e21e4af8c69721bb253d7090c1308dcc655.exe
Resource
win10v2004-20241007-en
General
-
Target
ef6c9658469390acda49a7d2d29d0e21e4af8c69721bb253d7090c1308dcc655.exe
-
Size
1.6MB
-
MD5
faa6c42c1c14245460f11e50d64a33d0
-
SHA1
a8415185aa25ae30c48c1ce92b4ea49a41c58059
-
SHA256
ef6c9658469390acda49a7d2d29d0e21e4af8c69721bb253d7090c1308dcc655
-
SHA512
32993abd0aa2f178f3626ca7b12638891f40443ea375cb3602f9cea0174c859d06090a17a0b6dfc42ffaa990f4e007a52bbef332895ea99c7ed0b97c05a0b30a
-
SSDEEP
12288:avk//qKF76/OXpqSjnTf0clY9uWC+RMpk1OC7HmrWcmbQC5onsYiu:h1zltpu0iu
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 10 IoCs
resource yara_rule behavioral1/memory/2980-54-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2980-68-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2980-70-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2980-72-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2980-75-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2980-77-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2980-79-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2980-86-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2980-88-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2980-91-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Executes dropped EXE 3 IoCs
pid Process 2660 jusched.exe 2980 jusched.exe 768 jusched.exe -
Loads dropped DLL 7 IoCs
pid Process 2908 ef6c9658469390acda49a7d2d29d0e21e4af8c69721bb253d7090c1308dcc655.exe 2908 ef6c9658469390acda49a7d2d29d0e21e4af8c69721bb253d7090c1308dcc655.exe 2908 ef6c9658469390acda49a7d2d29d0e21e4af8c69721bb253d7090c1308dcc655.exe 2908 ef6c9658469390acda49a7d2d29d0e21e4af8c69721bb253d7090c1308dcc655.exe 2908 ef6c9658469390acda49a7d2d29d0e21e4af8c69721bb253d7090c1308dcc655.exe 2660 jusched.exe 2660 jusched.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java Machine = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2660 set thread context of 2980 2660 jusched.exe 34 PID 2660 set thread context of 768 2660 jusched.exe 35 -
resource yara_rule behavioral1/memory/2980-51-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2980-54-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/768-65-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/768-63-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/768-58-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2980-48-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2980-68-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/768-69-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2980-70-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2980-72-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2980-75-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2980-77-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2980-79-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2980-86-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2980-88-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2980-91-0x0000000000400000-0x000000000045C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ef6c9658469390acda49a7d2d29d0e21e4af8c69721bb253d7090c1308dcc655.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2340 reg.exe 1768 reg.exe 1128 reg.exe 1620 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 2980 jusched.exe Token: SeCreateTokenPrivilege 2980 jusched.exe Token: SeAssignPrimaryTokenPrivilege 2980 jusched.exe Token: SeLockMemoryPrivilege 2980 jusched.exe Token: SeIncreaseQuotaPrivilege 2980 jusched.exe Token: SeMachineAccountPrivilege 2980 jusched.exe Token: SeTcbPrivilege 2980 jusched.exe Token: SeSecurityPrivilege 2980 jusched.exe Token: SeTakeOwnershipPrivilege 2980 jusched.exe Token: SeLoadDriverPrivilege 2980 jusched.exe Token: SeSystemProfilePrivilege 2980 jusched.exe Token: SeSystemtimePrivilege 2980 jusched.exe Token: SeProfSingleProcessPrivilege 2980 jusched.exe Token: SeIncBasePriorityPrivilege 2980 jusched.exe Token: SeCreatePagefilePrivilege 2980 jusched.exe Token: SeCreatePermanentPrivilege 2980 jusched.exe Token: SeBackupPrivilege 2980 jusched.exe Token: SeRestorePrivilege 2980 jusched.exe Token: SeShutdownPrivilege 2980 jusched.exe Token: SeDebugPrivilege 2980 jusched.exe Token: SeAuditPrivilege 2980 jusched.exe Token: SeSystemEnvironmentPrivilege 2980 jusched.exe Token: SeChangeNotifyPrivilege 2980 jusched.exe Token: SeRemoteShutdownPrivilege 2980 jusched.exe Token: SeUndockPrivilege 2980 jusched.exe Token: SeSyncAgentPrivilege 2980 jusched.exe Token: SeEnableDelegationPrivilege 2980 jusched.exe Token: SeManageVolumePrivilege 2980 jusched.exe Token: SeImpersonatePrivilege 2980 jusched.exe Token: SeCreateGlobalPrivilege 2980 jusched.exe Token: 31 2980 jusched.exe Token: 32 2980 jusched.exe Token: 33 2980 jusched.exe Token: 34 2980 jusched.exe Token: 35 2980 jusched.exe Token: SeDebugPrivilege 768 jusched.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2908 ef6c9658469390acda49a7d2d29d0e21e4af8c69721bb253d7090c1308dcc655.exe 2660 jusched.exe 2980 jusched.exe 2980 jusched.exe 768 jusched.exe 2980 jusched.exe -
Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 2908 wrote to memory of 2420 2908 ef6c9658469390acda49a7d2d29d0e21e4af8c69721bb253d7090c1308dcc655.exe 30 PID 2908 wrote to memory of 2420 2908 ef6c9658469390acda49a7d2d29d0e21e4af8c69721bb253d7090c1308dcc655.exe 30 PID 2908 wrote to memory of 2420 2908 ef6c9658469390acda49a7d2d29d0e21e4af8c69721bb253d7090c1308dcc655.exe 30 PID 2908 wrote to memory of 2420 2908 ef6c9658469390acda49a7d2d29d0e21e4af8c69721bb253d7090c1308dcc655.exe 30 PID 2420 wrote to memory of 948 2420 cmd.exe 32 PID 2420 wrote to memory of 948 2420 cmd.exe 32 PID 2420 wrote to memory of 948 2420 cmd.exe 32 PID 2420 wrote to memory of 948 2420 cmd.exe 32 PID 2908 wrote to memory of 2660 2908 ef6c9658469390acda49a7d2d29d0e21e4af8c69721bb253d7090c1308dcc655.exe 33 PID 2908 wrote to memory of 2660 2908 ef6c9658469390acda49a7d2d29d0e21e4af8c69721bb253d7090c1308dcc655.exe 33 PID 2908 wrote to memory of 2660 2908 ef6c9658469390acda49a7d2d29d0e21e4af8c69721bb253d7090c1308dcc655.exe 33 PID 2908 wrote to memory of 2660 2908 ef6c9658469390acda49a7d2d29d0e21e4af8c69721bb253d7090c1308dcc655.exe 33 PID 2660 wrote to memory of 2980 2660 jusched.exe 34 PID 2660 wrote to memory of 2980 2660 jusched.exe 34 PID 2660 wrote to memory of 2980 2660 jusched.exe 34 PID 2660 wrote to memory of 2980 2660 jusched.exe 34 PID 2660 wrote to memory of 2980 2660 jusched.exe 34 PID 2660 wrote to memory of 2980 2660 jusched.exe 34 PID 2660 wrote to memory of 2980 2660 jusched.exe 34 PID 2660 wrote to memory of 2980 2660 jusched.exe 34 PID 2660 wrote to memory of 2980 2660 jusched.exe 34 PID 2660 wrote to memory of 768 2660 jusched.exe 35 PID 2660 wrote to memory of 768 2660 jusched.exe 35 PID 2660 wrote to memory of 768 2660 jusched.exe 35 PID 2660 wrote to memory of 768 2660 jusched.exe 35 PID 2660 wrote to memory of 768 2660 jusched.exe 35 PID 2660 wrote to memory of 768 2660 jusched.exe 35 PID 2660 wrote to memory of 768 2660 jusched.exe 35 PID 2660 wrote to memory of 768 2660 jusched.exe 35 PID 2660 wrote to memory of 768 2660 jusched.exe 35 PID 2980 wrote to memory of 576 2980 jusched.exe 36 PID 2980 wrote to memory of 576 2980 jusched.exe 36 PID 2980 wrote to memory of 576 2980 jusched.exe 36 PID 2980 wrote to memory of 576 2980 jusched.exe 36 PID 2980 wrote to memory of 1988 2980 jusched.exe 37 PID 2980 wrote to memory of 1988 2980 jusched.exe 37 PID 2980 wrote to memory of 1988 2980 jusched.exe 37 PID 2980 wrote to memory of 1988 2980 jusched.exe 37 PID 2980 wrote to memory of 692 2980 jusched.exe 39 PID 2980 wrote to memory of 692 2980 jusched.exe 39 PID 2980 wrote to memory of 692 2980 jusched.exe 39 PID 2980 wrote to memory of 692 2980 jusched.exe 39 PID 2980 wrote to memory of 984 2980 jusched.exe 40 PID 2980 wrote to memory of 984 2980 jusched.exe 40 PID 2980 wrote to memory of 984 2980 jusched.exe 40 PID 2980 wrote to memory of 984 2980 jusched.exe 40 PID 576 wrote to memory of 1128 576 cmd.exe 43 PID 576 wrote to memory of 1128 576 cmd.exe 43 PID 576 wrote to memory of 1128 576 cmd.exe 43 PID 576 wrote to memory of 1128 576 cmd.exe 43 PID 1988 wrote to memory of 1768 1988 cmd.exe 45 PID 1988 wrote to memory of 1768 1988 cmd.exe 45 PID 1988 wrote to memory of 1768 1988 cmd.exe 45 PID 1988 wrote to memory of 1768 1988 cmd.exe 45 PID 984 wrote to memory of 2340 984 cmd.exe 46 PID 984 wrote to memory of 2340 984 cmd.exe 46 PID 984 wrote to memory of 2340 984 cmd.exe 46 PID 984 wrote to memory of 2340 984 cmd.exe 46 PID 692 wrote to memory of 1620 692 cmd.exe 47 PID 692 wrote to memory of 1620 692 cmd.exe 47 PID 692 wrote to memory of 1620 692 cmd.exe 47 PID 692 wrote to memory of 1620 692 cmd.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef6c9658469390acda49a7d2d29d0e21e4af8c69721bb253d7090c1308dcc655.exe"C:\Users\Admin\AppData\Local\Temp\ef6c9658469390acda49a7d2d29d0e21e4af8c69721bb253d7090c1308dcc655.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\jEDon.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java Machine" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:948
-
-
-
C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe"C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exeC:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1128
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1768
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1620
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2340
-
-
-
-
C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exeC:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:768
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
149B
MD5976ffa9a304b234c039c8739d97bb893
SHA1f70f7ede8b6e5d1b8a9b53c9bf43882485b55bd6
SHA2562b77cf051bb584aada8b9e5e07cba06e2077b42f009c33d10e31994ceec10384
SHA5121bd398b968736efbab740c81776781023a4ef0dc1c0191d6393a7582bd79b452666163691d82a27ee8989a1e293e6d6df57c303aa9b34497ae52be417f9e269c
-
Filesize
1.6MB
MD59ffe8f9e4410036164c3f4e134fa2f5a
SHA14d235ae41cbc8aca88e645138913742c6791bbe2
SHA2562392abe04690584016720645fb376298980b61543f2e432b32479500290eee88
SHA5122c8d9c7f21ad79c1510bd936e18eb7e59432ab8b3096d8e4fa31d57a3fd9e5463afdcb3be7af28e798eda8660b6863d1b96ee38e79cd01ebba468eecc01bdaca