blackshades | 562411b45b656ed95a56b9a596d23c838a24b9658c68a333823938dca36d2428

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2025, 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_1bcbc53ef61d6a22ef293043c556cacd.exe
Size

524KB
MD5

1bcbc53ef61d6a22ef293043c556cacd
SHA1

fd5c494645ccb6491a21b752abdafb312facd86b
SHA256

562411b45b656ed95a56b9a596d23c838a24b9658c68a333823938dca36d2428
SHA512

1e4dcac90a6dfac62a87f2e8123f5b0e71762f0b6dbf0f78e5009d74d5316db3f84a8c4da07c895f2855bb6bd33dcc0638721eac68b5a0f7a159ea306388b908
SSDEEP

12288:mdD68wPjNlZe48BFCLaTY+nH1Y7u3HzH+L:70DYaH1YsC

Score

10^/10

blackshades defense_evasion discovery rat

Malware Config

Signatures

Blackshades
Blackshades is a remote access trojan with various capabilities.
rat blackshades
Blackshades family
blackshades

Blackshades payload 15 IoCs

resource	yara_rule
behavioral2/memory/3700-5-0x0000000000400000-0x000000000047A000-memory.dmp	family_blackshades
behavioral2/memory/3700-7-0x0000000000400000-0x000000000047A000-memory.dmp	family_blackshades
behavioral2/memory/3700-16-0x0000000000400000-0x000000000047A000-memory.dmp	family_blackshades
behavioral2/memory/3700-17-0x0000000000400000-0x000000000047A000-memory.dmp	family_blackshades
behavioral2/memory/3700-18-0x0000000000400000-0x000000000047A000-memory.dmp	family_blackshades
behavioral2/memory/3700-19-0x0000000000400000-0x000000000047A000-memory.dmp	family_blackshades
behavioral2/memory/3700-21-0x0000000000400000-0x000000000047A000-memory.dmp	family_blackshades
behavioral2/memory/3700-22-0x0000000000400000-0x000000000047A000-memory.dmp	family_blackshades
behavioral2/memory/3700-23-0x0000000000400000-0x000000000047A000-memory.dmp	family_blackshades
behavioral2/memory/3700-25-0x0000000000400000-0x000000000047A000-memory.dmp	family_blackshades
behavioral2/memory/3700-26-0x0000000000400000-0x000000000047A000-memory.dmp	family_blackshades
behavioral2/memory/3700-27-0x0000000000400000-0x000000000047A000-memory.dmp	family_blackshades
behavioral2/memory/3700-29-0x0000000000400000-0x000000000047A000-memory.dmp	family_blackshades
behavioral2/memory/3700-30-0x0000000000400000-0x000000000047A000-memory.dmp	family_blackshades
behavioral2/memory/3700-33-0x0000000000400000-0x000000000047A000-memory.dmp	family_blackshades

Modifies firewall policy service 3 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\FUCKYEAH.exe = "C:\\Users\\Admin\\AppData\\Roaming\\FUCKYEAH.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4352 set thread context of 3700	4352	JaffaCakes118_1bcbc53ef61d6a22ef293043c556cacd.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_1bcbc53ef61d6a22ef293043c556cacd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
2520	reg.exe
3056	reg.exe
3472	reg.exe
4744	reg.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4352	JaffaCakes118_1bcbc53ef61d6a22ef293043c556cacd.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	4352	JaffaCakes118_1bcbc53ef61d6a22ef293043c556cacd.exe
Token: 1	3700	cvtres.exe
Token: SeCreateTokenPrivilege	3700	cvtres.exe
Token: SeAssignPrimaryTokenPrivilege	3700	cvtres.exe
Token: SeLockMemoryPrivilege	3700	cvtres.exe
Token: SeIncreaseQuotaPrivilege	3700	cvtres.exe
Token: SeMachineAccountPrivilege	3700	cvtres.exe
Token: SeTcbPrivilege	3700	cvtres.exe
Token: SeSecurityPrivilege	3700	cvtres.exe
Token: SeTakeOwnershipPrivilege	3700	cvtres.exe
Token: SeLoadDriverPrivilege	3700	cvtres.exe
Token: SeSystemProfilePrivilege	3700	cvtres.exe
Token: SeSystemtimePrivilege	3700	cvtres.exe
Token: SeProfSingleProcessPrivilege	3700	cvtres.exe
Token: SeIncBasePriorityPrivilege	3700	cvtres.exe
Token: SeCreatePagefilePrivilege	3700	cvtres.exe
Token: SeCreatePermanentPrivilege	3700	cvtres.exe
Token: SeBackupPrivilege	3700	cvtres.exe
Token: SeRestorePrivilege	3700	cvtres.exe
Token: SeShutdownPrivilege	3700	cvtres.exe
Token: SeDebugPrivilege	3700	cvtres.exe
Token: SeAuditPrivilege	3700	cvtres.exe
Token: SeSystemEnvironmentPrivilege	3700	cvtres.exe
Token: SeChangeNotifyPrivilege	3700	cvtres.exe
Token: SeRemoteShutdownPrivilege	3700	cvtres.exe
Token: SeUndockPrivilege	3700	cvtres.exe
Token: SeSyncAgentPrivilege	3700	cvtres.exe
Token: SeEnableDelegationPrivilege	3700	cvtres.exe
Token: SeManageVolumePrivilege	3700	cvtres.exe
Token: SeImpersonatePrivilege	3700	cvtres.exe
Token: SeCreateGlobalPrivilege	3700	cvtres.exe
Token: 31	3700	cvtres.exe
Token: 32	3700	cvtres.exe
Token: 33	3700	cvtres.exe
Token: 34	3700	cvtres.exe
Token: 35	3700	cvtres.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3700	cvtres.exe
3700	cvtres.exe
3700	cvtres.exe
3700	cvtres.exe
3700	cvtres.exe
3700	cvtres.exe
3700	cvtres.exe
3700	cvtres.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 3700	4352	JaffaCakes118_1bcbc53ef61d6a22ef293043c556cacd.exe	89
PID 4352 wrote to memory of 3700	4352	JaffaCakes118_1bcbc53ef61d6a22ef293043c556cacd.exe	89
PID 4352 wrote to memory of 3700	4352	JaffaCakes118_1bcbc53ef61d6a22ef293043c556cacd.exe	89
PID 4352 wrote to memory of 3700	4352	JaffaCakes118_1bcbc53ef61d6a22ef293043c556cacd.exe	89
PID 4352 wrote to memory of 3700	4352	JaffaCakes118_1bcbc53ef61d6a22ef293043c556cacd.exe	89
PID 4352 wrote to memory of 3700	4352	JaffaCakes118_1bcbc53ef61d6a22ef293043c556cacd.exe	89
PID 4352 wrote to memory of 3700	4352	JaffaCakes118_1bcbc53ef61d6a22ef293043c556cacd.exe	89
PID 4352 wrote to memory of 3700	4352	JaffaCakes118_1bcbc53ef61d6a22ef293043c556cacd.exe	89
PID 3700 wrote to memory of 1288	3700	cvtres.exe	90
PID 3700 wrote to memory of 1288	3700	cvtres.exe	90
PID 3700 wrote to memory of 1288	3700	cvtres.exe	90
PID 3700 wrote to memory of 4000	3700	cvtres.exe	91
PID 3700 wrote to memory of 4000	3700	cvtres.exe	91
PID 3700 wrote to memory of 4000	3700	cvtres.exe	91
PID 3700 wrote to memory of 2136	3700	cvtres.exe	92
PID 3700 wrote to memory of 2136	3700	cvtres.exe	92
PID 3700 wrote to memory of 2136	3700	cvtres.exe	92
PID 3700 wrote to memory of 3948	3700	cvtres.exe	93
PID 3700 wrote to memory of 3948	3700	cvtres.exe	93
PID 3700 wrote to memory of 3948	3700	cvtres.exe	93
PID 4000 wrote to memory of 4744	4000	cmd.exe	98
PID 4000 wrote to memory of 4744	4000	cmd.exe	98
PID 4000 wrote to memory of 4744	4000	cmd.exe	98
PID 2136 wrote to memory of 2520	2136	cmd.exe	99
PID 2136 wrote to memory of 2520	2136	cmd.exe	99
PID 2136 wrote to memory of 2520	2136	cmd.exe	99
PID 3948 wrote to memory of 3056	3948	cmd.exe	100
PID 3948 wrote to memory of 3056	3948	cmd.exe	100
PID 3948 wrote to memory of 3056	3948	cmd.exe	100
PID 1288 wrote to memory of 3472	1288	cmd.exe	101
PID 1288 wrote to memory of 3472	1288	cmd.exe	101
PID 1288 wrote to memory of 3472	1288	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1bcbc53ef61d6a22ef293043c556cacd.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1bcbc53ef61d6a22ef293043c556cacd.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3472
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4000
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4744
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2520
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\FUCKYEAH.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FUCKYEAH.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\FUCKYEAH.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FUCKYEAH.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3700-17-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3700-18-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3700-33-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3700-30-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3700-29-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3700-5-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3700-7-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3700-27-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3700-26-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3700-19-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3700-25-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3700-23-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3700-16-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3700-21-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3700-22-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/4352-0-0x0000000075062000-0x0000000075063000-memory.dmp

Filesize
4KB

Download
memory/4352-1-0x0000000075060000-0x0000000075611000-memory.dmp

Filesize
5.7MB

Download
memory/4352-15-0x0000000075060000-0x0000000075611000-memory.dmp

Filesize
5.7MB

Download
memory/4352-10-0x00000000010A0000-0x00000000010B0000-memory.dmp

Filesize
64KB

Download
memory/4352-4-0x0000000075060000-0x0000000075611000-memory.dmp

Filesize
5.7MB

Download
memory/4352-3-0x0000000075062000-0x0000000075063000-memory.dmp

Filesize
4KB

Download
memory/4352-2-0x0000000075060000-0x0000000075611000-memory.dmp

Filesize
5.7MB

Download