Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/02/2025, 17:30

General

  • Target

    JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe

  • Size

    113KB

  • MD5

    2186e3cbe4e1c1c1dcbe1ef33306c7bc

  • SHA1

    41836f739b0697dc158b6443804ca8e2a7686ca7

  • SHA256

    96efb6bd9b39c596590c74d2340968460fe64f4de808328b45162c50c056ec12

  • SHA512

    b61b8c292368a0339a96e7e74efa09e44c9f768151e988bfb94c9633bd00296e569673b8b80f205ab56cad82095fcd22c3f895c12ef9f235f14a4a68b92b8109

  • SSDEEP

    3072:tOEY4TjVzg8252TDH+U0p+Cjey9NxOjCzYsKF8t:t1Y4TZg8ZH+U0hj19NxECzYBK

Malware Config

Signatures

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

  • Blackshades family
  • Blackshades payload 14 IoCs
  • Modifies firewall policy service 3 TTPs 10 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2244
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4540
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • Modifies firewall policy service
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:4640
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe:*:Enabled:Windows Messanger" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4444
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2186e3cbe4e1c1c1dcbe1ef33306c7bc.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • Modifies firewall policy service
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:5040
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4780
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • Modifies firewall policy service
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:2580
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\local.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\local.exe:*:Enabled:Windows Messanger" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\local.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\local.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • Modifies firewall policy service
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:1088

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2244-0-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/2244-6-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/2244-7-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/2244-8-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/2244-10-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/2244-11-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/2244-13-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/2244-14-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/2244-15-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/2244-17-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/2244-18-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/2244-19-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/2244-20-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/2244-22-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/2244-23-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB