Analysis

  • max time kernel
    147s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2025, 03:22

General

  • Target

    JaffaCakes118_504a11600c1bde847c7f997b775f9de1.exe

  • Size

    594KB

  • MD5

    504a11600c1bde847c7f997b775f9de1

  • SHA1

    aaec6106254a44458900f85525925f275518cbcc

  • SHA256

    0b79d9fda8699c0fe4ce12eded4a352e6b73884aa53ad6911c5878043fcb90bb

  • SHA512

    5d8ebfb2b25efd4704b7b1be5faf405d70acbdb0773cdf7af84674fc25d17b6d92b9dca3c5aa88b244398dafd36b87245abe685113f65f8c93f12cce3e8fdfa2

  • SSDEEP

    6144:IBFURClUyP+sRyMfct/PEsFDmpWK7ToTtz7EQqW28mbUsGbnQbXjdNpI:IrURIU3M2ml7c5z7EQt28mgsGnQjLpI

Malware Config

Signatures

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

  • Blackshades family
  • Blackshades payload 16 IoCs
  • Modifies firewall policy service 3 TTPs 8 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504a11600c1bde847c7f997b775f9de1.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504a11600c1bde847c7f997b775f9de1.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops autorun.inf file
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2612
    • C:\Users\Admin\AppData\Local\Temp\AppLaunch\messengerplus.exe
      C:\Users\Admin\AppData\Local\Temp\\AppLaunch\messengerplus.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2788
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2268
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies firewall policy service
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:2680
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\AppLaunch\messengerplus.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AppLaunch\messengerplus.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2812
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\AppLaunch\messengerplus.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AppLaunch\messengerplus.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • Modifies firewall policy service
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:2736
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2688
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies firewall policy service
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:2844
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\msnmsgrs.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\msnmsgrs.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2912
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\msnmsgrs.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\msnmsgrs.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • Modifies firewall policy service
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:2792

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\AppLaunch\messengerplus.exe

          Filesize

          1.1MB

          MD5

          34aa912defa18c2c129f1e09d75c1d7e

          SHA1

          9c3046324657505a30ecd9b1fdb46c05bde7d470

          SHA256

          6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

          SHA512

          d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

        • memory/2612-33-0x0000000074E80000-0x000000007542B000-memory.dmp

          Filesize

          5.7MB

        • memory/2612-1-0x0000000074E80000-0x000000007542B000-memory.dmp

          Filesize

          5.7MB

        • memory/2612-2-0x0000000074E80000-0x000000007542B000-memory.dmp

          Filesize

          5.7MB

        • memory/2612-3-0x0000000074E80000-0x000000007542B000-memory.dmp

          Filesize

          5.7MB

        • memory/2612-4-0x0000000074E80000-0x000000007542B000-memory.dmp

          Filesize

          5.7MB

        • memory/2612-0-0x0000000074E81000-0x0000000074E82000-memory.dmp

          Filesize

          4KB

        • memory/2788-34-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/2788-39-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/2788-18-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/2788-16-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/2788-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2788-23-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/2788-35-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/2788-37-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/2788-38-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/2788-20-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/2788-40-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/2788-42-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/2788-43-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/2788-45-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/2788-49-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/2788-50-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/2788-52-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/2788-53-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/2788-54-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB