Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2025, 13:38
Behavioral task
behavioral1
Sample
JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe
Resource
win10v2004-20250129-en
General
-
Target
JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe
-
Size
652KB
-
MD5
9473dfcd003edbcd5fa84036fe53371d
-
SHA1
c31b303c034c9136fcb1bdefa8e8e3e54d00a2e1
-
SHA256
cfefebcb4090b1f491a6edc90b4129791ce5cf1fc522ff2573792852db85497d
-
SHA512
15bb8ff357282ee1e8865ddd90c528307a1df9736c468dd87860d09de1f4b3669f67e90a9664a7df8d326cfb37142051931ff5efbfefaadd3fa6bc12fd1fabc2
-
SSDEEP
12288:QkYIGR6JUK+fEh+vScTfEJihpUBVhK50Q2+Nd/HycRpj:QkswUKEEh+vSYMJihpUBQ0Dmxysj
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 3 IoCs
resource yara_rule behavioral2/memory/2784-4-0x0000000000400000-0x000000000045B000-memory.dmp family_blackshades behavioral2/memory/2784-8-0x0000000000400000-0x000000000045B000-memory.dmp family_blackshades behavioral2/memory/2784-11-0x0000000000400000-0x000000000045B000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\reg.exe = "C:\\Users\\Admin\\AppData\\Roaming\\reg.exe:*:Enabled:Windows Messanger" reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\reg = "C:\\Users\\Admin\\AppData\\Roaming\\reg.exe" JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EBB67DCD-BBCB-B7E3-2ADC-E754FBCAB495} JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EBB67DCD-BBCB-B7E3-2ADC-E754FBCAB495}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\reg.exe" JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Key created \REGISTRY\USER\S-1-5-21-4003209913-3868522715-854928974-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{EBB67DCD-BBCB-B7E3-2ADC-E754FBCAB495} JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Set value (str) \REGISTRY\USER\S-1-5-21-4003209913-3868522715-854928974-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{EBB67DCD-BBCB-B7E3-2ADC-E754FBCAB495}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\reg.exe" JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\reg = "C:\\Users\\Admin\\AppData\\Roaming\\reg.exe" JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Set value (str) \REGISTRY\USER\S-1-5-21-4003209913-3868522715-854928974-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reg = "C:\\Users\\Admin\\AppData\\Roaming\\reg.exe" JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe -
resource yara_rule behavioral2/memory/2784-0-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral2/memory/2784-4-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral2/memory/2784-8-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral2/memory/2784-11-0x0000000000400000-0x000000000045B000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 4088 reg.exe 960 reg.exe 3920 reg.exe 3916 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeCreateTokenPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeAssignPrimaryTokenPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeLockMemoryPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeIncreaseQuotaPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeMachineAccountPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeTcbPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeSecurityPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeTakeOwnershipPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeLoadDriverPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeSystemProfilePrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeSystemtimePrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeProfSingleProcessPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeIncBasePriorityPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeCreatePagefilePrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeCreatePermanentPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeBackupPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeRestorePrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeShutdownPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeDebugPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeAuditPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeSystemEnvironmentPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeChangeNotifyPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeRemoteShutdownPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeUndockPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeSyncAgentPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeEnableDelegationPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeManageVolumePrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeImpersonatePrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeCreateGlobalPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: 31 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: 32 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: 33 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: 34 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: 35 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe Token: SeDebugPrivilege 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2784 wrote to memory of 2944 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe 88 PID 2784 wrote to memory of 2944 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe 88 PID 2784 wrote to memory of 2944 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe 88 PID 2784 wrote to memory of 3320 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe 89 PID 2784 wrote to memory of 3320 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe 89 PID 2784 wrote to memory of 3320 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe 89 PID 2784 wrote to memory of 1868 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe 90 PID 2784 wrote to memory of 1868 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe 90 PID 2784 wrote to memory of 1868 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe 90 PID 2784 wrote to memory of 2416 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe 91 PID 2784 wrote to memory of 2416 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe 91 PID 2784 wrote to memory of 2416 2784 JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe 91 PID 2944 wrote to memory of 4088 2944 cmd.exe 96 PID 2944 wrote to memory of 4088 2944 cmd.exe 96 PID 2944 wrote to memory of 4088 2944 cmd.exe 96 PID 1868 wrote to memory of 960 1868 cmd.exe 97 PID 1868 wrote to memory of 960 1868 cmd.exe 97 PID 1868 wrote to memory of 960 1868 cmd.exe 97 PID 2416 wrote to memory of 3916 2416 cmd.exe 98 PID 2416 wrote to memory of 3916 2416 cmd.exe 98 PID 2416 wrote to memory of 3916 2416 cmd.exe 98 PID 3320 wrote to memory of 3920 3320 cmd.exe 99 PID 3320 wrote to memory of 3920 3320 cmd.exe 99 PID 3320 wrote to memory of 3920 3320 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe"1⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4088
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9473dfcd003edbcd5fa84036fe53371d.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3920
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:960
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\reg.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\reg.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\reg.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\reg.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3916
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32B
MD5785bc62a68e07eb89f1cd79be6382d20
SHA16f2b180d91b3d5f028a17d4b2b59df416cbfa6c4
SHA25625e91d64a45d274ef4c0b35f02f8cea0dada489d17a97e450c4e841c3d02d395
SHA5127eb915bb11ab3abe8488126ba7364b75206d5ead5ebbbfaa938a525574210452a68d206fe5bfeb4bc98bbc7d0f0a5ad8a7b1af8b71d15410dfe5eaa0a09d38aa