blackshades | 009a051c04943e14465ace1e70616e72c19a29683283e25639e78fa32057d3ff

Analysis

max time kernel
147s
max time network
146s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14/02/2025, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_f35f615e9ef3e6b149ca9231ba44f5a5.exe
Size 532KB
Sample250214-eqexxsslev
SHA256 009a051c04943e14465ace1e70616e72c19a29683283e25639e78fa32057d3ff
MD5 f35f615e9ef3e6b149ca9231ba44f5a5
SHA1 457d866a8e3c77068705d171cb278fc916709e86
SHA512 125b1f0665cd17afa77068676df08b0c76d571ba79c180fa5b97e89a6727d10673789be9513e292bb898f7ec96951a0662128e35cc6071c225d4ac74b49724d0
SSDEEP 12288:gY4wb99Sp/gm8mDavN6f3kemnUrDMinPZEwtQ7Ui4686OhAD+0MOZk8JH2VkX:gm9IgmgvN6fUemnUPMixEw2Ac87GD+0X
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackshades defense_evasion discovery persistence rat

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 12 IoCs

resource	yara_rule
behavioral1/memory/2920-26-0x0000000000400000-0x0000000000459000-memory.dmp	family_blackshades
behavioral1/memory/2920-22-0x0000000000400000-0x0000000000459000-memory.dmp	family_blackshades
behavioral1/memory/2920-38-0x0000000000400000-0x0000000000459000-memory.dmp	family_blackshades
behavioral1/memory/2920-39-0x0000000000400000-0x0000000000459000-memory.dmp	family_blackshades
behavioral1/memory/2920-40-0x0000000000400000-0x0000000000459000-memory.dmp	family_blackshades
behavioral1/memory/2920-41-0x0000000000400000-0x0000000000459000-memory.dmp	family_blackshades
behavioral1/memory/2920-43-0x0000000000400000-0x0000000000459000-memory.dmp	family_blackshades
behavioral1/memory/2920-45-0x0000000000400000-0x0000000000459000-memory.dmp	family_blackshades
behavioral1/memory/2920-47-0x0000000000400000-0x0000000000459000-memory.dmp	family_blackshades
behavioral1/memory/2920-51-0x0000000000400000-0x0000000000459000-memory.dmp	family_blackshades
behavioral1/memory/2920-53-0x0000000000400000-0x0000000000459000-memory.dmp	family_blackshades
behavioral1/memory/2920-58-0x0000000000400000-0x0000000000459000-memory.dmp	family_blackshades

Modifies firewall policy service 3 TTPs 8 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\csrss.exe = "C:\\Users\\Admin\\AppData\\Roaming\\csrss.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\local.exe = "C:\\Users\\Admin\\AppData\\Roaming\\local.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1BD94DF7-A5DF-CCF8-EFD0-577AAFCC185B}	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1BD94DF7-A5DF-CCF8-EFD0-577AAFCC185B}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\local.exe"	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{1BD94DF7-A5DF-CCF8-EFD0-577AAFCC185B}	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Active Setup\Installed Components\{1BD94DF7-A5DF-CCF8-EFD0-577AAFCC185B}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\local.exe"	csrss.exe

Executes dropped EXE 1 IoCs

pid	Process
2920	csrss.exe

Loads dropped DLL 5 IoCs

pid	Process
2528	JaffaCakes118_f35f615e9ef3e6b149ca9231ba44f5a5.exe
2528	JaffaCakes118_f35f615e9ef3e6b149ca9231ba44f5a5.exe
2528	JaffaCakes118_f35f615e9ef3e6b149ca9231ba44f5a5.exe
2528	JaffaCakes118_f35f615e9ef3e6b149ca9231ba44f5a5.exe
2528	JaffaCakes118_f35f615e9ef3e6b149ca9231ba44f5a5.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2528 set thread context of 2920	2528	JaffaCakes118_f35f615e9ef3e6b149ca9231ba44f5a5.exe	30

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_f35f615e9ef3e6b149ca9231ba44f5a5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
2192	reg.exe
2540	reg.exe
2552	reg.exe
1336	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: 1	2920	csrss.exe
Token: SeCreateTokenPrivilege	2920	csrss.exe
Token: SeAssignPrimaryTokenPrivilege	2920	csrss.exe
Token: SeLockMemoryPrivilege	2920	csrss.exe
Token: SeIncreaseQuotaPrivilege	2920	csrss.exe
Token: SeMachineAccountPrivilege	2920	csrss.exe
Token: SeTcbPrivilege	2920	csrss.exe
Token: SeSecurityPrivilege	2920	csrss.exe
Token: SeTakeOwnershipPrivilege	2920	csrss.exe
Token: SeLoadDriverPrivilege	2920	csrss.exe
Token: SeSystemProfilePrivilege	2920	csrss.exe
Token: SeSystemtimePrivilege	2920	csrss.exe
Token: SeProfSingleProcessPrivilege	2920	csrss.exe
Token: SeIncBasePriorityPrivilege	2920	csrss.exe
Token: SeCreatePagefilePrivilege	2920	csrss.exe
Token: SeCreatePermanentPrivilege	2920	csrss.exe
Token: SeBackupPrivilege	2920	csrss.exe
Token: SeRestorePrivilege	2920	csrss.exe
Token: SeShutdownPrivilege	2920	csrss.exe
Token: SeDebugPrivilege	2920	csrss.exe
Token: SeAuditPrivilege	2920	csrss.exe
Token: SeSystemEnvironmentPrivilege	2920	csrss.exe
Token: SeChangeNotifyPrivilege	2920	csrss.exe
Token: SeRemoteShutdownPrivilege	2920	csrss.exe
Token: SeUndockPrivilege	2920	csrss.exe
Token: SeSyncAgentPrivilege	2920	csrss.exe
Token: SeEnableDelegationPrivilege	2920	csrss.exe
Token: SeManageVolumePrivilege	2920	csrss.exe
Token: SeImpersonatePrivilege	2920	csrss.exe
Token: SeCreateGlobalPrivilege	2920	csrss.exe
Token: 31	2920	csrss.exe
Token: 32	2920	csrss.exe
Token: 33	2920	csrss.exe
Token: 34	2920	csrss.exe
Token: 35	2920	csrss.exe
Token: SeDebugPrivilege	2920	csrss.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2920	csrss.exe
2920	csrss.exe
2920	csrss.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2920	2528	JaffaCakes118_f35f615e9ef3e6b149ca9231ba44f5a5.exe	30
PID 2528 wrote to memory of 2920	2528	JaffaCakes118_f35f615e9ef3e6b149ca9231ba44f5a5.exe	30
PID 2528 wrote to memory of 2920	2528	JaffaCakes118_f35f615e9ef3e6b149ca9231ba44f5a5.exe	30
PID 2528 wrote to memory of 2920	2528	JaffaCakes118_f35f615e9ef3e6b149ca9231ba44f5a5.exe	30
PID 2528 wrote to memory of 2920	2528	JaffaCakes118_f35f615e9ef3e6b149ca9231ba44f5a5.exe	30
PID 2528 wrote to memory of 2920	2528	JaffaCakes118_f35f615e9ef3e6b149ca9231ba44f5a5.exe	30
PID 2528 wrote to memory of 2920	2528	JaffaCakes118_f35f615e9ef3e6b149ca9231ba44f5a5.exe	30
PID 2528 wrote to memory of 2920	2528	JaffaCakes118_f35f615e9ef3e6b149ca9231ba44f5a5.exe	30
PID 2920 wrote to memory of 636	2920	csrss.exe	31
PID 2920 wrote to memory of 636	2920	csrss.exe	31
PID 2920 wrote to memory of 636	2920	csrss.exe	31
PID 2920 wrote to memory of 636	2920	csrss.exe	31
PID 2920 wrote to memory of 2792	2920	csrss.exe	32
PID 2920 wrote to memory of 2792	2920	csrss.exe	32
PID 2920 wrote to memory of 2792	2920	csrss.exe	32
PID 2920 wrote to memory of 2792	2920	csrss.exe	32
PID 2920 wrote to memory of 2884	2920	csrss.exe	34
PID 2920 wrote to memory of 2884	2920	csrss.exe	34
PID 2920 wrote to memory of 2884	2920	csrss.exe	34
PID 2920 wrote to memory of 2884	2920	csrss.exe	34
PID 2920 wrote to memory of 2824	2920	csrss.exe	36
PID 2920 wrote to memory of 2824	2920	csrss.exe	36
PID 2920 wrote to memory of 2824	2920	csrss.exe	36
PID 2920 wrote to memory of 2824	2920	csrss.exe	36
PID 636 wrote to memory of 2540	636	cmd.exe	41
PID 636 wrote to memory of 2540	636	cmd.exe	41
PID 636 wrote to memory of 2540	636	cmd.exe	41
PID 636 wrote to memory of 2540	636	cmd.exe	41
PID 2792 wrote to memory of 1336	2792	cmd.exe	39
PID 2792 wrote to memory of 1336	2792	cmd.exe	39
PID 2792 wrote to memory of 1336	2792	cmd.exe	39
PID 2792 wrote to memory of 1336	2792	cmd.exe	39
PID 2824 wrote to memory of 2192	2824	cmd.exe	42
PID 2884 wrote to memory of 2552	2884	cmd.exe	40
PID 2824 wrote to memory of 2192	2824	cmd.exe	42
PID 2824 wrote to memory of 2192	2824	cmd.exe	42
PID 2824 wrote to memory of 2192	2824	cmd.exe	42
PID 2884 wrote to memory of 2552	2884	cmd.exe	40
PID 2884 wrote to memory of 2552	2884	cmd.exe	40
PID 2884 wrote to memory of 2552	2884	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f35f615e9ef3e6b149ca9231ba44f5a5.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f35f615e9ef3e6b149ca9231ba44f5a5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Users\Admin\AppData\Roaming\csrss.exe
  C:\Users\Admin\AppData\Roaming\csrss.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:636
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2540
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\csrss.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\csrss.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\csrss.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\csrss.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1336
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2552
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\local.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\local.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\local.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\local.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SystmCore.dll

Path \Users\Admin\AppData\Local\Temp\SystmCore.dll
Size 14KB
SHA256 49fd0e58f38e168384ab018ecee80306ac15232caec842e9f4554c8092593483
MD5 9a52fa5c6808030bb7da38600efd120b
SHA1 7169d46e1ba6615049e4672218aad8df5d8dc51c
SHA512 7563fe497bc254f86460a3704b2c090b85b8c9b0926b8835301e6a09626c2b6492eb764771dcf56c4902d34789566756aa60369377d9c2a57d5fbb24e955127a
SSDEEP 384:nbz9WiNfkovNxyWXSWrqrFc56sLRSP5U6:rfkoFxNCW6cUU6
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path \Users\Admin\AppData\Roaming\csrss.exe
Size 16KB
SHA256 bd0dcf9172a64c1252b6981fefce79c9453f4e78a8a70e0e68a73b31acdb2345
MD5 d6d07e6938d8cf0181ebe5e26b2cd8cf
SHA1 534f2b8dacfc282abfa92469aa1209c6ab891a44
SHA512 5a1cd880b39a7919d56971a3a236283976e8b723c71bf520aedf468a6290db88dff8f85a6c83ca2522f04ea46e0ccea975512daa1de7b1926687b4db95918696
SSDEEP 48:yrn/mzcDGX6UU2zN5xigmCk0sbCPQbkr5DNC8ObAcw3w/NK2:en+B6IzN9mRbCYbINNXs3Hk2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2528-33-0x0000000074C50000-0x00000000751FB000-memory.dmp

Download

memory/2528-1-0x0000000074C50000-0x00000000751FB000-memory.dmp

Download

memory/2528-2-0x0000000074C50000-0x00000000751FB000-memory.dmp

Download

memory/2528-0-0x0000000074C51000-0x0000000074C52000-memory.dmp

Download

memory/2920-19-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2920-40-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2920-22-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2920-20-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2920-26-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2920-38-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2920-39-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2920-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2920-41-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2920-43-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2920-45-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2920-47-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2920-51-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2920-53-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/2920-58-0x0000000000400000-0x0000000000459000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads