Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/02/2025, 03:12
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_be5dfafefd95d218c56395ad8be4e984.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_be5dfafefd95d218c56395ad8be4e984.exe
Resource
win10v2004-20250207-en
General
-
Target
JaffaCakes118_be5dfafefd95d218c56395ad8be4e984.exe
-
Size
436KB
-
MD5
be5dfafefd95d218c56395ad8be4e984
-
SHA1
4d265baa69e0d5a3fa06bf3c5c26fa73e8d71889
-
SHA256
401a6e01982720bc841e947833a9e7abaa5796406236047e9b3456cf9e840f53
-
SHA512
8bb7bc3d9ba10d84a17fc52efe2d666eb531aa0c2a813de8b6363342e7f8c741b4f319ab3f036cbc82641c836b3e5d34be8d4ef3718748429136adaf39983498
-
SSDEEP
12288:LkkZPCkiLG1yt0ZnHp+qYPCz64p7FIIhII:LkNLG1owpKPBW
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 7 IoCs
resource yara_rule behavioral1/memory/3040-22-0x0000000000400000-0x0000000000456000-memory.dmp family_blackshades behavioral1/memory/3040-26-0x0000000000400000-0x0000000000456000-memory.dmp family_blackshades behavioral1/memory/3040-35-0x0000000000400000-0x0000000000456000-memory.dmp family_blackshades behavioral1/memory/3040-36-0x0000000000400000-0x0000000000456000-memory.dmp family_blackshades behavioral1/memory/3040-38-0x0000000000400000-0x0000000000456000-memory.dmp family_blackshades behavioral1/memory/3040-39-0x0000000000400000-0x0000000000456000-memory.dmp family_blackshades behavioral1/memory/3040-48-0x0000000000400000-0x0000000000456000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\datacore.exe = "C:\\Users\\Admin\\AppData\\Roaming\\datacore.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Executes dropped EXE 1 IoCs
pid Process 2700 CCleaner.exe -
Loads dropped DLL 2 IoCs
pid Process 2684 JaffaCakes118_be5dfafefd95d218c56395ad8be4e984.exe 2684 JaffaCakes118_be5dfafefd95d218c56395ad8be4e984.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\CCleaner.exe = "C:\\Users\\Admin\\AppData\\Roaming\\IzYngQyBVxDQNvJiiKSfHa\\IzYngQyBVxDQNvJiiKSfHa\\0.0.0.0\\CCleaner.exe" CCleaner.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2700 set thread context of 3040 2700 CCleaner.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_be5dfafefd95d218c56395ad8be4e984.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCleaner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2884 reg.exe 1648 reg.exe 1388 reg.exe 1948 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 3040 vbc.exe Token: SeCreateTokenPrivilege 3040 vbc.exe Token: SeAssignPrimaryTokenPrivilege 3040 vbc.exe Token: SeLockMemoryPrivilege 3040 vbc.exe Token: SeIncreaseQuotaPrivilege 3040 vbc.exe Token: SeMachineAccountPrivilege 3040 vbc.exe Token: SeTcbPrivilege 3040 vbc.exe Token: SeSecurityPrivilege 3040 vbc.exe Token: SeTakeOwnershipPrivilege 3040 vbc.exe Token: SeLoadDriverPrivilege 3040 vbc.exe Token: SeSystemProfilePrivilege 3040 vbc.exe Token: SeSystemtimePrivilege 3040 vbc.exe Token: SeProfSingleProcessPrivilege 3040 vbc.exe Token: SeIncBasePriorityPrivilege 3040 vbc.exe Token: SeCreatePagefilePrivilege 3040 vbc.exe Token: SeCreatePermanentPrivilege 3040 vbc.exe Token: SeBackupPrivilege 3040 vbc.exe Token: SeRestorePrivilege 3040 vbc.exe Token: SeShutdownPrivilege 3040 vbc.exe Token: SeDebugPrivilege 3040 vbc.exe Token: SeAuditPrivilege 3040 vbc.exe Token: SeSystemEnvironmentPrivilege 3040 vbc.exe Token: SeChangeNotifyPrivilege 3040 vbc.exe Token: SeRemoteShutdownPrivilege 3040 vbc.exe Token: SeUndockPrivilege 3040 vbc.exe Token: SeSyncAgentPrivilege 3040 vbc.exe Token: SeEnableDelegationPrivilege 3040 vbc.exe Token: SeManageVolumePrivilege 3040 vbc.exe Token: SeImpersonatePrivilege 3040 vbc.exe Token: SeCreateGlobalPrivilege 3040 vbc.exe Token: 31 3040 vbc.exe Token: 32 3040 vbc.exe Token: 33 3040 vbc.exe Token: 34 3040 vbc.exe Token: 35 3040 vbc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3040 vbc.exe 3040 vbc.exe 3040 vbc.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 2684 wrote to memory of 2700 2684 JaffaCakes118_be5dfafefd95d218c56395ad8be4e984.exe 30 PID 2684 wrote to memory of 2700 2684 JaffaCakes118_be5dfafefd95d218c56395ad8be4e984.exe 30 PID 2684 wrote to memory of 2700 2684 JaffaCakes118_be5dfafefd95d218c56395ad8be4e984.exe 30 PID 2684 wrote to memory of 2700 2684 JaffaCakes118_be5dfafefd95d218c56395ad8be4e984.exe 30 PID 2700 wrote to memory of 3040 2700 CCleaner.exe 31 PID 2700 wrote to memory of 3040 2700 CCleaner.exe 31 PID 2700 wrote to memory of 3040 2700 CCleaner.exe 31 PID 2700 wrote to memory of 3040 2700 CCleaner.exe 31 PID 2700 wrote to memory of 3040 2700 CCleaner.exe 31 PID 2700 wrote to memory of 3040 2700 CCleaner.exe 31 PID 2700 wrote to memory of 3040 2700 CCleaner.exe 31 PID 2700 wrote to memory of 3040 2700 CCleaner.exe 31 PID 3040 wrote to memory of 2604 3040 vbc.exe 32 PID 3040 wrote to memory of 2604 3040 vbc.exe 32 PID 3040 wrote to memory of 2604 3040 vbc.exe 32 PID 3040 wrote to memory of 2604 3040 vbc.exe 32 PID 3040 wrote to memory of 2616 3040 vbc.exe 33 PID 3040 wrote to memory of 2616 3040 vbc.exe 33 PID 3040 wrote to memory of 2616 3040 vbc.exe 33 PID 3040 wrote to memory of 2616 3040 vbc.exe 33 PID 3040 wrote to memory of 780 3040 vbc.exe 34 PID 3040 wrote to memory of 780 3040 vbc.exe 34 PID 3040 wrote to memory of 780 3040 vbc.exe 34 PID 3040 wrote to memory of 780 3040 vbc.exe 34 PID 3040 wrote to memory of 3004 3040 vbc.exe 36 PID 3040 wrote to memory of 3004 3040 vbc.exe 36 PID 3040 wrote to memory of 3004 3040 vbc.exe 36 PID 3040 wrote to memory of 3004 3040 vbc.exe 36 PID 2604 wrote to memory of 1388 2604 cmd.exe 41 PID 2616 wrote to memory of 1648 2616 cmd.exe 42 PID 2616 wrote to memory of 1648 2616 cmd.exe 42 PID 2616 wrote to memory of 1648 2616 cmd.exe 42 PID 2616 wrote to memory of 1648 2616 cmd.exe 42 PID 2604 wrote to memory of 1388 2604 cmd.exe 41 PID 2604 wrote to memory of 1388 2604 cmd.exe 41 PID 2604 wrote to memory of 1388 2604 cmd.exe 41 PID 3004 wrote to memory of 1948 3004 cmd.exe 40 PID 3004 wrote to memory of 1948 3004 cmd.exe 40 PID 3004 wrote to memory of 1948 3004 cmd.exe 40 PID 3004 wrote to memory of 1948 3004 cmd.exe 40 PID 780 wrote to memory of 2884 780 cmd.exe 43 PID 780 wrote to memory of 2884 780 cmd.exe 43 PID 780 wrote to memory of 2884 780 cmd.exe 43 PID 780 wrote to memory of 2884 780 cmd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_be5dfafefd95d218c56395ad8be4e984.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_be5dfafefd95d218c56395ad8be4e984.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\Documents\CCleaner.exe"C:\Users\Admin\Documents\CCleaner.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1388
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1648
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2884
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\datacore.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\datacore.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\datacore.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\datacore.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1948
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
304KB
MD51c64303861e301c8143ecdb0e854df66
SHA16e0313ab6a194473d1990eaf7c42a4f4719f82bb
SHA256f06c0cf920298ea9671bd7c9dcec0c40cfa8bdb5f41410771d7234d81dadf4e6
SHA512b2188abc14b5cb51c45432b8bdf1650963e4dbf2ee1d3bf81f8389481da182ab481ddec99bb4db867bd7b914b47a141b1b2953d142360e35b176083db9726740