Analysis
-
max time kernel
147s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system -
submitted
04/03/2025, 13:00
Behavioral task
behavioral1
Sample
JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe
Resource
win7-20250207-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe
-
Size
174KB
-
MD5
4d7d6187c6df8f474df8155d8f4d0525
-
SHA1
1693c24cd00522be86100218b93872c60532c834
-
SHA256
c9f4808a4bf242e610cdddcd0f062e52b1f39e14b7ec2e08d11e4221089b7ef7
-
SHA512
03150d410343c0b3a56ffad0088586ce3a6831a088204d4e661886a1e946082aea8e93241d0271555bb1ae08c2f2cf32972bb8796f50616cebf26ea71d6a0303
-
SSDEEP
3072:yEjVHeXUTN4Ns1vJxrOL60AD85h3/Cz+ZYyXGdoyQdFKj3kCTN9SJC0ekTj:yEjVLTONWJxrOLw85Z/7lDUjNj70ewj
Score
10/10
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 12 IoCs
resource yara_rule behavioral1/memory/2796-9-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral1/memory/2796-11-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral1/memory/2796-13-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral1/memory/2796-14-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral1/memory/2796-15-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral1/memory/2796-16-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral1/memory/2796-18-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral1/memory/2796-19-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral1/memory/2796-21-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral1/memory/2796-23-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral1/memory/2796-25-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades behavioral1/memory/2796-26-0x0000000000400000-0x000000000047B000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\winupdate.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\winupdate.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
resource yara_rule behavioral1/memory/2796-0-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/2796-9-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/2796-11-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/2796-13-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/2796-14-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/2796-15-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/2796-16-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/2796-18-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/2796-19-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/2796-21-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/2796-23-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/2796-25-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/2796-26-0x0000000000400000-0x000000000047B000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 1844 reg.exe 3040 reg.exe 2732 reg.exe 2928 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeCreateTokenPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeAssignPrimaryTokenPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeLockMemoryPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeIncreaseQuotaPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeMachineAccountPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeTcbPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeSecurityPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeTakeOwnershipPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeLoadDriverPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeSystemProfilePrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeSystemtimePrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeProfSingleProcessPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeIncBasePriorityPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeCreatePagefilePrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeCreatePermanentPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeBackupPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeRestorePrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeShutdownPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeDebugPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeAuditPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeSystemEnvironmentPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeChangeNotifyPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeRemoteShutdownPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeUndockPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeSyncAgentPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeEnableDelegationPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeManageVolumePrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeImpersonatePrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeCreateGlobalPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: 31 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: 32 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: 33 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: 34 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: 35 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe Token: SeDebugPrivilege 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2796 wrote to memory of 1628 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe 31 PID 2796 wrote to memory of 1628 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe 31 PID 2796 wrote to memory of 1628 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe 31 PID 2796 wrote to memory of 1628 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe 31 PID 2796 wrote to memory of 2756 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe 32 PID 2796 wrote to memory of 2756 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe 32 PID 2796 wrote to memory of 2756 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe 32 PID 2796 wrote to memory of 2756 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe 32 PID 2796 wrote to memory of 2764 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe 33 PID 2796 wrote to memory of 2764 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe 33 PID 2796 wrote to memory of 2764 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe 33 PID 2796 wrote to memory of 2764 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe 33 PID 2796 wrote to memory of 2872 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe 34 PID 2796 wrote to memory of 2872 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe 34 PID 2796 wrote to memory of 2872 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe 34 PID 2796 wrote to memory of 2872 2796 JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe 34 PID 2756 wrote to memory of 2732 2756 cmd.exe 40 PID 2756 wrote to memory of 2732 2756 cmd.exe 40 PID 2756 wrote to memory of 2732 2756 cmd.exe 40 PID 2756 wrote to memory of 2732 2756 cmd.exe 40 PID 2764 wrote to memory of 2928 2764 cmd.exe 42 PID 2764 wrote to memory of 2928 2764 cmd.exe 42 PID 2764 wrote to memory of 2928 2764 cmd.exe 42 PID 2764 wrote to memory of 2928 2764 cmd.exe 42 PID 2872 wrote to memory of 1844 2872 cmd.exe 39 PID 1628 wrote to memory of 3040 1628 cmd.exe 41 PID 2872 wrote to memory of 1844 2872 cmd.exe 39 PID 1628 wrote to memory of 3040 1628 cmd.exe 41 PID 2872 wrote to memory of 1844 2872 cmd.exe 39 PID 1628 wrote to memory of 3040 1628 cmd.exe 41 PID 2872 wrote to memory of 1844 2872 cmd.exe 39 PID 1628 wrote to memory of 3040 1628 cmd.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3040
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d7d6187c6df8f474df8155d8f4d0525.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2732
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2928
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\winupdate.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\winupdate.exe:*:Enabled:Windows Messanger" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\winupdate.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\winupdate.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1844
-
-