Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
25/02/2025, 22:31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_2303e482b151168c841b60df960d6d39.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_2303e482b151168c841b60df960d6d39.exe
Resource
win10v2004-20250217-en
General
-
Target
JaffaCakes118_2303e482b151168c841b60df960d6d39.exe
-
Size
924KB
-
MD5
2303e482b151168c841b60df960d6d39
-
SHA1
c70d7aa2c1631af197306908db8c62e125d6baa4
-
SHA256
7f70a8d1f09dcb87e6ee114eca9e386757590c8731d9aa5f1bb17706616a137f
-
SHA512
fadf96ca12012fd6e2eb6908899dff6f072e11fadacc7dbf67ac5f45edb578803e02c5893518ee533cd611046d87094fe98b228164093ed986149a0c6664403a
-
SSDEEP
12288:FuEV3sUPJ0c00RDwme95mJyN2KYIosW0KaAPF9Fsv9uifapiPWQsSf7H4fiOXaU5:ljR83UrRLiC5aU3o0
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 12 IoCs
resource yara_rule behavioral2/memory/4188-3-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4188-5-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4188-21-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4188-22-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4188-24-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4188-25-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4188-26-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4188-29-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4188-30-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4188-33-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4188-35-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral2/memory/4188-37-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\rundll.exe = "C:\\Users\\Admin\\AppData\\Roaming\\rundll.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts JaffaCakes118_2303e482b151168c841b60df960d6d39.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_2303e482b151168c841b60df960d6d39.exe cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JaffaCakes118_2303e482b151168c841b60df960d6d39.exe cmd.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1928 set thread context of 4188 1928 JaffaCakes118_2303e482b151168c841b60df960d6d39.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_2303e482b151168c841b60df960d6d39.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 3504 reg.exe 1680 reg.exe 1352 reg.exe 2340 reg.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1928 JaffaCakes118_2303e482b151168c841b60df960d6d39.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 1928 JaffaCakes118_2303e482b151168c841b60df960d6d39.exe Token: 1 4188 vbc.exe Token: SeCreateTokenPrivilege 4188 vbc.exe Token: SeAssignPrimaryTokenPrivilege 4188 vbc.exe Token: SeLockMemoryPrivilege 4188 vbc.exe Token: SeIncreaseQuotaPrivilege 4188 vbc.exe Token: SeMachineAccountPrivilege 4188 vbc.exe Token: SeTcbPrivilege 4188 vbc.exe Token: SeSecurityPrivilege 4188 vbc.exe Token: SeTakeOwnershipPrivilege 4188 vbc.exe Token: SeLoadDriverPrivilege 4188 vbc.exe Token: SeSystemProfilePrivilege 4188 vbc.exe Token: SeSystemtimePrivilege 4188 vbc.exe Token: SeProfSingleProcessPrivilege 4188 vbc.exe Token: SeIncBasePriorityPrivilege 4188 vbc.exe Token: SeCreatePagefilePrivilege 4188 vbc.exe Token: SeCreatePermanentPrivilege 4188 vbc.exe Token: SeBackupPrivilege 4188 vbc.exe Token: SeRestorePrivilege 4188 vbc.exe Token: SeShutdownPrivilege 4188 vbc.exe Token: SeDebugPrivilege 4188 vbc.exe Token: SeAuditPrivilege 4188 vbc.exe Token: SeSystemEnvironmentPrivilege 4188 vbc.exe Token: SeChangeNotifyPrivilege 4188 vbc.exe Token: SeRemoteShutdownPrivilege 4188 vbc.exe Token: SeUndockPrivilege 4188 vbc.exe Token: SeSyncAgentPrivilege 4188 vbc.exe Token: SeEnableDelegationPrivilege 4188 vbc.exe Token: SeManageVolumePrivilege 4188 vbc.exe Token: SeImpersonatePrivilege 4188 vbc.exe Token: SeCreateGlobalPrivilege 4188 vbc.exe Token: 31 4188 vbc.exe Token: 32 4188 vbc.exe Token: 33 4188 vbc.exe Token: 34 4188 vbc.exe Token: 35 4188 vbc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4188 vbc.exe 4188 vbc.exe 4188 vbc.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 1928 wrote to memory of 4188 1928 JaffaCakes118_2303e482b151168c841b60df960d6d39.exe 86 PID 1928 wrote to memory of 4188 1928 JaffaCakes118_2303e482b151168c841b60df960d6d39.exe 86 PID 1928 wrote to memory of 4188 1928 JaffaCakes118_2303e482b151168c841b60df960d6d39.exe 86 PID 1928 wrote to memory of 4188 1928 JaffaCakes118_2303e482b151168c841b60df960d6d39.exe 86 PID 1928 wrote to memory of 4188 1928 JaffaCakes118_2303e482b151168c841b60df960d6d39.exe 86 PID 1928 wrote to memory of 4188 1928 JaffaCakes118_2303e482b151168c841b60df960d6d39.exe 86 PID 1928 wrote to memory of 4188 1928 JaffaCakes118_2303e482b151168c841b60df960d6d39.exe 86 PID 1928 wrote to memory of 4188 1928 JaffaCakes118_2303e482b151168c841b60df960d6d39.exe 86 PID 1928 wrote to memory of 4456 1928 JaffaCakes118_2303e482b151168c841b60df960d6d39.exe 88 PID 1928 wrote to memory of 4456 1928 JaffaCakes118_2303e482b151168c841b60df960d6d39.exe 88 PID 1928 wrote to memory of 4456 1928 JaffaCakes118_2303e482b151168c841b60df960d6d39.exe 88 PID 4188 wrote to memory of 956 4188 vbc.exe 90 PID 4188 wrote to memory of 956 4188 vbc.exe 90 PID 4188 wrote to memory of 956 4188 vbc.exe 90 PID 4188 wrote to memory of 3484 4188 vbc.exe 91 PID 4188 wrote to memory of 3484 4188 vbc.exe 91 PID 4188 wrote to memory of 3484 4188 vbc.exe 91 PID 4188 wrote to memory of 4380 4188 vbc.exe 92 PID 4188 wrote to memory of 4380 4188 vbc.exe 92 PID 4188 wrote to memory of 4380 4188 vbc.exe 92 PID 4188 wrote to memory of 4356 4188 vbc.exe 93 PID 4188 wrote to memory of 4356 4188 vbc.exe 93 PID 4188 wrote to memory of 4356 4188 vbc.exe 93 PID 3484 wrote to memory of 1680 3484 cmd.exe 98 PID 3484 wrote to memory of 1680 3484 cmd.exe 98 PID 3484 wrote to memory of 1680 3484 cmd.exe 98 PID 4380 wrote to memory of 3504 4380 cmd.exe 99 PID 4380 wrote to memory of 3504 4380 cmd.exe 99 PID 4380 wrote to memory of 3504 4380 cmd.exe 99 PID 956 wrote to memory of 2340 956 cmd.exe 100 PID 956 wrote to memory of 2340 956 cmd.exe 100 PID 956 wrote to memory of 2340 956 cmd.exe 100 PID 4356 wrote to memory of 1352 4356 cmd.exe 101 PID 4356 wrote to memory of 1352 4356 cmd.exe 101 PID 4356 wrote to memory of 1352 4356 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2303e482b151168c841b60df960d6d39.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2303e482b151168c841b60df960d6d39.exe"1⤵
- Drops file in Drivers directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2340
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1680
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3504
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\rundll.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\rundll.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\rundll.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\rundll.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1352
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Grand Theft Auto IV.bat""2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4456
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
218B
MD549c02c68e9c1ac925c36d778cf8ad2b7
SHA125fed8cf04a4eb4f2cbfdd1e605efb7936a707bf
SHA256f94b188ddfcacebbaf9f92c38409575636b1f6501e03b55ab097544b6ff987bd
SHA5121118f12e997d1cc20ecb473882d4280015c654c63eec5b32f79949e6a3e72e55f0afd600db3e9eee78bd822aa0db910dec3df3eb4785e4c877c3b2babfc26b35
-
Filesize
924KB
MD52303e482b151168c841b60df960d6d39
SHA1c70d7aa2c1631af197306908db8c62e125d6baa4
SHA2567f70a8d1f09dcb87e6ee114eca9e386757590c8731d9aa5f1bb17706616a137f
SHA512fadf96ca12012fd6e2eb6908899dff6f072e11fadacc7dbf67ac5f45edb578803e02c5893518ee533cd611046d87094fe98b228164093ed986149a0c6664403a