General
-
Target
JaffaCakes118_ffe3d5f1a942c4a35a5f415f9dc18013
-
Size
197KB
-
Sample
250216-gaz92avnfm
-
MD5
ffe3d5f1a942c4a35a5f415f9dc18013
-
SHA1
b5675a249a8dc7bf37e069e2634d38682a7df813
-
SHA256
0d0e6cf0b263302a431392ba4b29f25bd6d8851c0a2188bf669d000a36baf1c3
-
SHA512
2d5d8ad956afe4f8aa3b6cfc223e53c7144f4937afdea21c22382dd3023df6ae7eaa4383181b0ffb255303ded352c725133939eab8e08bf9b8858fe2eb8f23bb
-
SSDEEP
3072:EUDWo2xq2aTme7POFgRyyBBk6lcyt0vcIGR55uxMFTosFqIdLyIxtgJDW9:EddVe7PKLyzrlsuWMPFqEF
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_ffe3d5f1a942c4a35a5f415f9dc18013.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
JaffaCakes118_ffe3d5f1a942c4a35a5f415f9dc18013.exe
Resource
win10v2004-20250207-en
Malware Config
Targets
-
-
Target
JaffaCakes118_ffe3d5f1a942c4a35a5f415f9dc18013
-
Size
197KB
-
MD5
ffe3d5f1a942c4a35a5f415f9dc18013
-
SHA1
b5675a249a8dc7bf37e069e2634d38682a7df813
-
SHA256
0d0e6cf0b263302a431392ba4b29f25bd6d8851c0a2188bf669d000a36baf1c3
-
SHA512
2d5d8ad956afe4f8aa3b6cfc223e53c7144f4937afdea21c22382dd3023df6ae7eaa4383181b0ffb255303ded352c725133939eab8e08bf9b8858fe2eb8f23bb
-
SSDEEP
3072:EUDWo2xq2aTme7POFgRyyBBk6lcyt0vcIGR55uxMFTosFqIdLyIxtgJDW9:EddVe7PKLyzrlsuWMPFqEF
-
Blackshades family
-
Blackshades payload
-
Modifies firewall policy service
-
Adds policy Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
5