Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/02/2025, 11:43
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe
Resource
win10v2004-20250211-en
General
-
Target
JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe
-
Size
657KB
-
MD5
f774046c437ddfc3303975bcf232f9a3
-
SHA1
5c1b01bf30d110f3387e876400ec64d6c085b3e9
-
SHA256
6ad26871f986e69a828a9c3d4e48a5062cb637c5d7df837f783679978d94090d
-
SHA512
bcf41deb4b2ff66022ded1c2f2a898b6df7510eb2e6193b6150c03b1d86f3a48d9b717bf0665e42426c034e5b5ccb759c49a5f68b48cae42fc1f21a0bce5c1d8
-
SSDEEP
12288:PuBVvG50dw/syOSDqm4chRAix2gpeTi4O+F5eogumEFMZKSJurX:PoNdw/sdSONchRAypu4og8MZKyurX
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 16 IoCs
resource yara_rule behavioral1/memory/2984-52-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral1/memory/2984-49-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral1/memory/2984-63-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral1/memory/2984-64-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral1/memory/2984-66-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral1/memory/2984-67-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral1/memory/2984-68-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral1/memory/2984-70-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral1/memory/2984-71-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral1/memory/2984-72-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral1/memory/2984-73-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral1/memory/2984-75-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral1/memory/2984-76-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral1/memory/2984-78-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral1/memory/2984-79-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral1/memory/2984-80-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\svchost.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\IG8QG958JT.exe = "C:\\Users\\Admin\\AppData\\Roaming\\IG8QG958JT.exe:*:Enabled:Windows Messanger" reg.exe -
Executes dropped EXE 2 IoCs
pid Process 2056 svchost.exe 2984 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 1596 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 2056 svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1596 set thread context of 2056 1596 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 30 PID 2056 set thread context of 2984 2056 svchost.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 1476 reg.exe 536 reg.exe 1536 reg.exe 328 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 2056 svchost.exe Token: 1 2984 svchost.exe Token: SeCreateTokenPrivilege 2984 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2984 svchost.exe Token: SeLockMemoryPrivilege 2984 svchost.exe Token: SeIncreaseQuotaPrivilege 2984 svchost.exe Token: SeMachineAccountPrivilege 2984 svchost.exe Token: SeTcbPrivilege 2984 svchost.exe Token: SeSecurityPrivilege 2984 svchost.exe Token: SeTakeOwnershipPrivilege 2984 svchost.exe Token: SeLoadDriverPrivilege 2984 svchost.exe Token: SeSystemProfilePrivilege 2984 svchost.exe Token: SeSystemtimePrivilege 2984 svchost.exe Token: SeProfSingleProcessPrivilege 2984 svchost.exe Token: SeIncBasePriorityPrivilege 2984 svchost.exe Token: SeCreatePagefilePrivilege 2984 svchost.exe Token: SeCreatePermanentPrivilege 2984 svchost.exe Token: SeBackupPrivilege 2984 svchost.exe Token: SeRestorePrivilege 2984 svchost.exe Token: SeShutdownPrivilege 2984 svchost.exe Token: SeDebugPrivilege 2984 svchost.exe Token: SeAuditPrivilege 2984 svchost.exe Token: SeSystemEnvironmentPrivilege 2984 svchost.exe Token: SeChangeNotifyPrivilege 2984 svchost.exe Token: SeRemoteShutdownPrivilege 2984 svchost.exe Token: SeUndockPrivilege 2984 svchost.exe Token: SeSyncAgentPrivilege 2984 svchost.exe Token: SeEnableDelegationPrivilege 2984 svchost.exe Token: SeManageVolumePrivilege 2984 svchost.exe Token: SeImpersonatePrivilege 2984 svchost.exe Token: SeCreateGlobalPrivilege 2984 svchost.exe Token: 31 2984 svchost.exe Token: 32 2984 svchost.exe Token: 33 2984 svchost.exe Token: 34 2984 svchost.exe Token: 35 2984 svchost.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2984 svchost.exe 2984 svchost.exe 2984 svchost.exe 2984 svchost.exe 2984 svchost.exe 2984 svchost.exe 2984 svchost.exe 2984 svchost.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 1596 wrote to memory of 2056 1596 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 30 PID 1596 wrote to memory of 2056 1596 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 30 PID 1596 wrote to memory of 2056 1596 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 30 PID 1596 wrote to memory of 2056 1596 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 30 PID 1596 wrote to memory of 2056 1596 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 30 PID 1596 wrote to memory of 2056 1596 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 30 PID 1596 wrote to memory of 2056 1596 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 30 PID 1596 wrote to memory of 2056 1596 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 30 PID 1596 wrote to memory of 2056 1596 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 30 PID 1596 wrote to memory of 2056 1596 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 30 PID 1596 wrote to memory of 1720 1596 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 31 PID 1596 wrote to memory of 1720 1596 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 31 PID 1596 wrote to memory of 1720 1596 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 31 PID 1596 wrote to memory of 1720 1596 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 31 PID 2056 wrote to memory of 2984 2056 svchost.exe 32 PID 2056 wrote to memory of 2984 2056 svchost.exe 32 PID 2056 wrote to memory of 2984 2056 svchost.exe 32 PID 2056 wrote to memory of 2984 2056 svchost.exe 32 PID 2056 wrote to memory of 2984 2056 svchost.exe 32 PID 2056 wrote to memory of 2984 2056 svchost.exe 32 PID 2056 wrote to memory of 2984 2056 svchost.exe 32 PID 2056 wrote to memory of 2984 2056 svchost.exe 32 PID 2984 wrote to memory of 2076 2984 svchost.exe 33 PID 2984 wrote to memory of 2076 2984 svchost.exe 33 PID 2984 wrote to memory of 2076 2984 svchost.exe 33 PID 2984 wrote to memory of 2076 2984 svchost.exe 33 PID 2984 wrote to memory of 2116 2984 svchost.exe 35 PID 2984 wrote to memory of 2116 2984 svchost.exe 35 PID 2984 wrote to memory of 2116 2984 svchost.exe 35 PID 2984 wrote to memory of 2116 2984 svchost.exe 35 PID 2984 wrote to memory of 2164 2984 svchost.exe 36 PID 2984 wrote to memory of 2164 2984 svchost.exe 36 PID 2984 wrote to memory of 2164 2984 svchost.exe 36 PID 2984 wrote to memory of 2164 2984 svchost.exe 36 PID 2164 wrote to memory of 1476 2164 cmd.exe 40 PID 2164 wrote to memory of 1476 2164 cmd.exe 40 PID 2164 wrote to memory of 1476 2164 cmd.exe 40 PID 2164 wrote to memory of 1476 2164 cmd.exe 40 PID 2116 wrote to memory of 328 2116 cmd.exe 41 PID 2116 wrote to memory of 328 2116 cmd.exe 41 PID 2116 wrote to memory of 328 2116 cmd.exe 41 PID 2116 wrote to memory of 328 2116 cmd.exe 41 PID 2076 wrote to memory of 536 2076 cmd.exe 42 PID 2076 wrote to memory of 536 2076 cmd.exe 42 PID 2076 wrote to memory of 536 2076 cmd.exe 42 PID 2076 wrote to memory of 536 2076 cmd.exe 42 PID 2984 wrote to memory of 1700 2984 svchost.exe 43 PID 2984 wrote to memory of 1700 2984 svchost.exe 43 PID 2984 wrote to memory of 1700 2984 svchost.exe 43 PID 2984 wrote to memory of 1700 2984 svchost.exe 43 PID 1700 wrote to memory of 1536 1700 cmd.exe 45 PID 1700 wrote to memory of 1536 1700 cmd.exe 45 PID 1700 wrote to memory of 1536 1700 cmd.exe 45 PID 1700 wrote to memory of 1536 1700 cmd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:536
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:328
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1476
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\IG8QG958JT.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IG8QG958JT.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\IG8QG958JT.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IG8QG958JT.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1536
-
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cc.vbs"2⤵
- System Location Discovery: System Language Discovery
PID:1720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
383B
MD502da68b12950ba95f97ad8f00303bb2c
SHA11f3c15784f429d108210569adb0e2275af00cad0
SHA256059040f9892d5229df02f54b42d31ba7f4818bf5e964fb016be9fa441193afcd
SHA512d67791e0c158ba6762b9d74b291c21762bda27eedbc7652bb8f3639b283b8847b65faacaa334258a1d5a6c7fd4ed6d1efb3261cfb424572f87ab2f24502fed9a
-
Filesize
31KB
MD5ed797d8dc2c92401985d162e42ffa450
SHA10f02fc517c7facc4baefde4fe9467fb6488ebabe
SHA256b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e
SHA512e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2