Analysis

  • max time kernel
    147s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26/02/2025, 03:03

General

  • Target

    JaffaCakes118_2392316e710472968d2547c5165a878a.exe

  • Size

    576KB

  • MD5

    2392316e710472968d2547c5165a878a

  • SHA1

    2401e6cddd3196e1c3d6db94dfc47af43798ef54

  • SHA256

    706de930537df09595f349deb66e26126a1ece049bcb1f8cea52dfe190ae8820

  • SHA512

    c85e41342c771f31c8cc41adb4e508c823569c357d9840fe2c574857ad29862097516c1a7f8a77ab94bf9be98b044a4875ba5247dc65b70c436deb0e667af16a

  • SSDEEP

    12288:jECAPL1qjQudTZVsMw3+tZuq8X+HQ2yOUQMcMH3S:gCAPcj5Xw3+tQXAQ2yOUQMT3S

Malware Config

Signatures

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

  • Blackshades family
  • Blackshades payload 13 IoCs
  • Modifies firewall policy service 3 TTPs 8 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2392316e710472968d2547c5165a878a.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2392316e710472968d2547c5165a878a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2392316e710472968d2547c5165a878a.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2392316e710472968d2547c5165a878a.exe"
      2⤵
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3060
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2392316e710472968d2547c5165a878a.exe
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2392316e710472968d2547c5165a878a.exe"
        3⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:540
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2752
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:2900
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2392316e710472968d2547c5165a878a.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2392316e710472968d2547c5165a878a.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2716
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2392316e710472968d2547c5165a878a.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2392316e710472968d2547c5165a878a.exe:*:Enabled:Windows Messanger" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:2772
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2828
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:2872
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\rundll32.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\rundll32.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2856
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\rundll32.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\rundll32.exe:*:Enabled:Windows Messanger" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:2876

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/540-41-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/540-34-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/540-65-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/540-62-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/540-53-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/540-48-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/540-17-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/540-25-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/540-21-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/540-46-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/540-44-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/540-33-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/540-19-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/540-36-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/540-37-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/3060-12-0x0000000000400000-0x0000000000475000-memory.dmp

    Filesize

    468KB

  • memory/3060-14-0x0000000000400000-0x0000000000475000-memory.dmp

    Filesize

    468KB

  • memory/3060-35-0x0000000000400000-0x0000000000475000-memory.dmp

    Filesize

    468KB

  • memory/3060-4-0x0000000000400000-0x0000000000475000-memory.dmp

    Filesize

    468KB

  • memory/3060-2-0x0000000000400000-0x0000000000475000-memory.dmp

    Filesize

    468KB

  • memory/3060-6-0x0000000000400000-0x0000000000475000-memory.dmp

    Filesize

    468KB

  • memory/3060-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB