Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
21/02/2025, 03:25
General
-
Target
JaffaCakes118_0fed20648d736052db384f5d7834e287.exe
-
Size
496KB
-
MD5
0fed20648d736052db384f5d7834e287
-
SHA1
2411e15fcbc261c9e3815e6d937cc768010ce6ca
-
SHA256
843cc91c63b92c5fb1d332781e3b7e062350f9fef1a2e2999097cfc1154ae4a9
-
SHA512
de76d007ee4170989474153854cb2f8c0bac8733ceae66a26307827442c13e9c06d07ab773045cfadcfa3ac2fe6f2b740a1581e009dd52028f27de06e6ff16f2
-
SSDEEP
12288:eDCBL8JL9fRhYorKYe9aVVyeTc+M2y2tPTmnVi:es8wNpWyfujs
Score
10/10
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 12 IoCs
-
Modifies firewall policy service 3 TTPs 10 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry key 1 TTPs 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 32 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0fed20648d736052db384f5d7834e287.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0fed20648d736052db384f5d7834e287.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\JaffaCakes118_0fed20648d736052db384f5d7834e287.exeC:\Users\Admin\AppData\Roaming\JaffaCakes118_0fed20648d736052db384f5d7834e287.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JaffaCakes118_0fed20648d736052db384f5d7834e287.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JaffaCakes118_0fed20648d736052db384f5d7834e287.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JaffaCakes118_0fed20648d736052db384f5d7834e287.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JaffaCakes118_0fed20648d736052db384f5d7834e287.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5c66f69b234fb0bcd09a15654c8b4d01d
SHA12018b3663b6844632a0a49fcd272a500f029770c
SHA256952f10539fdbc54d4d1da05558c2a6cc491604d2c46e586441cbc4682bdc2bdb
SHA5125ef4eed281811f38c4508e141212468d34df7362d6cc08e3ae87d5f0d1f6cdb44c72b2f5bbccd720e4f8f02bf6d65ddc493bcc3e8642c8fdbe8017450e548f72
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB