Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23/02/2025, 17:30
Behavioral task
behavioral1
Sample
JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe
-
Size
113KB
-
MD5
2186e3cbe4e1c1c1dcbe1ef33306c7bc
-
SHA1
41836f739b0697dc158b6443804ca8e2a7686ca7
-
SHA256
96efb6bd9b39c596590c74d2340968460fe64f4de808328b45162c50c056ec12
-
SHA512
b61b8c292368a0339a96e7e74efa09e44c9f768151e988bfb94c9633bd00296e569673b8b80f205ab56cad82095fcd22c3f895c12ef9f235f14a4a68b92b8109
-
SSDEEP
3072:tOEY4TjVzg8252TDH+U0p+Cjey9NxOjCzYsKF8t:t1Y4TZg8ZH+U0hj19NxECzYBK
Score
10/10
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 14 IoCs
resource yara_rule behavioral1/memory/768-6-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral1/memory/768-7-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral1/memory/768-9-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral1/memory/768-10-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral1/memory/768-11-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral1/memory/768-13-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral1/memory/768-14-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral1/memory/768-15-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral1/memory/768-17-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral1/memory/768-18-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral1/memory/768-19-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral1/memory/768-21-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral1/memory/768-22-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades behavioral1/memory/768-23-0x0000000000400000-0x000000000045D000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\local.exe = "C:\\Users\\Admin\\AppData\\Roaming\\local.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe -
resource yara_rule behavioral1/memory/768-0-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/768-6-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/768-7-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/768-9-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/768-10-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/768-11-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/768-13-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/768-14-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/768-15-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/768-17-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/768-18-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/768-19-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/768-21-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/768-22-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/768-23-0x0000000000400000-0x000000000045D000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2756 reg.exe 2860 reg.exe 2876 reg.exe 2104 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeCreateTokenPrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeAssignPrimaryTokenPrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeLockMemoryPrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeIncreaseQuotaPrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeMachineAccountPrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeTcbPrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeSecurityPrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeTakeOwnershipPrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeLoadDriverPrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeSystemProfilePrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeSystemtimePrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeProfSingleProcessPrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeIncBasePriorityPrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeCreatePagefilePrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeCreatePermanentPrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeBackupPrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeRestorePrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeShutdownPrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeDebugPrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeAuditPrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeSystemEnvironmentPrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeChangeNotifyPrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeRemoteShutdownPrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeUndockPrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeSyncAgentPrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeEnableDelegationPrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeManageVolumePrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeImpersonatePrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: SeCreateGlobalPrivilege 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: 31 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: 32 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: 33 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: 34 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe Token: 35 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 768 wrote to memory of 1272 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe 30 PID 768 wrote to memory of 1272 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe 30 PID 768 wrote to memory of 1272 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe 30 PID 768 wrote to memory of 1272 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe 30 PID 768 wrote to memory of 2372 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe 31 PID 768 wrote to memory of 2372 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe 31 PID 768 wrote to memory of 2372 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe 31 PID 768 wrote to memory of 2372 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe 31 PID 768 wrote to memory of 2396 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe 32 PID 768 wrote to memory of 2396 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe 32 PID 768 wrote to memory of 2396 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe 32 PID 768 wrote to memory of 2396 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe 32 PID 768 wrote to memory of 2428 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe 33 PID 768 wrote to memory of 2428 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe 33 PID 768 wrote to memory of 2428 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe 33 PID 768 wrote to memory of 2428 768 JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe 33 PID 2396 wrote to memory of 2756 2396 cmd.exe 39 PID 2396 wrote to memory of 2756 2396 cmd.exe 39 PID 2396 wrote to memory of 2756 2396 cmd.exe 39 PID 2396 wrote to memory of 2756 2396 cmd.exe 39 PID 2372 wrote to memory of 2860 2372 cmd.exe 38 PID 2372 wrote to memory of 2860 2372 cmd.exe 38 PID 2372 wrote to memory of 2860 2372 cmd.exe 38 PID 2372 wrote to memory of 2860 2372 cmd.exe 38 PID 2428 wrote to memory of 2104 2428 cmd.exe 40 PID 2428 wrote to memory of 2104 2428 cmd.exe 40 PID 2428 wrote to memory of 2104 2428 cmd.exe 40 PID 2428 wrote to memory of 2104 2428 cmd.exe 40 PID 1272 wrote to memory of 2876 1272 cmd.exe 41 PID 1272 wrote to memory of 2876 1272 cmd.exe 41 PID 1272 wrote to memory of 2876 1272 cmd.exe 41 PID 1272 wrote to memory of 2876 1272 cmd.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2876
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2860
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2756
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\local.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\local.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\local.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\local.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2104
-
-