Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/03/2025, 21:32
Static task
static1
Behavioral task
behavioral1
Sample
83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe
Resource
win10v2004-20250217-en
General
-
Target
83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe
-
Size
1.6MB
-
MD5
a6373929ec69d0d3bde77aca3f4afd8e
-
SHA1
ad672810598934b2c0e79ec884645f8c784b6b69
-
SHA256
83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700
-
SHA512
6140ded034c5ebff1d43c414ff27611ba79ae42c0e3bc7b02ecc5837a51bda8682daa97a9216c6686ea4186da71b9241af0cd50462519926977e38b2f5108b57
-
SSDEEP
12288:avk//qKF76/OXpqSjnTf0clY9uWC+RMpk1OC7HmrWcmbQC5onsYia:h1zltpu0ia
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 10 IoCs
resource yara_rule behavioral1/memory/2800-57-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2800-66-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2800-70-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2800-72-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2800-75-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2800-77-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2800-80-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2800-84-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2800-89-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2800-94-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Executes dropped EXE 3 IoCs
pid Process 2768 jusched.exe 2800 jusched.exe 2036 jusched.exe -
Loads dropped DLL 7 IoCs
pid Process 1256 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 1256 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 1256 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 1256 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 1256 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 2768 jusched.exe 2768 jusched.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java Machine = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2768 set thread context of 2800 2768 jusched.exe 34 PID 2768 set thread context of 2036 2768 jusched.exe 35 -
resource yara_rule behavioral1/memory/2036-58-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2800-57-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2036-56-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2800-53-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2800-52-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2036-51-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2036-67-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2800-66-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2800-70-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2800-72-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2800-75-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2800-77-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2800-80-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2800-84-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2800-89-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2800-94-0x0000000000400000-0x000000000045C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 868 reg.exe 2672 reg.exe 1776 reg.exe 1724 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 2036 jusched.exe Token: 1 2800 jusched.exe Token: SeCreateTokenPrivilege 2800 jusched.exe Token: SeAssignPrimaryTokenPrivilege 2800 jusched.exe Token: SeLockMemoryPrivilege 2800 jusched.exe Token: SeIncreaseQuotaPrivilege 2800 jusched.exe Token: SeMachineAccountPrivilege 2800 jusched.exe Token: SeTcbPrivilege 2800 jusched.exe Token: SeSecurityPrivilege 2800 jusched.exe Token: SeTakeOwnershipPrivilege 2800 jusched.exe Token: SeLoadDriverPrivilege 2800 jusched.exe Token: SeSystemProfilePrivilege 2800 jusched.exe Token: SeSystemtimePrivilege 2800 jusched.exe Token: SeProfSingleProcessPrivilege 2800 jusched.exe Token: SeIncBasePriorityPrivilege 2800 jusched.exe Token: SeCreatePagefilePrivilege 2800 jusched.exe Token: SeCreatePermanentPrivilege 2800 jusched.exe Token: SeBackupPrivilege 2800 jusched.exe Token: SeRestorePrivilege 2800 jusched.exe Token: SeShutdownPrivilege 2800 jusched.exe Token: SeDebugPrivilege 2800 jusched.exe Token: SeAuditPrivilege 2800 jusched.exe Token: SeSystemEnvironmentPrivilege 2800 jusched.exe Token: SeChangeNotifyPrivilege 2800 jusched.exe Token: SeRemoteShutdownPrivilege 2800 jusched.exe Token: SeUndockPrivilege 2800 jusched.exe Token: SeSyncAgentPrivilege 2800 jusched.exe Token: SeEnableDelegationPrivilege 2800 jusched.exe Token: SeManageVolumePrivilege 2800 jusched.exe Token: SeImpersonatePrivilege 2800 jusched.exe Token: SeCreateGlobalPrivilege 2800 jusched.exe Token: 31 2800 jusched.exe Token: 32 2800 jusched.exe Token: 33 2800 jusched.exe Token: 34 2800 jusched.exe Token: 35 2800 jusched.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1256 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 2768 jusched.exe 2036 jusched.exe 2800 jusched.exe 2800 jusched.exe 2800 jusched.exe -
Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 1256 wrote to memory of 2284 1256 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 30 PID 1256 wrote to memory of 2284 1256 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 30 PID 1256 wrote to memory of 2284 1256 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 30 PID 1256 wrote to memory of 2284 1256 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 30 PID 2284 wrote to memory of 2816 2284 cmd.exe 32 PID 2284 wrote to memory of 2816 2284 cmd.exe 32 PID 2284 wrote to memory of 2816 2284 cmd.exe 32 PID 2284 wrote to memory of 2816 2284 cmd.exe 32 PID 1256 wrote to memory of 2768 1256 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 33 PID 1256 wrote to memory of 2768 1256 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 33 PID 1256 wrote to memory of 2768 1256 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 33 PID 1256 wrote to memory of 2768 1256 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 33 PID 2768 wrote to memory of 2800 2768 jusched.exe 34 PID 2768 wrote to memory of 2800 2768 jusched.exe 34 PID 2768 wrote to memory of 2800 2768 jusched.exe 34 PID 2768 wrote to memory of 2800 2768 jusched.exe 34 PID 2768 wrote to memory of 2800 2768 jusched.exe 34 PID 2768 wrote to memory of 2800 2768 jusched.exe 34 PID 2768 wrote to memory of 2800 2768 jusched.exe 34 PID 2768 wrote to memory of 2800 2768 jusched.exe 34 PID 2768 wrote to memory of 2800 2768 jusched.exe 34 PID 2768 wrote to memory of 2036 2768 jusched.exe 35 PID 2768 wrote to memory of 2036 2768 jusched.exe 35 PID 2768 wrote to memory of 2036 2768 jusched.exe 35 PID 2768 wrote to memory of 2036 2768 jusched.exe 35 PID 2768 wrote to memory of 2036 2768 jusched.exe 35 PID 2768 wrote to memory of 2036 2768 jusched.exe 35 PID 2768 wrote to memory of 2036 2768 jusched.exe 35 PID 2768 wrote to memory of 2036 2768 jusched.exe 35 PID 2768 wrote to memory of 2036 2768 jusched.exe 35 PID 2800 wrote to memory of 2644 2800 jusched.exe 36 PID 2800 wrote to memory of 2644 2800 jusched.exe 36 PID 2800 wrote to memory of 2644 2800 jusched.exe 36 PID 2800 wrote to memory of 2644 2800 jusched.exe 36 PID 2800 wrote to memory of 2676 2800 jusched.exe 37 PID 2800 wrote to memory of 2676 2800 jusched.exe 37 PID 2800 wrote to memory of 2676 2800 jusched.exe 37 PID 2800 wrote to memory of 2676 2800 jusched.exe 37 PID 2800 wrote to memory of 2688 2800 jusched.exe 38 PID 2800 wrote to memory of 2688 2800 jusched.exe 38 PID 2800 wrote to memory of 2688 2800 jusched.exe 38 PID 2800 wrote to memory of 2688 2800 jusched.exe 38 PID 2800 wrote to memory of 2348 2800 jusched.exe 40 PID 2800 wrote to memory of 2348 2800 jusched.exe 40 PID 2800 wrote to memory of 2348 2800 jusched.exe 40 PID 2800 wrote to memory of 2348 2800 jusched.exe 40 PID 2676 wrote to memory of 1776 2676 cmd.exe 43 PID 2676 wrote to memory of 1776 2676 cmd.exe 43 PID 2676 wrote to memory of 1776 2676 cmd.exe 43 PID 2676 wrote to memory of 1776 2676 cmd.exe 43 PID 2644 wrote to memory of 2672 2644 cmd.exe 45 PID 2644 wrote to memory of 2672 2644 cmd.exe 45 PID 2644 wrote to memory of 2672 2644 cmd.exe 45 PID 2644 wrote to memory of 2672 2644 cmd.exe 45 PID 2688 wrote to memory of 868 2688 cmd.exe 46 PID 2688 wrote to memory of 868 2688 cmd.exe 46 PID 2688 wrote to memory of 868 2688 cmd.exe 46 PID 2688 wrote to memory of 868 2688 cmd.exe 46 PID 2348 wrote to memory of 1724 2348 cmd.exe 47 PID 2348 wrote to memory of 1724 2348 cmd.exe 47 PID 2348 wrote to memory of 1724 2348 cmd.exe 47 PID 2348 wrote to memory of 1724 2348 cmd.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe"C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\WRiAQ.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java Machine" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2816
-
-
-
C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe"C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exeC:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2672
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1776
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:868
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1724
-
-
-
-
C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exeC:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2036
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
149B
MD5976ffa9a304b234c039c8739d97bb893
SHA1f70f7ede8b6e5d1b8a9b53c9bf43882485b55bd6
SHA2562b77cf051bb584aada8b9e5e07cba06e2077b42f009c33d10e31994ceec10384
SHA5121bd398b968736efbab740c81776781023a4ef0dc1c0191d6393a7582bd79b452666163691d82a27ee8989a1e293e6d6df57c303aa9b34497ae52be417f9e269c
-
Filesize
1.6MB
MD5ee9e019835a8d8831eb35721be4fbcb1
SHA1cb3dfdcf53c31b2b7a4ed5cce6e1a60d5cc7ff59
SHA256cde0685cf3aa90b1ed5e171dcc877c1dc953a559fbba7607d5c02ac8fd4854b7
SHA512497959b05ebba0bdc4b62f6eba414f85f24c61b811743ec651d6eba0ec99faebd863d447cd6166f3591c4ade0907f1a6e58013769198684fabd8680b67702cc5