Analysis

  • max time kernel
    147s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2025, 03:22

General

  • Target

    JaffaCakes118_504a11600c1bde847c7f997b775f9de1.exe

  • Size

    594KB

  • MD5

    504a11600c1bde847c7f997b775f9de1

  • SHA1

    aaec6106254a44458900f85525925f275518cbcc

  • SHA256

    0b79d9fda8699c0fe4ce12eded4a352e6b73884aa53ad6911c5878043fcb90bb

  • SHA512

    5d8ebfb2b25efd4704b7b1be5faf405d70acbdb0773cdf7af84674fc25d17b6d92b9dca3c5aa88b244398dafd36b87245abe685113f65f8c93f12cce3e8fdfa2

  • SSDEEP

    6144:IBFURClUyP+sRyMfct/PEsFDmpWK7ToTtz7EQqW28mbUsGbnQbXjdNpI:IrURIU3M2ml7c5z7EQt28mgsGnQjLpI

Malware Config

Signatures

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

  • Blackshades family
  • Blackshades payload 15 IoCs
  • Modifies firewall policy service 3 TTPs 10 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504a11600c1bde847c7f997b775f9de1.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_504a11600c1bde847c7f997b775f9de1.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5116
    • C:\Users\Admin\AppData\Local\Temp\AppLaunch\messengerplus.exe
      C:\Users\Admin\AppData\Local\Temp\\AppLaunch\messengerplus.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1604
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3812
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies firewall policy service
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:1684
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\AppLaunch\messengerplus.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AppLaunch\messengerplus.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4924
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\AppLaunch\messengerplus.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AppLaunch\messengerplus.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • Modifies firewall policy service
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:2392
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4340
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies firewall policy service
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:1348
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\msnmsgrs.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\msnmsgrs.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4064
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\msnmsgrs.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\msnmsgrs.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • Modifies firewall policy service
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:388

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\AppLaunch\messengerplus.exe

          Filesize

          1.1MB

          MD5

          d881de17aa8f2e2c08cbb7b265f928f9

          SHA1

          08936aebc87decf0af6e8eada191062b5e65ac2a

          SHA256

          b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

          SHA512

          5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

        • memory/1604-28-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/1604-42-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/1604-47-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/1604-46-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/1604-15-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/1604-19-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/1604-45-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/1604-43-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/1604-27-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/1604-32-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/1604-36-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/1604-31-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/1604-30-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/1604-34-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/1604-35-0x0000000000400000-0x000000000047A000-memory.dmp

          Filesize

          488KB

        • memory/5116-2-0x0000000074DA0000-0x0000000075351000-memory.dmp

          Filesize

          5.7MB

        • memory/5116-0-0x0000000074DA2000-0x0000000074DA3000-memory.dmp

          Filesize

          4KB

        • memory/5116-26-0x0000000074DA0000-0x0000000075351000-memory.dmp

          Filesize

          5.7MB

        • memory/5116-25-0x0000000074DA2000-0x0000000074DA3000-memory.dmp

          Filesize

          4KB

        • memory/5116-1-0x0000000074DA0000-0x0000000075351000-memory.dmp

          Filesize

          5.7MB

        • memory/5116-5-0x0000000074DA0000-0x0000000075351000-memory.dmp

          Filesize

          5.7MB