Overview

overview

10

Static

static

3

JaffaCakes...fa.exe

windows7-x64

JaffaCakes...fa.exe

windows10-2004-x64

Analysis

  • max time kernel
    33s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02/03/2025, 12:00

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    JaffaCakes118_4014db815996cdacdf3bb0e4e83f2dfa.exe

  • Size

    6.5MB

  • MD5

    4014db815996cdacdf3bb0e4e83f2dfa

  • SHA1

    a23415316f3820fb0f276ffb1b72637b5e09a3e6

  • SHA256

    62e0d9686d8ff84b01797ac16e9893ad9388b0905127843db0b4745976f5e00c

  • SHA512

    bdf1c3509bf02233878f22baa1437feacf49bba07c01a01183255ad06cfdded922aac9d453138d44b7e65e301f3637dd64142405090f09bad02b2ab948490c88

  • SSDEEP

    196608:qv3gGGJjVPLMloDujzv+0+8I5KKruB5a5z0:qvYbTVDaVe5KMCay

Score
10/10
blackshadesbootkitdefense_evasiondiscoverypersistenceratupx

Malware Config

Signatures

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades
  • Blackshades family
    blackshades
  • Blackshades payload 5 IoCs
  • Modifies firewall policy service 3 TTPs 8 IoCs
    defense_evasion
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops file in Drivers directory 15 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 22 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 24 IoCs
  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4014db815996cdacdf3bb0e4e83f2dfa.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4014db815996cdacdf3bb0e4e83f2dfa.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2912
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3036
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Writes to the Master Boot Record (MBR)
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1840
        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe
          "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe"
          4⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2480
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2900
            • C:\Windows\SysWOW64\reg.exe
              REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
              6⤵
              • Modifies firewall policy service
              • System Location Discovery: System Language Discovery
              • Modifies registry key
              PID:2632
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe:*:Enabled:Windows Messanger" /f
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2888
            • C:\Windows\SysWOW64\reg.exe
              REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe:*:Enabled:Windows Messanger" /f
              6⤵
              • Modifies firewall policy service
              • System Location Discovery: System Language Discovery
              • Modifies registry key
              PID:2624
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2872
            • C:\Windows\SysWOW64\reg.exe
              REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
              6⤵
              • Modifies firewall policy service
              • System Location Discovery: System Language Discovery
              • Modifies registry key
              PID:2676
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2876
            • C:\Windows\SysWOW64\reg.exe
              REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
              6⤵
              • Modifies firewall policy service
              • System Location Discovery: System Language Discovery
              • Modifies registry key
              PID:2616
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUPA~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUPA~1.EXE
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:2248
      • C:\Users\Admin\AppData\Local\Temp\nstB895.tmp\AnyDVDTray.exe
        "C:\Users\Admin\AppData\Local\Temp\nstB895.tmp\AnyDVDTray.exe" -c
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:832
      • C:\Program Files (x86)\SlySoft\AnyDVD\SetRegACL.exe
        "C:\Program Files (x86)\SlySoft\AnyDVD\SetRegACL.exe" Software\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons 64
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2500
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:2980
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:1996

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      3
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      2
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Pre-OS Boot

      1
      T1542

      Bootkit

      1
      T1542.003

      Privilege Escalation

      Boot or Logon Autostart Execution

      3
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      2
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Defense Evasion

      Impair Defenses

      1
      T1562

      Disable or Modify System Firewall

      1
      T1562.004

      Modify Registry

      5
      T1112

      Pre-OS Boot

      1
      T1542

      Bootkit

      1
      T1542.003

      Credential Access

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      1
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVD-uninst.exe
        Filesize

        28KB

        MD5

        6880bce6d5c48861dfef9cf4025b443f

        SHA1

        fd8431dada83de3e3d89c7ffbaddca831e7eb433

        SHA256

        49609892beeeaf14dcf57e17a94053c5fcf42756cb2637375c96ea8952dca63e

        SHA512

        0bb4af38190a60a968baf2abc5ff2cc651e2c3aee376596acae680bb3503957d417603397b9d0901dbb19919fd712066a54adb5240f5bcf02e444e49e8b53055

        Download Submit

      • C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVD-uninst.ini
        Filesize

        4KB

        MD5

        080c96bfa330dd18021b9507647a52a3

        SHA1

        1b7a2d89ec4eb3057ffa4f3245be7b2319d6af8a

        SHA256

        03da71d1671acaf206e14d457f03557e961fa53b9da4ea20a6908ff0824009e0

        SHA512

        8ddd8bbb70bc4038016468468f3f2e7742f3df76744f1fc33fe6a1690695e604e88eb7fc3f96843ba8f4b478611f5aed7d646228db73b5398e93d84e50bc2b00

        Download Submit

      • C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVD.exe
        Filesize

        90KB

        MD5

        84169de84cde3677912c648bada4e600

        SHA1

        434427ab22b4ebad7390ac8b0f3f6b9a04b6e42e

        SHA256

        63f0eb9e9eb1cb6b7822ed37e998a7a77d6b79038dc58519d9e357debcbd9110

        SHA512

        863165f2c27de8775bedae7f1ee2e61230786f7266611420538717d6adddd6edafd206c8b5dd39319ad2e2f2d8d4e6ce0d58320d763061c6ec4e213b045cad76

        Download Submit

      • C:\Program Files (x86)\SlySoft\AnyDVD\SetRegACL.exe
        Filesize

        52KB

        MD5

        d866d346523fcb09f96384afcbd8f757

        SHA1

        d53600fcaf09f42bf1c0b2411960bb66f702b76a

        SHA256

        bd36f2094a3d2fd79a649f00e4196e45c50727dc745d570d1804e0834266a934

        SHA512

        7547d86136d266f670bcc6d8b126ca58d38596dda3c47183799f7b79cb1461d118b825b91fa066fe1126b123e00351bc18fa335a43e36932f13c047bbe300e53

        Download Submit

      • \Program Files (x86)\SlySoft\AnyDVD\HelpLauncher.exe
        Filesize

        6KB

        MD5

        e2393ca981b0b538fa3923af06734f2d

        SHA1

        66a6bff64217d610553d98730c1a691ddf1202fc

        SHA256

        ed31f5cc42b52ae1a8d47216883ee2ce6d9079ea274149621ac64fc9bb9a7023

        SHA512

        f97440ace8250ad0604757731c2af09e8b9ac6df1cc2d433606e9ccf6198204ef155da5c159aff60a6fa7f5f9afa7e495db754c5fe047a75e92b4881b336fb30

        Download Submit

      • \Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUPA~1.EXE
        Filesize

        6.1MB

        MD5

        b2eafc38fafbe40722dc7eed655e304c

        SHA1

        4cfa5482f6b4c72b16485d929bec020c8c7ad366

        SHA256

        9d84ac796710b7b59b1f7772cd6c6da1fa8136c77d85ff0321b2c916686e346c

        SHA512

        fb3c94765531ea9c9c1aa2d517316b0c50874e62350ed06a99231496a598b5cdbd5b7904157efe9be332bb087d932d67e8d53efa22001398cbe908ec78323618

        Download Submit

      • \Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe
        Filesize

        404KB

        MD5

        e08181892440c61a291ce6a2b6854665

        SHA1

        8f15394936201860f27208598f997512e5cae5b0

        SHA256

        62db06ca80a0b52f3c0adbfb431931fd59030d6318b4aa0640f295ec2786567f

        SHA512

        a54d78a22241c537c3d960e5b5c9bcd297c3cd384b654f8585afc51b2e27ff584beb5ef5c9417a168b112aa4bd4ffd9a8ad2637d3fe6a13e8ce21768ec875ac9

        Download Submit

      • \Users\Admin\AppData\Local\Temp\nstB895.tmp\AnyDVDtray.exe
        Filesize

        4.3MB

        MD5

        f5e7fb080e61cb64a1c87ea184221bbb

        SHA1

        dca8867a86fb72dfa5d169482c890d13b1cdf1a9

        SHA256

        5b0bfac52b2f1cead27a118a7761b62e17ba4b008340e503749e7a57960e3870

        SHA512

        da3a8221d7d46ad1a24638c4a0d2a80993eb7ea254d57f0de3ad7a9907932dbd883ef78201a8213d082bdb2fe1c8f0c968042bd1b5671e60faf1f4f431cfda78

        Download Submit

      • memory/832-85-0x0000000000400000-0x0000000000A6D000-memory.dmp

        Filesize

        6.4MB

        Download

      • memory/1840-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1840-57-0x0000000000400000-0x000000000045A000-memory.dmp

        Filesize

        360KB

        Download

      • memory/1840-19-0x0000000000400000-0x000000000045A000-memory.dmp

        Filesize

        360KB

        Download

      • memory/1840-17-0x0000000000400000-0x000000000045A000-memory.dmp

        Filesize

        360KB

        Download

      • memory/1840-25-0x0000000000400000-0x000000000045A000-memory.dmp

        Filesize

        360KB

        Download

      • memory/1840-28-0x0000000000400000-0x000000000045A000-memory.dmp

        Filesize

        360KB

        Download

      • memory/1840-15-0x0000000000400000-0x000000000045A000-memory.dmp

        Filesize

        360KB

        Download

      • memory/2248-66-0x00000000001D0000-0x00000000001F8000-memory.dmp

        Filesize

        160KB

        Download

      • memory/2248-86-0x0000000000400000-0x0000000000428000-memory.dmp

        Filesize

        160KB

        Download

      • memory/2248-305-0x0000000000400000-0x0000000000428000-memory.dmp

        Filesize

        160KB

        Download

      • memory/2248-302-0x0000000000400000-0x0000000000428000-memory.dmp

        Filesize

        160KB

        Download

      • memory/2248-58-0x0000000000400000-0x0000000000428000-memory.dmp

        Filesize

        160KB

        Download

      • memory/2248-72-0x0000000000400000-0x0000000000428000-memory.dmp

        Filesize

        160KB

        Download

      • memory/2248-99-0x00000000007E0000-0x00000000007E8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/2248-84-0x0000000003540000-0x0000000003BAD000-memory.dmp

        Filesize

        6.4MB

        Download

      • memory/2248-88-0x0000000003540000-0x0000000003BAD000-memory.dmp

        Filesize

        6.4MB

        Download

      • memory/2480-53-0x0000000000400000-0x0000000000497000-memory.dmp

        Filesize

        604KB

        Download

      • memory/2480-87-0x0000000000400000-0x0000000000497000-memory.dmp

        Filesize

        604KB

        Download

      • memory/2480-42-0x0000000000400000-0x0000000000497000-memory.dmp

        Filesize

        604KB

        Download

      • memory/2480-46-0x0000000000400000-0x0000000000497000-memory.dmp

        Filesize

        604KB

        Download

      • memory/2480-48-0x0000000000400000-0x0000000000497000-memory.dmp

        Filesize

        604KB

        Download

      • memory/2480-52-0x0000000000400000-0x0000000000497000-memory.dmp

        Filesize

        604KB

        Download

      • memory/2480-38-0x0000000000400000-0x0000000000497000-memory.dmp

        Filesize

        604KB

        Download

      • memory/2480-71-0x0000000000400000-0x0000000000497000-memory.dmp

        Filesize

        604KB

        Download

      • memory/2480-303-0x0000000000400000-0x0000000000497000-memory.dmp

        Filesize

        604KB

        Download

      • memory/2480-40-0x0000000000400000-0x0000000000497000-memory.dmp

        Filesize

        604KB

        Download

      • memory/2480-306-0x0000000000400000-0x0000000000497000-memory.dmp

        Filesize

        604KB

        Download

      • memory/2912-43-0x00000000001C0000-0x00000000001E8000-memory.dmp

        Filesize

        160KB

        Download

      • memory/2912-70-0x00000000001C0000-0x00000000001E8000-memory.dmp

        Filesize

        160KB

        Download