Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250211-en -
resource tags
arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system -
submitted
15/02/2025, 17:17
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_fad2025ee0892538e680397a738647be.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_fad2025ee0892538e680397a738647be.exe
Resource
win10v2004-20250211-en
General
-
Target
JaffaCakes118_fad2025ee0892538e680397a738647be.exe
-
Size
272KB
-
MD5
fad2025ee0892538e680397a738647be
-
SHA1
602d3dcbed556f54d74a2ea551fa5ff93577647c
-
SHA256
1e59631cc92c79fea6a408cfb330922c566668400e9e4027e110bcc3ea8a2063
-
SHA512
be766cd688e8864ee28cdb8d3f3bf9d9213d081ce3844a3019c7f33f474b34a7d2401b2fa5ea5ae581946e2c5118e05a7b7daa043350a69b7e074f8459ace413
-
SSDEEP
6144:AM9qf+fxn4UcSMjIzKvb1SxXipxEm98rgPv0Z:r9qf+aU0jIzKv5SxXipxui0Z
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 14 IoCs
resource yara_rule behavioral2/memory/2328-5-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/2328-11-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/2328-17-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/2328-18-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/2328-20-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/2328-21-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/2328-22-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/2328-25-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/2328-26-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/2328-27-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/2328-30-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/2328-31-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/2328-34-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/2328-35-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\4ABREJBV4M.exe = "C:\\Users\\Admin\\AppData\\Roaming\\4ABREJBV4M.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\svchost.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe -
Downloads MZ/PE file 1 IoCs
flow pid Process 65 4888 Process not Found -
Executes dropped EXE 1 IoCs
pid Process 2328 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2508704002-2325818048-3575902788-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Live = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_fad2025ee0892538e680397a738647be.exe" JaffaCakes118_fad2025ee0892538e680397a738647be.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4572 set thread context of 2328 4572 JaffaCakes118_fad2025ee0892538e680397a738647be.exe 88 -
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_fad2025ee0892538e680397a738647be.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4012 MicrosoftEdgeUpdate.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 4588 reg.exe 4820 reg.exe 3084 reg.exe 4304 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 4572 JaffaCakes118_fad2025ee0892538e680397a738647be.exe Token: 1 2328 svchost.exe Token: SeCreateTokenPrivilege 2328 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2328 svchost.exe Token: SeLockMemoryPrivilege 2328 svchost.exe Token: SeIncreaseQuotaPrivilege 2328 svchost.exe Token: SeMachineAccountPrivilege 2328 svchost.exe Token: SeTcbPrivilege 2328 svchost.exe Token: SeSecurityPrivilege 2328 svchost.exe Token: SeTakeOwnershipPrivilege 2328 svchost.exe Token: SeLoadDriverPrivilege 2328 svchost.exe Token: SeSystemProfilePrivilege 2328 svchost.exe Token: SeSystemtimePrivilege 2328 svchost.exe Token: SeProfSingleProcessPrivilege 2328 svchost.exe Token: SeIncBasePriorityPrivilege 2328 svchost.exe Token: SeCreatePagefilePrivilege 2328 svchost.exe Token: SeCreatePermanentPrivilege 2328 svchost.exe Token: SeBackupPrivilege 2328 svchost.exe Token: SeRestorePrivilege 2328 svchost.exe Token: SeShutdownPrivilege 2328 svchost.exe Token: SeDebugPrivilege 2328 svchost.exe Token: SeAuditPrivilege 2328 svchost.exe Token: SeSystemEnvironmentPrivilege 2328 svchost.exe Token: SeChangeNotifyPrivilege 2328 svchost.exe Token: SeRemoteShutdownPrivilege 2328 svchost.exe Token: SeUndockPrivilege 2328 svchost.exe Token: SeSyncAgentPrivilege 2328 svchost.exe Token: SeEnableDelegationPrivilege 2328 svchost.exe Token: SeManageVolumePrivilege 2328 svchost.exe Token: SeImpersonatePrivilege 2328 svchost.exe Token: SeCreateGlobalPrivilege 2328 svchost.exe Token: 31 2328 svchost.exe Token: 32 2328 svchost.exe Token: 33 2328 svchost.exe Token: 34 2328 svchost.exe Token: 35 2328 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 4572 wrote to memory of 2328 4572 JaffaCakes118_fad2025ee0892538e680397a738647be.exe 88 PID 4572 wrote to memory of 2328 4572 JaffaCakes118_fad2025ee0892538e680397a738647be.exe 88 PID 4572 wrote to memory of 2328 4572 JaffaCakes118_fad2025ee0892538e680397a738647be.exe 88 PID 4572 wrote to memory of 2328 4572 JaffaCakes118_fad2025ee0892538e680397a738647be.exe 88 PID 4572 wrote to memory of 2328 4572 JaffaCakes118_fad2025ee0892538e680397a738647be.exe 88 PID 4572 wrote to memory of 2328 4572 JaffaCakes118_fad2025ee0892538e680397a738647be.exe 88 PID 4572 wrote to memory of 2328 4572 JaffaCakes118_fad2025ee0892538e680397a738647be.exe 88 PID 4572 wrote to memory of 2328 4572 JaffaCakes118_fad2025ee0892538e680397a738647be.exe 88 PID 2328 wrote to memory of 4296 2328 svchost.exe 90 PID 2328 wrote to memory of 4296 2328 svchost.exe 90 PID 2328 wrote to memory of 4296 2328 svchost.exe 90 PID 2328 wrote to memory of 2268 2328 svchost.exe 91 PID 2328 wrote to memory of 2268 2328 svchost.exe 91 PID 2328 wrote to memory of 2268 2328 svchost.exe 91 PID 2328 wrote to memory of 1588 2328 svchost.exe 92 PID 2328 wrote to memory of 1588 2328 svchost.exe 92 PID 2328 wrote to memory of 1588 2328 svchost.exe 92 PID 2328 wrote to memory of 4536 2328 svchost.exe 93 PID 2328 wrote to memory of 4536 2328 svchost.exe 93 PID 2328 wrote to memory of 4536 2328 svchost.exe 93 PID 4296 wrote to memory of 4820 4296 cmd.exe 98 PID 4296 wrote to memory of 4820 4296 cmd.exe 98 PID 4296 wrote to memory of 4820 4296 cmd.exe 98 PID 2268 wrote to memory of 3084 2268 cmd.exe 99 PID 2268 wrote to memory of 3084 2268 cmd.exe 99 PID 2268 wrote to memory of 3084 2268 cmd.exe 99 PID 1588 wrote to memory of 4304 1588 cmd.exe 100 PID 1588 wrote to memory of 4304 1588 cmd.exe 100 PID 1588 wrote to memory of 4304 1588 cmd.exe 100 PID 4536 wrote to memory of 4588 4536 cmd.exe 101 PID 4536 wrote to memory of 4588 4536 cmd.exe 101 PID 4536 wrote to memory of 4588 4536 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fad2025ee0892538e680397a738647be.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fad2025ee0892538e680397a738647be.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4820
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3084
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4304
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\4ABREJBV4M.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\4ABREJBV4M.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\4ABREJBV4M.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\4ABREJBV4M.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4588
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUMwOEVBNjItM0VEMS00MUNELUExNzMtRDMwMkFCREE3QjE0fSIgdXNlcmlkPSJ7NzVFMjIxMzAtQ0Q3Ri00QzM0LUI0MzgtRUVFQjhDNzI5MDhDfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MzA4N0I0OUItNjQzQy00NzZGLUFCOEEtODk5MTA2RERENjA1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0IiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODMyMzYiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NDI1MTE0ODAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NzYyNzM2OTk2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4012
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD5e118330b4629b12368d91b9df6488be0
SHA1ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA2563a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
SHA512ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0