Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250211-en -
resource tags
arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2025, 10:46
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe
Resource
win10v2004-20250211-en
General
-
Target
JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe
-
Size
717KB
-
MD5
f6ee85eacb0bfc71d7bd16db9dd1831a
-
SHA1
7e02f05972c0cbb8c1dbcac89cfdb4ede5f58816
-
SHA256
bcc59c36fee704a490b39ce997df768e3226c5b6804c47cfef913d2eb00057b4
-
SHA512
4c4326ab47963ad98c5beeba7749f21195f61b121b92a0fc49d54365a993671e9af578cb3dbfcdc349548b435d6ae121fd14ba21bd431002a2249e185d8825e0
-
SSDEEP
12288:wjolOXNuJO5KmjqZ859MWaDWcSWnAqkNBW73LUXf/K2i0qfR:i+vmqs9EnAg73L
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 13 IoCs
resource yara_rule behavioral2/memory/4496-10-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4496-14-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4496-26-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4496-41-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4496-44-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4496-47-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4496-51-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4496-54-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4496-57-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4496-61-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4496-64-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4496-67-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4496-71-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\windows = "C:\\Users\\Admin\\AppData\\Roaming\\cmd.exe" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run svchost.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2656314083-4170277356-267438488-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{63D6BB9C-A746-3CD0-1E1D-E5BED9CDAA5B}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\cmd.exe" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{63D6BB9C-A746-3CD0-1E1D-E5BED9CDAA5B} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{63D6BB9C-A746-3CD0-1E1D-E5BED9CDAA5B}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\cmd.exe" svchost.exe Key created \REGISTRY\USER\S-1-5-21-2656314083-4170277356-267438488-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{63D6BB9C-A746-3CD0-1E1D-E5BED9CDAA5B} svchost.exe -
Downloads MZ/PE file 1 IoCs
flow pid Process 22 2972 Process not Found -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2656314083-4170277356-267438488-1000\Control Panel\International\Geo\Nation JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe -
Executes dropped EXE 5 IoCs
pid Process 4496 svchost.exe 3520 cmd.exe 2100 cmd.exe 4872 cmd.exe 4532 cmd.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2656314083-4170277356-267438488-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinZip = "C:\\Users\\Admin\\AppData\\Roaming\\Mw3 Extreme Hack Pack.exe" JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\windows = "C:\\Users\\Admin\\AppData\\Roaming\\cmd.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2656314083-4170277356-267438488-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows = "C:\\Users\\Admin\\AppData\\Roaming\\cmd.exe" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1784 set thread context of 4496 1784 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 93 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4876 MicrosoftEdgeUpdate.exe -
Kills process with taskkill 1 IoCs
pid Process 1524 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1784 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe -
Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeDebugPrivilege 1784 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe Token: SeDebugPrivilege 1524 taskkill.exe Token: 1 4496 svchost.exe Token: SeCreateTokenPrivilege 4496 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4496 svchost.exe Token: SeLockMemoryPrivilege 4496 svchost.exe Token: SeIncreaseQuotaPrivilege 4496 svchost.exe Token: SeMachineAccountPrivilege 4496 svchost.exe Token: SeTcbPrivilege 4496 svchost.exe Token: SeSecurityPrivilege 4496 svchost.exe Token: SeTakeOwnershipPrivilege 4496 svchost.exe Token: SeLoadDriverPrivilege 4496 svchost.exe Token: SeSystemProfilePrivilege 4496 svchost.exe Token: SeSystemtimePrivilege 4496 svchost.exe Token: SeProfSingleProcessPrivilege 4496 svchost.exe Token: SeIncBasePriorityPrivilege 4496 svchost.exe Token: SeCreatePagefilePrivilege 4496 svchost.exe Token: SeCreatePermanentPrivilege 4496 svchost.exe Token: SeBackupPrivilege 4496 svchost.exe Token: SeRestorePrivilege 4496 svchost.exe Token: SeShutdownPrivilege 4496 svchost.exe Token: SeDebugPrivilege 4496 svchost.exe Token: SeAuditPrivilege 4496 svchost.exe Token: SeSystemEnvironmentPrivilege 4496 svchost.exe Token: SeChangeNotifyPrivilege 4496 svchost.exe Token: SeRemoteShutdownPrivilege 4496 svchost.exe Token: SeUndockPrivilege 4496 svchost.exe Token: SeSyncAgentPrivilege 4496 svchost.exe Token: SeEnableDelegationPrivilege 4496 svchost.exe Token: SeManageVolumePrivilege 4496 svchost.exe Token: SeImpersonatePrivilege 4496 svchost.exe Token: SeCreateGlobalPrivilege 4496 svchost.exe Token: 31 4496 svchost.exe Token: 32 4496 svchost.exe Token: 33 4496 svchost.exe Token: 34 4496 svchost.exe Token: 35 4496 svchost.exe Token: SeDebugPrivilege 4496 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4496 svchost.exe 4496 svchost.exe 4496 svchost.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1784 wrote to memory of 1408 1784 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 89 PID 1784 wrote to memory of 1408 1784 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 89 PID 1784 wrote to memory of 1408 1784 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 89 PID 1408 wrote to memory of 1524 1408 cmd.exe 91 PID 1408 wrote to memory of 1524 1408 cmd.exe 91 PID 1408 wrote to memory of 1524 1408 cmd.exe 91 PID 1784 wrote to memory of 4496 1784 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 93 PID 1784 wrote to memory of 4496 1784 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 93 PID 1784 wrote to memory of 4496 1784 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 93 PID 1784 wrote to memory of 4496 1784 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 93 PID 1784 wrote to memory of 4496 1784 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 93 PID 1784 wrote to memory of 4496 1784 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 93 PID 1784 wrote to memory of 4496 1784 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 93 PID 1784 wrote to memory of 4496 1784 JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe 93 PID 4496 wrote to memory of 3520 4496 svchost.exe 94 PID 4496 wrote to memory of 3520 4496 svchost.exe 94 PID 4496 wrote to memory of 3520 4496 svchost.exe 94 PID 4496 wrote to memory of 2100 4496 svchost.exe 95 PID 4496 wrote to memory of 2100 4496 svchost.exe 95 PID 4496 wrote to memory of 2100 4496 svchost.exe 95 PID 4496 wrote to memory of 4872 4496 svchost.exe 99 PID 4496 wrote to memory of 4872 4496 svchost.exe 99 PID 4496 wrote to memory of 4872 4496 svchost.exe 99 PID 4496 wrote to memory of 4532 4496 svchost.exe 102 PID 4496 wrote to memory of 4532 4496 svchost.exe 102 PID 4496 wrote to memory of 4532 4496 svchost.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\caiz.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\taskkill.exeTASKKILL /F /IM C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f6ee85eacb0bfc71d7bd16db9dd1831a.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1524
-
-
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe2⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Roaming\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3520
-
-
C:\Users\Admin\AppData\Roaming\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f3⤵
- Executes dropped EXE
PID:2100
-
-
C:\Users\Admin\AppData\Roaming\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Executes dropped EXE
PID:4872
-
-
C:\Users\Admin\AppData\Roaming\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\cmd.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\cmd.exe:*:Enabled:Windows Messanger" /f3⤵
- Executes dropped EXE
PID:4532
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTgyNURGMkYtQ0U3Ni00QjU1LUI0MUEtMzg0MDQ3MTE0OTEzfSIgdXNlcmlkPSJ7MEZDOUI1MDItNDUyQy00ODM3LTlCNTUtQjI2ODE2ODg5N0VCfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MjI5QzIwOTItNEJEMi00NjVBLUIyMTItNjhDNUZEOTQ2ODJFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODM0MTAiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NTUzNjg2NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODM1MTc5OTYwIi8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4876
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
241B
MD541abe8cebca457c058878ce71dbcad47
SHA143171d72950c7e0090c99aada96a7d2a1822e862
SHA25639610d0acc80b2f4c6c780998c34be8f9fa9bef2a6b4f146df10f4473e67d37e
SHA512fdc915390ad24022bd1b18c3b990c7caadc96c504894aa4c508c02d3c9660a739c6eebbef40c3dd07752a50c5cf4c181da2d09fa35baf1fafff5f9ccf678d871
-
Filesize
1KB
MD55b032d6dbc63d830be5ffa5dd679247a
SHA1c3553f08c562034ff156b8c776be714b8af618f6
SHA25630f4f452fc8ef6f5fbb5cdc2b5ca39eac48a634f1c328fa8dfe624616f295ada
SHA512859bc96f0551dd23d0b84165e07e3fa78fa970c347c9925ce243931225074b4ae514f34484090d83250b49e377f63736b12c72db1403321d4da9d7e4d1542d90