Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250207-en -
resource tags
arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2025, 07:42
Static task
static1
Behavioral task
behavioral1
Sample
Anonymous DoSer.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
Anonymous DoSer.exe
Resource
win10v2004-20250207-en
General
-
Target
Anonymous DoSer.exe
-
Size
601KB
-
MD5
b86e117d120264bf7d165ed578843510
-
SHA1
e58eabd02b51b5c2ff150ec45fdecf5430ee43ca
-
SHA256
e94454d2825d2bf6a1580988162767d29ab0a73589aee93fd9183d81fdd6c307
-
SHA512
c745b197dfc560e1a1e492fabf6c088e480a5c5e6ed1a405ac7a2ec7060c20b115735f7d8208b5f5fef5b7bc9f9116f279f7acb86b50d4266ff28b39533a75be
-
SSDEEP
12288:w7Spt6JMt1HOuS3lPvTX8u/CdrnW952xSHriovgvgYVK8h/quFt:w7S/6q/HOjPrN8nWnwSngvUEB
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 15 IoCs
resource yara_rule behavioral2/memory/2608-15-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral2/memory/2608-18-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral2/memory/2608-29-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral2/memory/2608-32-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral2/memory/2608-34-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral2/memory/2608-35-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral2/memory/2608-37-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral2/memory/2608-38-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral2/memory/2608-40-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral2/memory/2608-41-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral2/memory/2608-43-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral2/memory/2608-44-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral2/memory/2608-45-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral2/memory/2608-48-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades behavioral2/memory/2608-49-0x0000000000400000-0x0000000000478000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe:*:Enabled:Windows Messanger" reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\DDos.exe = "C:\\Users\\Admin\\AppData\\Roaming\\DDos.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Downloads MZ/PE file 1 IoCs
flow pid Process 44 4240 Process not Found -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3932017190-1449707826-1445630-1000\Control Panel\International\Geo\Nation Anonymous DoSer.exe -
Executes dropped EXE 1 IoCs
pid Process 2284 812848259.exe -
Uses the VBS compiler for execution 1 TTPs
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini Anonymous DoSer.exe File opened for modification C:\Windows\assembly\Desktop.ini Anonymous DoSer.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2336 set thread context of 2608 2336 Anonymous DoSer.exe 91 -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly Anonymous DoSer.exe File created C:\Windows\assembly\Desktop.ini Anonymous DoSer.exe File opened for modification C:\Windows\assembly\Desktop.ini Anonymous DoSer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Anonymous DoSer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 812848259.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4704 MicrosoftEdgeUpdate.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 4016 reg.exe 4716 reg.exe 840 reg.exe 3020 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 2336 Anonymous DoSer.exe Token: 1 2608 vbc.exe Token: SeCreateTokenPrivilege 2608 vbc.exe Token: SeAssignPrimaryTokenPrivilege 2608 vbc.exe Token: SeLockMemoryPrivilege 2608 vbc.exe Token: SeIncreaseQuotaPrivilege 2608 vbc.exe Token: SeMachineAccountPrivilege 2608 vbc.exe Token: SeTcbPrivilege 2608 vbc.exe Token: SeSecurityPrivilege 2608 vbc.exe Token: SeTakeOwnershipPrivilege 2608 vbc.exe Token: SeLoadDriverPrivilege 2608 vbc.exe Token: SeSystemProfilePrivilege 2608 vbc.exe Token: SeSystemtimePrivilege 2608 vbc.exe Token: SeProfSingleProcessPrivilege 2608 vbc.exe Token: SeIncBasePriorityPrivilege 2608 vbc.exe Token: SeCreatePagefilePrivilege 2608 vbc.exe Token: SeCreatePermanentPrivilege 2608 vbc.exe Token: SeBackupPrivilege 2608 vbc.exe Token: SeRestorePrivilege 2608 vbc.exe Token: SeShutdownPrivilege 2608 vbc.exe Token: SeDebugPrivilege 2608 vbc.exe Token: SeAuditPrivilege 2608 vbc.exe Token: SeSystemEnvironmentPrivilege 2608 vbc.exe Token: SeChangeNotifyPrivilege 2608 vbc.exe Token: SeRemoteShutdownPrivilege 2608 vbc.exe Token: SeUndockPrivilege 2608 vbc.exe Token: SeSyncAgentPrivilege 2608 vbc.exe Token: SeEnableDelegationPrivilege 2608 vbc.exe Token: SeManageVolumePrivilege 2608 vbc.exe Token: SeImpersonatePrivilege 2608 vbc.exe Token: SeCreateGlobalPrivilege 2608 vbc.exe Token: 31 2608 vbc.exe Token: 32 2608 vbc.exe Token: 33 2608 vbc.exe Token: 34 2608 vbc.exe Token: 35 2608 vbc.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2608 vbc.exe 2608 vbc.exe 2608 vbc.exe 2608 vbc.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2284 2336 Anonymous DoSer.exe 89 PID 2336 wrote to memory of 2284 2336 Anonymous DoSer.exe 89 PID 2336 wrote to memory of 2284 2336 Anonymous DoSer.exe 89 PID 2336 wrote to memory of 2608 2336 Anonymous DoSer.exe 91 PID 2336 wrote to memory of 2608 2336 Anonymous DoSer.exe 91 PID 2336 wrote to memory of 2608 2336 Anonymous DoSer.exe 91 PID 2336 wrote to memory of 2608 2336 Anonymous DoSer.exe 91 PID 2336 wrote to memory of 2608 2336 Anonymous DoSer.exe 91 PID 2336 wrote to memory of 2608 2336 Anonymous DoSer.exe 91 PID 2336 wrote to memory of 2608 2336 Anonymous DoSer.exe 91 PID 2336 wrote to memory of 2608 2336 Anonymous DoSer.exe 91 PID 2608 wrote to memory of 4392 2608 vbc.exe 92 PID 2608 wrote to memory of 4392 2608 vbc.exe 92 PID 2608 wrote to memory of 4392 2608 vbc.exe 92 PID 2608 wrote to memory of 1036 2608 vbc.exe 93 PID 2608 wrote to memory of 1036 2608 vbc.exe 93 PID 2608 wrote to memory of 1036 2608 vbc.exe 93 PID 2608 wrote to memory of 4828 2608 vbc.exe 94 PID 2608 wrote to memory of 4828 2608 vbc.exe 94 PID 2608 wrote to memory of 4828 2608 vbc.exe 94 PID 2608 wrote to memory of 4944 2608 vbc.exe 95 PID 2608 wrote to memory of 4944 2608 vbc.exe 95 PID 2608 wrote to memory of 4944 2608 vbc.exe 95 PID 4828 wrote to memory of 4016 4828 cmd.exe 100 PID 4828 wrote to memory of 4016 4828 cmd.exe 100 PID 4828 wrote to memory of 4016 4828 cmd.exe 100 PID 4392 wrote to memory of 4716 4392 cmd.exe 101 PID 4392 wrote to memory of 4716 4392 cmd.exe 101 PID 4392 wrote to memory of 4716 4392 cmd.exe 101 PID 1036 wrote to memory of 3020 1036 cmd.exe 102 PID 1036 wrote to memory of 3020 1036 cmd.exe 102 PID 1036 wrote to memory of 3020 1036 cmd.exe 102 PID 4944 wrote to memory of 840 4944 cmd.exe 103 PID 4944 wrote to memory of 840 4944 cmd.exe 103 PID 4944 wrote to memory of 840 4944 cmd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\Anonymous DoSer.exe"C:\Users\Admin\AppData\Local\Temp\Anonymous DoSer.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\812848259.exe"C:\Users\Admin\AppData\Local\Temp\812848259.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2284
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\\vbc.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4716
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3020
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4016
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\DDos.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\DDos.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\DDos.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\DDos.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:840
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTBFQzI0RDctMTE1RC00NTA5LUI1OUUtM0MzMTg1ODE2OUE3fSIgdXNlcmlkPSJ7RjQ4ODJCRTgtRDg4Qi00Mjg4LTk3MEEtM0IwMDJDMjA0MjIxfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RkUyRjgwQzctNzNFNy00MjgzLThCNDgtMzhBQ0FDOEY4Njg3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI2IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY0MzMiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODc1OTU2NTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjU1ODA2NDY2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4704
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
278KB
MD5270f2f56af0de91cc5f0b83ed241851b
SHA17b0ea98bb83ca8be24e62b2f68133f43867e6403
SHA2561a9e73e0e877edd16882dcc866467e7ee817efad6ef68a7de82c2c12b2e566fe
SHA512b8b4b06503cbc9da38a898088f8031b44ee0e4dd415f2ab853b360fd3065a37df7d63383913948cbc475669a6c5aaff6a20379d5bd89bbfa4c9510bff4e42597