Analysis
-
max time kernel
147s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/02/2025, 10:46
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe
Resource
win10v2004-20250211-en
General
-
Target
JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe
-
Size
717KB
-
MD5
f6ee85eacb0bfc71d7bd16db9dd1831a
-
SHA1
7e02f05972c0cbb8c1dbcac89cfdb4ede5f58816
-
SHA256
bcc59c36fee704a490b39ce997df768e3226c5b6804c47cfef913d2eb00057b4
-
SHA512
4c4326ab47963ad98c5beeba7749f21195f61b121b92a0fc49d54365a993671e9af578cb3dbfcdc349548b435d6ae121fd14ba21bd431002a2249e185d8825e0
-
SSDEEP
12288:wjolOXNuJO5KmjqZ859MWaDWcSWnAqkNBW73LUXf/K2i0qfR:i+vmqs9EnAg73L
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 13 IoCs
resource yara_rule behavioral1/memory/2552-20-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral1/memory/2552-31-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral1/memory/2552-40-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral1/memory/2552-60-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral1/memory/2552-61-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral1/memory/2552-62-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral1/memory/2552-64-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral1/memory/2552-65-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral1/memory/2552-66-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral1/memory/2552-68-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral1/memory/2552-69-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral1/memory/2552-70-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral1/memory/2552-72-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\windows = "C:\\Users\\Admin\\AppData\\Roaming\\cmd.exe" svchost.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Active Setup\Installed Components\{63D6BB9C-A746-3CD0-1E1D-E5BED9CDAA5B}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\cmd.exe" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{63D6BB9C-A746-3CD0-1E1D-E5BED9CDAA5B} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{63D6BB9C-A746-3CD0-1E1D-E5BED9CDAA5B}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\cmd.exe" svchost.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{63D6BB9C-A746-3CD0-1E1D-E5BED9CDAA5B} svchost.exe -
Executes dropped EXE 5 IoCs
pid Process 2552 svchost.exe 2212 cmd.exe 2592 cmd.exe 1140 cmd.exe 2764 cmd.exe -
Loads dropped DLL 7 IoCs
pid Process 2420 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 2420 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinZip = "C:\\Users\\Admin\\AppData\\Roaming\\Mw3 Extreme Hack Pack.exe" JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\windows = "C:\\Users\\Admin\\AppData\\Roaming\\cmd.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\windows = "C:\\Users\\Admin\\AppData\\Roaming\\cmd.exe" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2420 set thread context of 2552 2420 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Kills process with taskkill 1 IoCs
pid Process 2772 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2420 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe -
Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeDebugPrivilege 2420 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe Token: SeDebugPrivilege 2772 taskkill.exe Token: 1 2552 svchost.exe Token: SeCreateTokenPrivilege 2552 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2552 svchost.exe Token: SeLockMemoryPrivilege 2552 svchost.exe Token: SeIncreaseQuotaPrivilege 2552 svchost.exe Token: SeMachineAccountPrivilege 2552 svchost.exe Token: SeTcbPrivilege 2552 svchost.exe Token: SeSecurityPrivilege 2552 svchost.exe Token: SeTakeOwnershipPrivilege 2552 svchost.exe Token: SeLoadDriverPrivilege 2552 svchost.exe Token: SeSystemProfilePrivilege 2552 svchost.exe Token: SeSystemtimePrivilege 2552 svchost.exe Token: SeProfSingleProcessPrivilege 2552 svchost.exe Token: SeIncBasePriorityPrivilege 2552 svchost.exe Token: SeCreatePagefilePrivilege 2552 svchost.exe Token: SeCreatePermanentPrivilege 2552 svchost.exe Token: SeBackupPrivilege 2552 svchost.exe Token: SeRestorePrivilege 2552 svchost.exe Token: SeShutdownPrivilege 2552 svchost.exe Token: SeDebugPrivilege 2552 svchost.exe Token: SeAuditPrivilege 2552 svchost.exe Token: SeSystemEnvironmentPrivilege 2552 svchost.exe Token: SeChangeNotifyPrivilege 2552 svchost.exe Token: SeRemoteShutdownPrivilege 2552 svchost.exe Token: SeUndockPrivilege 2552 svchost.exe Token: SeSyncAgentPrivilege 2552 svchost.exe Token: SeEnableDelegationPrivilege 2552 svchost.exe Token: SeManageVolumePrivilege 2552 svchost.exe Token: SeImpersonatePrivilege 2552 svchost.exe Token: SeCreateGlobalPrivilege 2552 svchost.exe Token: 31 2552 svchost.exe Token: 32 2552 svchost.exe Token: 33 2552 svchost.exe Token: 34 2552 svchost.exe Token: 35 2552 svchost.exe Token: SeDebugPrivilege 2552 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2792 2420 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 30 PID 2420 wrote to memory of 2792 2420 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 30 PID 2420 wrote to memory of 2792 2420 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 30 PID 2420 wrote to memory of 2792 2420 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 30 PID 2792 wrote to memory of 2772 2792 cmd.exe 32 PID 2792 wrote to memory of 2772 2792 cmd.exe 32 PID 2792 wrote to memory of 2772 2792 cmd.exe 32 PID 2792 wrote to memory of 2772 2792 cmd.exe 32 PID 2420 wrote to memory of 2552 2420 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 34 PID 2420 wrote to memory of 2552 2420 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 34 PID 2420 wrote to memory of 2552 2420 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 34 PID 2420 wrote to memory of 2552 2420 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 34 PID 2420 wrote to memory of 2552 2420 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 34 PID 2420 wrote to memory of 2552 2420 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 34 PID 2420 wrote to memory of 2552 2420 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 34 PID 2420 wrote to memory of 2552 2420 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 34 PID 2420 wrote to memory of 2552 2420 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 34 PID 2552 wrote to memory of 2212 2552 svchost.exe 35 PID 2552 wrote to memory of 2212 2552 svchost.exe 35 PID 2552 wrote to memory of 2212 2552 svchost.exe 35 PID 2552 wrote to memory of 2212 2552 svchost.exe 35 PID 2552 wrote to memory of 2592 2552 svchost.exe 36 PID 2552 wrote to memory of 2592 2552 svchost.exe 36 PID 2552 wrote to memory of 2592 2552 svchost.exe 36 PID 2552 wrote to memory of 2592 2552 svchost.exe 36 PID 2552 wrote to memory of 1140 2552 svchost.exe 37 PID 2552 wrote to memory of 1140 2552 svchost.exe 37 PID 2552 wrote to memory of 1140 2552 svchost.exe 37 PID 2552 wrote to memory of 1140 2552 svchost.exe 37 PID 2552 wrote to memory of 2764 2552 svchost.exe 38 PID 2552 wrote to memory of 2764 2552 svchost.exe 38 PID 2552 wrote to memory of 2764 2552 svchost.exe 38 PID 2552 wrote to memory of 2764 2552 svchost.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\caiz.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\taskkill.exeTASKKILL /F /IM C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
-
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe2⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Roaming\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Executes dropped EXE
PID:2212
-
-
C:\Users\Admin\AppData\Roaming\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f3⤵
- Executes dropped EXE
PID:2592
-
-
C:\Users\Admin\AppData\Roaming\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Executes dropped EXE
PID:1140
-
-
C:\Users\Admin\AppData\Roaming\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\cmd.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\cmd.exe:*:Enabled:Windows Messanger" /f3⤵
- Executes dropped EXE
PID:2764
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
241B
MD541abe8cebca457c058878ce71dbcad47
SHA143171d72950c7e0090c99aada96a7d2a1822e862
SHA25639610d0acc80b2f4c6c780998c34be8f9fa9bef2a6b4f146df10f4473e67d37e
SHA512fdc915390ad24022bd1b18c3b990c7caadc96c504894aa4c508c02d3c9660a739c6eebbef40c3dd07752a50c5cf4c181da2d09fa35baf1fafff5f9ccf678d871
-
Filesize
1KB
MD55b032d6dbc63d830be5ffa5dd679247a
SHA1c3553f08c562034ff156b8c776be714b8af618f6
SHA25630f4f452fc8ef6f5fbb5cdc2b5ca39eac48a634f1c328fa8dfe624616f295ada
SHA512859bc96f0551dd23d0b84165e07e3fa78fa970c347c9925ce243931225074b4ae514f34484090d83250b49e377f63736b12c72db1403321d4da9d7e4d1542d90