Analysis
-
max time kernel
147s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
01/03/2025, 17:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe
-
Size
609KB
-
MD5
3a785b75b99a7f68266de756a0b8d771
-
SHA1
685efde599af03ed0ba53c7b8cd2b2119a411309
-
SHA256
f0ad703d49f6b8fa60938222cb111f58e4cc1534856740f8ad47f872894a2f01
-
SHA512
4fa742d8361f1043f4dd02598e41d261164b0b673ddbe694d141e7393f16d35673236fc491854b3268b75a58d0671af124e15eb21b69c9e429f52a41ef4ea064
-
SSDEEP
12288:JMWvgfOETm9LNAF+L+ci1TJd3H4qa+Kn39fWma68I+f55kIIpi:JMW8IL+ci1Vd3H4n39fr+f55kIIp
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 10 IoCs
resource yara_rule behavioral2/memory/996-3-0x0000000000400000-0x00000000005A9000-memory.dmp family_blackshades behavioral2/memory/996-5-0x0000000000400000-0x00000000005A9000-memory.dmp family_blackshades behavioral2/memory/996-18-0x0000000000400000-0x00000000005A9000-memory.dmp family_blackshades behavioral2/memory/996-19-0x0000000000400000-0x00000000005A9000-memory.dmp family_blackshades behavioral2/memory/996-21-0x0000000000400000-0x00000000005A9000-memory.dmp family_blackshades behavioral2/memory/996-22-0x0000000000400000-0x00000000005A9000-memory.dmp family_blackshades behavioral2/memory/996-23-0x0000000000400000-0x00000000005A9000-memory.dmp family_blackshades behavioral2/memory/996-25-0x0000000000400000-0x00000000005A9000-memory.dmp family_blackshades behavioral2/memory/996-26-0x0000000000400000-0x00000000005A9000-memory.dmp family_blackshades behavioral2/memory/996-27-0x0000000000400000-0x00000000005A9000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\ToolbarUpdater.exe = "C:\\Users\\Admin\\AppData\\Roaming\\ToolbarUpdater.exe:*:Enabled:Windows Messanger" reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\QuickTabbing = "C:\\Users\\Admin\\AppData\\Roaming\\MyFolder\\QuickTabbing.exe" WScript.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5112 set thread context of 996 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 96 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000_Classes\Local Settings JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 396 reg.exe 3608 reg.exe 4580 reg.exe 2928 reg.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe Token: 1 996 cvtres.exe Token: SeCreateTokenPrivilege 996 cvtres.exe Token: SeAssignPrimaryTokenPrivilege 996 cvtres.exe Token: SeLockMemoryPrivilege 996 cvtres.exe Token: SeIncreaseQuotaPrivilege 996 cvtres.exe Token: SeMachineAccountPrivilege 996 cvtres.exe Token: SeTcbPrivilege 996 cvtres.exe Token: SeSecurityPrivilege 996 cvtres.exe Token: SeTakeOwnershipPrivilege 996 cvtres.exe Token: SeLoadDriverPrivilege 996 cvtres.exe Token: SeSystemProfilePrivilege 996 cvtres.exe Token: SeSystemtimePrivilege 996 cvtres.exe Token: SeProfSingleProcessPrivilege 996 cvtres.exe Token: SeIncBasePriorityPrivilege 996 cvtres.exe Token: SeCreatePagefilePrivilege 996 cvtres.exe Token: SeCreatePermanentPrivilege 996 cvtres.exe Token: SeBackupPrivilege 996 cvtres.exe Token: SeRestorePrivilege 996 cvtres.exe Token: SeShutdownPrivilege 996 cvtres.exe Token: SeDebugPrivilege 996 cvtres.exe Token: SeAuditPrivilege 996 cvtres.exe Token: SeSystemEnvironmentPrivilege 996 cvtres.exe Token: SeChangeNotifyPrivilege 996 cvtres.exe Token: SeRemoteShutdownPrivilege 996 cvtres.exe Token: SeUndockPrivilege 996 cvtres.exe Token: SeSyncAgentPrivilege 996 cvtres.exe Token: SeEnableDelegationPrivilege 996 cvtres.exe Token: SeManageVolumePrivilege 996 cvtres.exe Token: SeImpersonatePrivilege 996 cvtres.exe Token: SeCreateGlobalPrivilege 996 cvtres.exe Token: 31 996 cvtres.exe Token: 32 996 cvtres.exe Token: 33 996 cvtres.exe Token: 34 996 cvtres.exe Token: 35 996 cvtres.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 996 cvtres.exe 996 cvtres.exe 996 cvtres.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 5112 wrote to memory of 996 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 96 PID 5112 wrote to memory of 996 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 96 PID 5112 wrote to memory of 996 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 96 PID 5112 wrote to memory of 996 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 96 PID 5112 wrote to memory of 996 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 96 PID 5112 wrote to memory of 996 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 96 PID 5112 wrote to memory of 996 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 96 PID 5112 wrote to memory of 996 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 96 PID 996 wrote to memory of 436 996 cvtres.exe 97 PID 996 wrote to memory of 436 996 cvtres.exe 97 PID 996 wrote to memory of 436 996 cvtres.exe 97 PID 996 wrote to memory of 1616 996 cvtres.exe 98 PID 996 wrote to memory of 1616 996 cvtres.exe 98 PID 996 wrote to memory of 1616 996 cvtres.exe 98 PID 996 wrote to memory of 1592 996 cvtres.exe 99 PID 996 wrote to memory of 1592 996 cvtres.exe 99 PID 996 wrote to memory of 1592 996 cvtres.exe 99 PID 996 wrote to memory of 1724 996 cvtres.exe 100 PID 996 wrote to memory of 1724 996 cvtres.exe 100 PID 996 wrote to memory of 1724 996 cvtres.exe 100 PID 436 wrote to memory of 3608 436 cmd.exe 105 PID 436 wrote to memory of 3608 436 cmd.exe 105 PID 436 wrote to memory of 3608 436 cmd.exe 105 PID 1724 wrote to memory of 2928 1724 cmd.exe 106 PID 1724 wrote to memory of 2928 1724 cmd.exe 106 PID 1724 wrote to memory of 2928 1724 cmd.exe 106 PID 1616 wrote to memory of 4580 1616 cmd.exe 107 PID 1616 wrote to memory of 4580 1616 cmd.exe 107 PID 1616 wrote to memory of 4580 1616 cmd.exe 107 PID 1592 wrote to memory of 396 1592 cmd.exe 108 PID 1592 wrote to memory of 396 1592 cmd.exe 108 PID 1592 wrote to memory of 396 1592 cmd.exe 108 PID 5112 wrote to memory of 2904 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 110 PID 5112 wrote to memory of 2904 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 110 PID 5112 wrote to memory of 2904 5112 JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3a785b75b99a7f68266de756a0b8d771.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3608
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4580
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:396
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\ToolbarUpdater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ToolbarUpdater.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\ToolbarUpdater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ToolbarUpdater.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2928
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\MyFolder\tmp6.vbs" 02⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2904
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3