Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
08/02/2025, 00:10
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_bcea65735d99c38cb0b5e6493f40c53b.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_bcea65735d99c38cb0b5e6493f40c53b.exe
Resource
win10v2004-20250207-en
General
-
Target
JaffaCakes118_bcea65735d99c38cb0b5e6493f40c53b.exe
-
Size
433KB
-
MD5
bcea65735d99c38cb0b5e6493f40c53b
-
SHA1
02ab575ea1a70713622eaefb779a6bd4ab917ea8
-
SHA256
4e0f9e6733c4271fc053074990f397d2adafc7ea6960a3272e45f08fbac51b9d
-
SHA512
12f3254746f1c1f3a7a6508ddaa3c41e8178d0626872db044902658eacc024c3ce19ce846d064c0f8ed64e8a4f3c6b79556a837ee0f1962060c4a852487d6950
-
SSDEEP
6144:QpC2F8NXC796TB9vj480ifEEdq3hohwTiUCDzHO3tIuNlUpEf0:QTeVQkTrvj41GdqRl2UC3HO9FNlUis
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 13 IoCs
resource yara_rule behavioral1/memory/2868-27-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2868-26-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2868-35-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2868-37-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2868-38-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2868-39-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2868-40-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2868-41-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2868-42-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2868-43-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2868-45-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2868-48-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades behavioral1/memory/2868-49-0x0000000000400000-0x0000000000473000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\explorer.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\explorer.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Google\GoogleUpdater.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Google\\GoogleUpdater.exe:*:Enabled:Windows Messanger" reg.exe -
Executes dropped EXE 1 IoCs
pid Process 2868 explorer.exe -
Loads dropped DLL 1 IoCs
pid Process 3004 JaffaCakes118_bcea65735d99c38cb0b5e6493f40c53b.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\GoogleUpdate.exe\"" JaffaCakes118_bcea65735d99c38cb0b5e6493f40c53b.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3004 set thread context of 2868 3004 JaffaCakes118_bcea65735d99c38cb0b5e6493f40c53b.exe 29 -
resource yara_rule behavioral1/memory/2868-25-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2868-27-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2868-26-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2868-21-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2868-18-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2868-16-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2868-35-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2868-37-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2868-38-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2868-39-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2868-40-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2868-41-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2868-42-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2868-43-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2868-45-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2868-48-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/2868-49-0x0000000000400000-0x0000000000473000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\explorer.exe JaffaCakes118_bcea65735d99c38cb0b5e6493f40c53b.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\explorer.exe JaffaCakes118_bcea65735d99c38cb0b5e6493f40c53b.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_bcea65735d99c38cb0b5e6493f40c53b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2804 reg.exe 760 reg.exe 2768 reg.exe 2896 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 3004 JaffaCakes118_bcea65735d99c38cb0b5e6493f40c53b.exe Token: 1 2868 explorer.exe Token: SeCreateTokenPrivilege 2868 explorer.exe Token: SeAssignPrimaryTokenPrivilege 2868 explorer.exe Token: SeLockMemoryPrivilege 2868 explorer.exe Token: SeIncreaseQuotaPrivilege 2868 explorer.exe Token: SeMachineAccountPrivilege 2868 explorer.exe Token: SeTcbPrivilege 2868 explorer.exe Token: SeSecurityPrivilege 2868 explorer.exe Token: SeTakeOwnershipPrivilege 2868 explorer.exe Token: SeLoadDriverPrivilege 2868 explorer.exe Token: SeSystemProfilePrivilege 2868 explorer.exe Token: SeSystemtimePrivilege 2868 explorer.exe Token: SeProfSingleProcessPrivilege 2868 explorer.exe Token: SeIncBasePriorityPrivilege 2868 explorer.exe Token: SeCreatePagefilePrivilege 2868 explorer.exe Token: SeCreatePermanentPrivilege 2868 explorer.exe Token: SeBackupPrivilege 2868 explorer.exe Token: SeRestorePrivilege 2868 explorer.exe Token: SeShutdownPrivilege 2868 explorer.exe Token: SeDebugPrivilege 2868 explorer.exe Token: SeAuditPrivilege 2868 explorer.exe Token: SeSystemEnvironmentPrivilege 2868 explorer.exe Token: SeChangeNotifyPrivilege 2868 explorer.exe Token: SeRemoteShutdownPrivilege 2868 explorer.exe Token: SeUndockPrivilege 2868 explorer.exe Token: SeSyncAgentPrivilege 2868 explorer.exe Token: SeEnableDelegationPrivilege 2868 explorer.exe Token: SeManageVolumePrivilege 2868 explorer.exe Token: SeImpersonatePrivilege 2868 explorer.exe Token: SeCreateGlobalPrivilege 2868 explorer.exe Token: 31 2868 explorer.exe Token: 32 2868 explorer.exe Token: 33 2868 explorer.exe Token: 34 2868 explorer.exe Token: 35 2868 explorer.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2868 explorer.exe 2868 explorer.exe 2868 explorer.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2868 3004 JaffaCakes118_bcea65735d99c38cb0b5e6493f40c53b.exe 29 PID 3004 wrote to memory of 2868 3004 JaffaCakes118_bcea65735d99c38cb0b5e6493f40c53b.exe 29 PID 3004 wrote to memory of 2868 3004 JaffaCakes118_bcea65735d99c38cb0b5e6493f40c53b.exe 29 PID 3004 wrote to memory of 2868 3004 JaffaCakes118_bcea65735d99c38cb0b5e6493f40c53b.exe 29 PID 3004 wrote to memory of 2868 3004 JaffaCakes118_bcea65735d99c38cb0b5e6493f40c53b.exe 29 PID 3004 wrote to memory of 2868 3004 JaffaCakes118_bcea65735d99c38cb0b5e6493f40c53b.exe 29 PID 3004 wrote to memory of 2868 3004 JaffaCakes118_bcea65735d99c38cb0b5e6493f40c53b.exe 29 PID 3004 wrote to memory of 2868 3004 JaffaCakes118_bcea65735d99c38cb0b5e6493f40c53b.exe 29 PID 2868 wrote to memory of 2980 2868 explorer.exe 30 PID 2868 wrote to memory of 2980 2868 explorer.exe 30 PID 2868 wrote to memory of 2980 2868 explorer.exe 30 PID 2868 wrote to memory of 2980 2868 explorer.exe 30 PID 2868 wrote to memory of 2752 2868 explorer.exe 31 PID 2868 wrote to memory of 2752 2868 explorer.exe 31 PID 2868 wrote to memory of 2752 2868 explorer.exe 31 PID 2868 wrote to memory of 2752 2868 explorer.exe 31 PID 2868 wrote to memory of 2748 2868 explorer.exe 32 PID 2868 wrote to memory of 2748 2868 explorer.exe 32 PID 2868 wrote to memory of 2748 2868 explorer.exe 32 PID 2868 wrote to memory of 2748 2868 explorer.exe 32 PID 2868 wrote to memory of 2136 2868 explorer.exe 33 PID 2868 wrote to memory of 2136 2868 explorer.exe 33 PID 2868 wrote to memory of 2136 2868 explorer.exe 33 PID 2868 wrote to memory of 2136 2868 explorer.exe 33 PID 2752 wrote to memory of 760 2752 cmd.exe 39 PID 2752 wrote to memory of 760 2752 cmd.exe 39 PID 2752 wrote to memory of 760 2752 cmd.exe 39 PID 2752 wrote to memory of 760 2752 cmd.exe 39 PID 2136 wrote to memory of 2768 2136 cmd.exe 38 PID 2136 wrote to memory of 2768 2136 cmd.exe 38 PID 2136 wrote to memory of 2768 2136 cmd.exe 38 PID 2136 wrote to memory of 2768 2136 cmd.exe 38 PID 2980 wrote to memory of 2804 2980 cmd.exe 40 PID 2980 wrote to memory of 2804 2980 cmd.exe 40 PID 2980 wrote to memory of 2804 2980 cmd.exe 40 PID 2980 wrote to memory of 2804 2980 cmd.exe 40 PID 2748 wrote to memory of 2896 2748 cmd.exe 41 PID 2748 wrote to memory of 2896 2748 cmd.exe 41 PID 2748 wrote to memory of 2896 2748 cmd.exe 41 PID 2748 wrote to memory of 2896 2748 cmd.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bcea65735d99c38cb0b5e6493f40c53b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bcea65735d99c38cb0b5e6493f40c53b.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\explorer.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\explorer.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2804
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\explorer.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\explorer.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\explorer.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\explorer.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:760
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2896
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Google\GoogleUpdater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Google\GoogleUpdater.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Google\GoogleUpdater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Google\GoogleUpdater.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2768
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98