Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20250207-en -
resource tags
arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system -
submitted
08/02/2025, 03:12
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_be5dfafefd95d218c56395ad8be4e984.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_be5dfafefd95d218c56395ad8be4e984.exe
Resource
win10v2004-20250207-en
General
-
Target
JaffaCakes118_be5dfafefd95d218c56395ad8be4e984.exe
-
Size
436KB
-
MD5
be5dfafefd95d218c56395ad8be4e984
-
SHA1
4d265baa69e0d5a3fa06bf3c5c26fa73e8d71889
-
SHA256
401a6e01982720bc841e947833a9e7abaa5796406236047e9b3456cf9e840f53
-
SHA512
8bb7bc3d9ba10d84a17fc52efe2d666eb531aa0c2a813de8b6363342e7f8c741b4f319ab3f036cbc82641c836b3e5d34be8d4ef3718748429136adaf39983498
-
SSDEEP
12288:LkkZPCkiLG1yt0ZnHp+qYPCz64p7FIIhII:LkNLG1owpKPBW
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 7 IoCs
resource yara_rule behavioral2/memory/4996-25-0x0000000000400000-0x0000000000456000-memory.dmp family_blackshades behavioral2/memory/4996-22-0x0000000000400000-0x0000000000456000-memory.dmp family_blackshades behavioral2/memory/4996-33-0x0000000000400000-0x0000000000456000-memory.dmp family_blackshades behavioral2/memory/4996-34-0x0000000000400000-0x0000000000456000-memory.dmp family_blackshades behavioral2/memory/4996-36-0x0000000000400000-0x0000000000456000-memory.dmp family_blackshades behavioral2/memory/4996-37-0x0000000000400000-0x0000000000456000-memory.dmp family_blackshades behavioral2/memory/4996-46-0x0000000000400000-0x0000000000456000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\datacore.exe = "C:\\Users\\Admin\\AppData\\Roaming\\datacore.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Downloads MZ/PE file 2 IoCs
flow pid Process 35 3192 Process not Found 61 2208 Process not Found -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-189444705-1272902858-1305688695-1000\Control Panel\International\Geo\Nation JaffaCakes118_be5dfafefd95d218c56395ad8be4e984.exe -
Executes dropped EXE 1 IoCs
pid Process 2708 CCleaner.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-189444705-1272902858-1305688695-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CCleaner.exe = "C:\\Users\\Admin\\AppData\\Roaming\\IzYngQyBVxDQNvJiiKSfHa\\IzYngQyBVxDQNvJiiKSfHa\\0.0.0.0\\CCleaner.exe" CCleaner.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2708 set thread context of 4996 2708 CCleaner.exe 90 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCleaner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_be5dfafefd95d218c56395ad8be4e984.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 912 MicrosoftEdgeUpdate.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 232 reg.exe 2304 reg.exe 1912 reg.exe 4720 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 4996 vbc.exe Token: SeCreateTokenPrivilege 4996 vbc.exe Token: SeAssignPrimaryTokenPrivilege 4996 vbc.exe Token: SeLockMemoryPrivilege 4996 vbc.exe Token: SeIncreaseQuotaPrivilege 4996 vbc.exe Token: SeMachineAccountPrivilege 4996 vbc.exe Token: SeTcbPrivilege 4996 vbc.exe Token: SeSecurityPrivilege 4996 vbc.exe Token: SeTakeOwnershipPrivilege 4996 vbc.exe Token: SeLoadDriverPrivilege 4996 vbc.exe Token: SeSystemProfilePrivilege 4996 vbc.exe Token: SeSystemtimePrivilege 4996 vbc.exe Token: SeProfSingleProcessPrivilege 4996 vbc.exe Token: SeIncBasePriorityPrivilege 4996 vbc.exe Token: SeCreatePagefilePrivilege 4996 vbc.exe Token: SeCreatePermanentPrivilege 4996 vbc.exe Token: SeBackupPrivilege 4996 vbc.exe Token: SeRestorePrivilege 4996 vbc.exe Token: SeShutdownPrivilege 4996 vbc.exe Token: SeDebugPrivilege 4996 vbc.exe Token: SeAuditPrivilege 4996 vbc.exe Token: SeSystemEnvironmentPrivilege 4996 vbc.exe Token: SeChangeNotifyPrivilege 4996 vbc.exe Token: SeRemoteShutdownPrivilege 4996 vbc.exe Token: SeUndockPrivilege 4996 vbc.exe Token: SeSyncAgentPrivilege 4996 vbc.exe Token: SeEnableDelegationPrivilege 4996 vbc.exe Token: SeManageVolumePrivilege 4996 vbc.exe Token: SeImpersonatePrivilege 4996 vbc.exe Token: SeCreateGlobalPrivilege 4996 vbc.exe Token: 31 4996 vbc.exe Token: 32 4996 vbc.exe Token: 33 4996 vbc.exe Token: 34 4996 vbc.exe Token: 35 4996 vbc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4996 vbc.exe 4996 vbc.exe 4996 vbc.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 3880 wrote to memory of 2708 3880 JaffaCakes118_be5dfafefd95d218c56395ad8be4e984.exe 89 PID 3880 wrote to memory of 2708 3880 JaffaCakes118_be5dfafefd95d218c56395ad8be4e984.exe 89 PID 3880 wrote to memory of 2708 3880 JaffaCakes118_be5dfafefd95d218c56395ad8be4e984.exe 89 PID 2708 wrote to memory of 4996 2708 CCleaner.exe 90 PID 2708 wrote to memory of 4996 2708 CCleaner.exe 90 PID 2708 wrote to memory of 4996 2708 CCleaner.exe 90 PID 2708 wrote to memory of 4996 2708 CCleaner.exe 90 PID 2708 wrote to memory of 4996 2708 CCleaner.exe 90 PID 2708 wrote to memory of 4996 2708 CCleaner.exe 90 PID 2708 wrote to memory of 4996 2708 CCleaner.exe 90 PID 2708 wrote to memory of 4996 2708 CCleaner.exe 90 PID 4996 wrote to memory of 1656 4996 vbc.exe 91 PID 4996 wrote to memory of 1656 4996 vbc.exe 91 PID 4996 wrote to memory of 1656 4996 vbc.exe 91 PID 4996 wrote to memory of 2436 4996 vbc.exe 92 PID 4996 wrote to memory of 2436 4996 vbc.exe 92 PID 4996 wrote to memory of 2436 4996 vbc.exe 92 PID 4996 wrote to memory of 1356 4996 vbc.exe 93 PID 4996 wrote to memory of 1356 4996 vbc.exe 93 PID 4996 wrote to memory of 1356 4996 vbc.exe 93 PID 4996 wrote to memory of 1972 4996 vbc.exe 94 PID 4996 wrote to memory of 1972 4996 vbc.exe 94 PID 4996 wrote to memory of 1972 4996 vbc.exe 94 PID 1356 wrote to memory of 232 1356 cmd.exe 99 PID 1356 wrote to memory of 232 1356 cmd.exe 99 PID 1356 wrote to memory of 232 1356 cmd.exe 99 PID 2436 wrote to memory of 4720 2436 cmd.exe 100 PID 2436 wrote to memory of 4720 2436 cmd.exe 100 PID 2436 wrote to memory of 4720 2436 cmd.exe 100 PID 1972 wrote to memory of 1912 1972 cmd.exe 101 PID 1972 wrote to memory of 1912 1972 cmd.exe 101 PID 1972 wrote to memory of 1912 1972 cmd.exe 101 PID 1656 wrote to memory of 2304 1656 cmd.exe 102 PID 1656 wrote to memory of 2304 1656 cmd.exe 102 PID 1656 wrote to memory of 2304 1656 cmd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_be5dfafefd95d218c56395ad8be4e984.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_be5dfafefd95d218c56395ad8be4e984.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\Documents\CCleaner.exe"C:\Users\Admin\Documents\CCleaner.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2304
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4720
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:232
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\datacore.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\datacore.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\datacore.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\datacore.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1912
-
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTU1NjA3REItMTNFOS00RUVGLTg2RTAtQUQwQTM4OTQ3QjAyfSIgdXNlcmlkPSJ7NjAyRTZGMkYtRDk1Ni00RDg3LTlFQTItRTAxQUMzMDdDQUJFfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NjVDOTg1MjctQUYwNy00REVCLUFCRDktMjVBMUI3MEZEODIzfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5MjEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODE5ODA3NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODM0NjI4MDYzIi8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:912
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
304KB
MD51c64303861e301c8143ecdb0e854df66
SHA16e0313ab6a194473d1990eaf7c42a4f4719f82bb
SHA256f06c0cf920298ea9671bd7c9dcec0c40cfa8bdb5f41410771d7234d81dadf4e6
SHA512b2188abc14b5cb51c45432b8bdf1650963e4dbf2ee1d3bf81f8389481da182ab481ddec99bb4db867bd7b914b47a141b1b2953d142360e35b176083db9726740