Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250211-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/02/2025, 06:25

General

  • Target

    JaffaCakes118_f48d6c15b59cca769248eb3408fdbcc1.exe

  • Size

    548KB

  • MD5

    f48d6c15b59cca769248eb3408fdbcc1

  • SHA1

    3e980f2a4cf07475ab12731d3e52c16775e977d0

  • SHA256

    3a319914b0d3bb4bb1c1be69b93dc2df6a7488c6728f8692442670e87fb09a38

  • SHA512

    d2ba75f81caa10689b325d66a7736deff8a8bc5925cd3d01880f476d6cb11c1e47d3963ce0c7094dc3f4b12b1f4a1ffb55e4ae2ddf1801abd01b0bbbe289eea2

  • SSDEEP

    12288:frrbkU9bmTBQPLlqJD0Dr7OE6d2x2V/YRfL9YWkMd0br8vt:DPkUF7PpEDOr7Ofde2VWf+WkF/

Malware Config

Signatures

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

  • Blackshades family
  • Blackshades payload 14 IoCs
  • Modifies firewall policy service 3 TTPs 10 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Downloads MZ/PE file 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f48d6c15b59cca769248eb3408fdbcc1.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f48d6c15b59cca769248eb3408fdbcc1.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1912
    • C:\Users\Admin\AppData\Roaming\JaffaCakes118_f48d6c15b59cca769248eb3408fdbcc1.exe
      C:\Users\Admin\AppData\Roaming\JaffaCakes118_f48d6c15b59cca769248eb3408fdbcc1.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3824
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2528
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies firewall policy service
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:1200
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JaffaCakes118_f48d6c15b59cca769248eb3408fdbcc1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JaffaCakes118_f48d6c15b59cca769248eb3408fdbcc1.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1652
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JaffaCakes118_f48d6c15b59cca769248eb3408fdbcc1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JaffaCakes118_f48d6c15b59cca769248eb3408fdbcc1.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • Modifies firewall policy service
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:4160
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3056
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies firewall policy service
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:1868
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Youtube.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Youtube.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1204
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Youtube.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Youtube.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • Modifies firewall policy service
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:2256
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTE0NEY1MTYtNUJDNS00ODlCLTlDNkEtQ0YyM0JBRTMyODc0fSIgdXNlcmlkPSJ7Q0IxNTFCNTItMDYxNy00RUFDLThCQTEtMjdFMUU4NUY5Qjg1fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7Q0E5RUJBMkItRkFFOS00ODk1LTg1NzctMDk5N0VBODExQjlGfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODM0MTAiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NTUzNjg2NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1ODY2NDY0MzI2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:3524

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\GetProcAddress.dll

    Filesize

    15KB

    MD5

    0254f8bb5bcb4e8c1a3a47ffa27bbe0e

    SHA1

    093b480409486d7a0585132a7db7dec57d12ae64

    SHA256

    6e8991e5ed5af7582b4855d51dd5fb2818f8406db3f14bfaaa857aff1c15d28f

    SHA512

    009877f541d6f779a64d5b0f10e28e8b2815bf10b906264997f3e941c5c8be1d611b1137b2898ba482a5d8fbfb27431ea45225bc1197aa3671fd3f6029f16b88

  • C:\Users\Admin\AppData\Roaming\JaffaCakes118_f48d6c15b59cca769248eb3408fdbcc1.exe

    Filesize

    16KB

    MD5

    1761e13c73655dd58a651dda683bec99

    SHA1

    596329d5657b4d25f85fe8aea6b36ecab3abda0b

    SHA256

    e070ac247fe664012120397ab70d58f6476dbd9e79b8f9c4475be9ab7a14834d

    SHA512

    aa9f4bbf1b2e87bd8445debff47489b33a5aa70e7ba7729982abcab38335c41b47bb1daf0d35e901185931f1b7f688ee7caa7111f94d8d36fa4d1ee217f3d196

  • memory/1912-26-0x0000000073DE2000-0x0000000073DE3000-memory.dmp

    Filesize

    4KB

  • memory/1912-1-0x0000000073DE0000-0x0000000074391000-memory.dmp

    Filesize

    5.7MB

  • memory/1912-2-0x0000000073DE0000-0x0000000074391000-memory.dmp

    Filesize

    5.7MB

  • memory/1912-0-0x0000000073DE2000-0x0000000073DE3000-memory.dmp

    Filesize

    4KB

  • memory/1912-27-0x0000000073DE0000-0x0000000074391000-memory.dmp

    Filesize

    5.7MB

  • memory/3824-29-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/3824-35-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/3824-28-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/3824-16-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/3824-31-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/3824-32-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/3824-33-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/3824-20-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/3824-37-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/3824-38-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/3824-39-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/3824-41-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/3824-42-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/3824-43-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB