Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    14/02/2025, 16:50

General

  • Target

    JaffaCakes118_f9f1edb4eebbe5016d19daaf80e16e27.exe

  • Size

    2.1MB

  • MD5

    f9f1edb4eebbe5016d19daaf80e16e27

  • SHA1

    18a3aaff5c422894ce8d65cdd3c9fc70cb4a51f5

  • SHA256

    638455a0770ccd0646b516fa156a04960847824cb11aacf533ad9c6b8dc94753

  • SHA512

    cbbfc791f060a1123166067e2287cc575998212c30e3b1fc28b076d4a4a1f59f7838cbd099d43dc5901035e60e8d469ac61ac095ed07d3c98a4916890fa542a4

  • SSDEEP

    49152:Zsn7VxWWhzSenZncQLVxft5DEuO7zWYNcISPOP8pDrJLmaV:Y7thzSenZBZxnDw+K0OPiDrFV

Malware Config

Signatures

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

  • Blackshades family
  • Blackshades payload 15 IoCs
  • Modifies firewall policy service 3 TTPs 8 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f1edb4eebbe5016d19daaf80e16e27.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f1edb4eebbe5016d19daaf80e16e27.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3032
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f1edb4eebbe5016d19daaf80e16e27.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f1edb4eebbe5016d19daaf80e16e27.exe"
      2⤵
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1700
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f1edb4eebbe5016d19daaf80e16e27.exe
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f1edb4eebbe5016d19daaf80e16e27.exe"
        3⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2760
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2736
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:2680
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f1edb4eebbe5016d19daaf80e16e27.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f1edb4eebbe5016d19daaf80e16e27.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2492
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f1edb4eebbe5016d19daaf80e16e27.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9f1edb4eebbe5016d19daaf80e16e27.exe:*:Enabled:Windows Messanger" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:2800
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2900
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:2868
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\iexplorer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\iexplorer.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2876
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\iexplorer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\iexplorer.exe:*:Enabled:Windows Messanger" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:2896

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\data.dat

    Filesize

    33B

    MD5

    d7ee9cb29d94a15a851db7f64219de2c

    SHA1

    64de02fdabb99b2f4f00dde3dcf26d9b2d8ac9b7

    SHA256

    db4fdbe88fcd9ac3a9a145c9a7f4661a6e88d1a61a203f58c89101cfc9dc6ca5

    SHA512

    73cb80642fa49c9c353094575138a8bbd2d770fe03235a94b8bbf72ee7b5e6b29251ca3064560398402d69f45c1654b2ff379f1b50a03d081ec83cf5eb86f24a

  • memory/1700-22-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/1700-42-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/1700-10-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/1700-14-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/1700-16-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/1700-12-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/1700-18-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/1700-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1700-26-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/1700-24-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/2760-36-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2760-57-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2760-68-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2760-65-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2760-64-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2760-60-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2760-29-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2760-59-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2760-35-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2760-31-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/2760-56-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2760-46-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2760-47-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2760-48-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2760-49-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2760-50-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2760-51-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2760-52-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/3032-2-0x0000000000400000-0x00000000005D2000-memory.dmp

    Filesize

    1.8MB

  • memory/3032-25-0x0000000002BF0000-0x0000000002DC2000-memory.dmp

    Filesize

    1.8MB

  • memory/3032-0-0x0000000000400000-0x00000000005D2000-memory.dmp

    Filesize

    1.8MB

  • memory/3032-28-0x0000000000400000-0x00000000005D2000-memory.dmp

    Filesize

    1.8MB

  • memory/3032-4-0x0000000000400000-0x00000000005D2000-memory.dmp

    Filesize

    1.8MB

  • memory/3032-3-0x0000000000400000-0x00000000005D2000-memory.dmp

    Filesize

    1.8MB

  • memory/3032-1-0x000000000042C000-0x000000000042D000-memory.dmp

    Filesize

    4KB

  • memory/3032-5-0x0000000000400000-0x00000000005D2000-memory.dmp

    Filesize

    1.8MB