Analysis

  • max time kernel
    147s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250211-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/02/2025, 18:08

General

  • Target

    JaffaCakes118_fa7e7d5edba288e9a95e4900206fbf70.exe

  • Size

    3.2MB

  • MD5

    fa7e7d5edba288e9a95e4900206fbf70

  • SHA1

    f6102046c18472bc0b693704f21f17e705dbc439

  • SHA256

    0d517d250b9e225215ad9b645b58684833571f2ef66509ad7c18a7a47fec7f64

  • SHA512

    04b110915bced26833878d7e8ad5a3d9db8f34c6de3a44038cbf496c49197482ebc0717c0ae1539f89a18043d401e3ff0afcff41326ee2c8b9d52119fca3cd8e

  • SSDEEP

    49152:4NjcJogDk4FTI5d81YkJ0CoiLNyOEe9hl3qJaMScJ0:

Malware Config

Signatures

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

  • Blackshades family
  • Blackshades payload 12 IoCs
  • Modifies firewall policy service 3 TTPs 10 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fa7e7d5edba288e9a95e4900206fbf70.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fa7e7d5edba288e9a95e4900206fbf70.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3876
    • C:\Users\Admin\AppData\Local\Temp\update2.exe
      "C:\Users\Admin\AppData\Local\Temp\update2.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        3⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1956
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3932
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:4624
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3036
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:3260
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5032
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:4868
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\update.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\update.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:876
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\update.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\update.exe:*:Enabled:Windows Messanger" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:4448
    • C:\Users\Admin\AppData\Local\Temp\is63.exe
      "C:\Users\Admin\AppData\Local\Temp\is63.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4872
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3668
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Njk1OTQ0MDEtOUU0Ny00OUNDLThGMUUtNzc3OTJGQUIyNTdCfSIgdXNlcmlkPSJ7MTgyQUQxRjMtOEZFRi00RUZDLUJEQjktQzJDQkQyQ0YyREVEfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QjM1MEQyRjYtMDhEMi00ODZELUI3RUMtOUJCRTU0MkY0NDcxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODMzNzEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NDE5Mjc1MzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1Mzk5NzY3MDI4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:3008

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is63.exe

    Filesize

    612KB

    MD5

    5151fc17f564a6957f7638fac81b4189

    SHA1

    cbae925ff16608cfd4bd1a9b65bd6db3f0acefc6

    SHA256

    5c94615a6a6fe91013284e519a5168cb9d331a02d2232e0c16b31bc1647e3c72

    SHA512

    f379dcd542ec3a59b5b91e38c2c1d3d2d99cf118f49e00d6195c3c4bee601ad2b46f30eeacf02db73bb0fcdb65128b1bc569a073e0f7aea874545c9faa01b5ca

  • C:\Users\Admin\AppData\Local\Temp\update2.exe

    Filesize

    592KB

    MD5

    773b23201407b8009404952159e8dc27

    SHA1

    52a48f92fd40530da17066b291bef66b6fae8f8a

    SHA256

    5aa6487ff9ed17b6eca8e973bc829ff436bfd6cfb9b037a46bc7d3ab75001b9d

    SHA512

    279171274dad941f91325e5c704eb556cf9ef180dda77754d50fe884ccea4b952d3f1ff5bc3e9b900fa48fc0098cad284630529fe202713d76e3f3f26be7d06e

  • memory/1956-73-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/1956-91-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/1956-94-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/1956-82-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/1956-43-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/1956-70-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/1956-67-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/1956-63-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/1956-59-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/1956-56-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/1956-53-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/1956-45-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2400-28-0x0000000074130000-0x00000000746E1000-memory.dmp

    Filesize

    5.7MB

  • memory/2400-46-0x0000000074130000-0x00000000746E1000-memory.dmp

    Filesize

    5.7MB

  • memory/2400-26-0x0000000074130000-0x00000000746E1000-memory.dmp

    Filesize

    5.7MB

  • memory/2400-29-0x0000000074130000-0x00000000746E1000-memory.dmp

    Filesize

    5.7MB

  • memory/3668-40-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3668-35-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3668-39-0x0000000000460000-0x0000000000529000-memory.dmp

    Filesize

    804KB

  • memory/3668-33-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3876-0-0x0000000074132000-0x0000000074133000-memory.dmp

    Filesize

    4KB

  • memory/3876-27-0x0000000074130000-0x00000000746E1000-memory.dmp

    Filesize

    5.7MB

  • memory/3876-2-0x0000000074130000-0x00000000746E1000-memory.dmp

    Filesize

    5.7MB

  • memory/3876-1-0x0000000074130000-0x00000000746E1000-memory.dmp

    Filesize

    5.7MB

  • memory/4872-42-0x0000000074130000-0x00000000746E1000-memory.dmp

    Filesize

    5.7MB

  • memory/4872-32-0x0000000074130000-0x00000000746E1000-memory.dmp

    Filesize

    5.7MB

  • memory/4872-31-0x0000000074130000-0x00000000746E1000-memory.dmp

    Filesize

    5.7MB

  • memory/4872-30-0x0000000074130000-0x00000000746E1000-memory.dmp

    Filesize

    5.7MB