Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20250211-en - resource tags
- submitted
16/02/2025, 04:32
General
- Target JaffaCakes118_ff782b59442e156d78bef67b80b90efa.exe
- Size 1.7MB
- Sample250216-e56dessmbn
- SHA256 83425ccfaa33acfceb809ee0913b1d9c974f7bb8acc961ac771fdbf07891cfa4
Malware Config
Signatures
- Blackshades
Blackshades is a remote access trojan with various capabilities.
- Blackshades family
- Blackshades payload 2 IoCs
- Modifies firewall policy service 3 TTPs 10 IoCs
- Detected Nirsoft tools 6 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
- Adds policy Run key to start application 2 TTPs 2 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Downloads MZ/PE file 1 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 15 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Suspicious use of SetThreadContext 11 IoCs
- UPX packed file 32 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Modifies registry class 28 IoCs
- Modifies registry key 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 48 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ff782b59442e156d78bef67b80b90efa.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ff782b59442e156d78bef67b80b90efa.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\apps.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\apps.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\apps.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\apps.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\apps.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\apps.exe4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\apps.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\apps.exe:*:Enabled:Windows Messanger" /f5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\apps.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\apps.exe:*:Enabled:Windows Messanger" /f6⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f6⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aps2.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aps2.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aps2.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aps2.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aps2.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aps2.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aps2.exe/stext "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\offc.dat"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aps2.exe/stext "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\mess.dat"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aps2.exe/stext "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\mail.dat"5⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aps2.exe/stext "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dial.dat"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aps2.exe/stext "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\chro.dat"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aps2.exe/stext "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iexp.dat"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aps2.exe/stext "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ptsg.dat"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aps2.exe/stext "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ffox.dat"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aps2.exe/stext "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\opra.dat"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7Q0VDMDhFQUUtNjAzRi00QTU0LUE4RkEtMDdDQjFENUI1NzBCfSIgdXNlcmlkPSJ7RUI0NkY5RTEtNDM3Ny00OEE5LUE1REYtRUFBNUFEMkY2OEVCfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NEQ3NjZCNTEtRTc3Qy00QUM1LTgxQTUtRDY4REU1RDA5RkVDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0IiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODMzNzEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NDE5Mjc1MzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzE2OTA5Njk4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
5Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
apps.exe
aps2.exe
dial.dat
offc.dat
memory/1528-7-0x0000000010000000-0x00000000101AC000-memory.dmp
memory/1528-35-0x0000000010000000-0x00000000101AC000-memory.dmp
memory/1932-96-0x0000000000400000-0x0000000000418000-memory.dmp
memory/1932-92-0x0000000000400000-0x0000000000418000-memory.dmp
memory/1932-94-0x0000000000400000-0x0000000000418000-memory.dmp
memory/1932-97-0x0000000000400000-0x0000000000418000-memory.dmp
memory/2024-73-0x0000000010000000-0x00000000101AC000-memory.dmp
memory/2168-80-0x0000000000400000-0x0000000000418000-memory.dmp
memory/2168-78-0x0000000000400000-0x0000000000418000-memory.dmp
memory/2168-81-0x0000000000400000-0x0000000000418000-memory.dmp
memory/2248-105-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2248-100-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2248-102-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2248-104-0x0000000000400000-0x000000000043E000-memory.dmp
memory/2452-108-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2452-111-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2452-110-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2524-34-0x00000000021F0000-0x000000000234A000-memory.dmp
memory/2524-38-0x0000000010000000-0x00000000101AC000-memory.dmp
memory/2524-22-0x00000000021F0000-0x000000000234A000-memory.dmp
memory/2524-20-0x0000000010000000-0x00000000101AC000-memory.dmp
memory/2524-21-0x0000000010000000-0x00000000101AC000-memory.dmp
memory/2524-19-0x0000000010000000-0x00000000101AC000-memory.dmp
memory/2524-17-0x00000000021F0000-0x000000000234A000-memory.dmp
memory/2524-10-0x00000000021F0000-0x000000000234A000-memory.dmp
memory/2524-9-0x0000000010000000-0x00000000101AC000-memory.dmp
memory/2720-66-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2720-69-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2720-65-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2720-70-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2720-71-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2720-64-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/2828-86-0x0000000000400000-0x0000000000425000-memory.dmp
memory/2828-84-0x0000000000400000-0x0000000000425000-memory.dmp
memory/2828-87-0x0000000000400000-0x0000000000425000-memory.dmp
memory/3192-91-0x0000000000400000-0x000000000041F000-memory.dmp
memory/3192-88-0x0000000000400000-0x000000000041F000-memory.dmp
memory/3192-90-0x0000000000400000-0x000000000041F000-memory.dmp
memory/3840-31-0x0000000000400000-0x00000000005AC000-memory.dmp
memory/3840-27-0x0000000000400000-0x00000000005AC000-memory.dmp
memory/3840-26-0x0000000000400000-0x00000000005AC000-memory.dmp
memory/3840-32-0x0000000000400000-0x00000000005AC000-memory.dmp
memory/3840-33-0x0000000000400000-0x00000000005AC000-memory.dmp
memory/3840-28-0x0000000000400000-0x00000000005AC000-memory.dmp
memory/5064-49-0x00000000024E0000-0x000000000263A000-memory.dmp
memory/5064-77-0x0000000010000000-0x00000000101AC000-memory.dmp
memory/5064-55-0x00000000024E0000-0x000000000263A000-memory.dmp
memory/5064-57-0x0000000010000000-0x00000000101AC000-memory.dmp
memory/5064-60-0x00000000024E0000-0x000000000263A000-memory.dmp
memory/5064-58-0x0000000010000000-0x00000000101AC000-memory.dmp
memory/5064-48-0x0000000010000000-0x00000000101AC000-memory.dmp
memory/5064-59-0x0000000010000000-0x00000000101AC000-memory.dmp
memory/5064-72-0x00000000024E0000-0x000000000263A000-memory.dmp