Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2025, 21:23
Static task
static1
Behavioral task
behavioral1
Sample
83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe
Resource
win10v2004-20250217-en
General
-
Target
83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe
-
Size
1.6MB
-
MD5
a6373929ec69d0d3bde77aca3f4afd8e
-
SHA1
ad672810598934b2c0e79ec884645f8c784b6b69
-
SHA256
83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700
-
SHA512
6140ded034c5ebff1d43c414ff27611ba79ae42c0e3bc7b02ecc5837a51bda8682daa97a9216c6686ea4186da71b9241af0cd50462519926977e38b2f5108b57
-
SSDEEP
12288:avk//qKF76/OXpqSjnTf0clY9uWC+RMpk1OC7HmrWcmbQC5onsYia:h1zltpu0ia
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 12 IoCs
resource yara_rule behavioral2/memory/3196-36-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/3196-50-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/3196-52-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/3196-54-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/3196-56-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/3196-59-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/3196-61-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/3196-64-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/3196-66-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/3196-68-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/3196-73-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/3196-77-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Control Panel\International\Geo\Nation 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe -
Executes dropped EXE 3 IoCs
pid Process 1760 jusched.exe 3196 jusched.exe 2416 jusched.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Machine = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1760 set thread context of 3196 1760 jusched.exe 94 PID 1760 set thread context of 2416 1760 jusched.exe 95 -
resource yara_rule behavioral2/memory/3196-31-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/3196-36-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/2416-40-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/2416-44-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/2416-37-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3196-34-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/3196-50-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/2416-51-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3196-52-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/3196-54-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/3196-56-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/3196-59-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/3196-61-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/3196-64-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/3196-66-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/3196-68-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/3196-73-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/3196-77-0x0000000000400000-0x000000000045C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 860 reg.exe 2344 reg.exe 2288 reg.exe 944 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 2416 jusched.exe Token: 1 3196 jusched.exe Token: SeCreateTokenPrivilege 3196 jusched.exe Token: SeAssignPrimaryTokenPrivilege 3196 jusched.exe Token: SeLockMemoryPrivilege 3196 jusched.exe Token: SeIncreaseQuotaPrivilege 3196 jusched.exe Token: SeMachineAccountPrivilege 3196 jusched.exe Token: SeTcbPrivilege 3196 jusched.exe Token: SeSecurityPrivilege 3196 jusched.exe Token: SeTakeOwnershipPrivilege 3196 jusched.exe Token: SeLoadDriverPrivilege 3196 jusched.exe Token: SeSystemProfilePrivilege 3196 jusched.exe Token: SeSystemtimePrivilege 3196 jusched.exe Token: SeProfSingleProcessPrivilege 3196 jusched.exe Token: SeIncBasePriorityPrivilege 3196 jusched.exe Token: SeCreatePagefilePrivilege 3196 jusched.exe Token: SeCreatePermanentPrivilege 3196 jusched.exe Token: SeBackupPrivilege 3196 jusched.exe Token: SeRestorePrivilege 3196 jusched.exe Token: SeShutdownPrivilege 3196 jusched.exe Token: SeDebugPrivilege 3196 jusched.exe Token: SeAuditPrivilege 3196 jusched.exe Token: SeSystemEnvironmentPrivilege 3196 jusched.exe Token: SeChangeNotifyPrivilege 3196 jusched.exe Token: SeRemoteShutdownPrivilege 3196 jusched.exe Token: SeUndockPrivilege 3196 jusched.exe Token: SeSyncAgentPrivilege 3196 jusched.exe Token: SeEnableDelegationPrivilege 3196 jusched.exe Token: SeManageVolumePrivilege 3196 jusched.exe Token: SeImpersonatePrivilege 3196 jusched.exe Token: SeCreateGlobalPrivilege 3196 jusched.exe Token: 31 3196 jusched.exe Token: 32 3196 jusched.exe Token: 33 3196 jusched.exe Token: 34 3196 jusched.exe Token: 35 3196 jusched.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3320 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 1760 jusched.exe 3196 jusched.exe 3196 jusched.exe 2416 jusched.exe 3196 jusched.exe -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 3320 wrote to memory of 1328 3320 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 88 PID 3320 wrote to memory of 1328 3320 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 88 PID 3320 wrote to memory of 1328 3320 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 88 PID 1328 wrote to memory of 4224 1328 cmd.exe 92 PID 1328 wrote to memory of 4224 1328 cmd.exe 92 PID 1328 wrote to memory of 4224 1328 cmd.exe 92 PID 3320 wrote to memory of 1760 3320 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 93 PID 3320 wrote to memory of 1760 3320 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 93 PID 3320 wrote to memory of 1760 3320 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 93 PID 1760 wrote to memory of 3196 1760 jusched.exe 94 PID 1760 wrote to memory of 3196 1760 jusched.exe 94 PID 1760 wrote to memory of 3196 1760 jusched.exe 94 PID 1760 wrote to memory of 3196 1760 jusched.exe 94 PID 1760 wrote to memory of 3196 1760 jusched.exe 94 PID 1760 wrote to memory of 3196 1760 jusched.exe 94 PID 1760 wrote to memory of 3196 1760 jusched.exe 94 PID 1760 wrote to memory of 3196 1760 jusched.exe 94 PID 1760 wrote to memory of 2416 1760 jusched.exe 95 PID 1760 wrote to memory of 2416 1760 jusched.exe 95 PID 1760 wrote to memory of 2416 1760 jusched.exe 95 PID 1760 wrote to memory of 2416 1760 jusched.exe 95 PID 1760 wrote to memory of 2416 1760 jusched.exe 95 PID 1760 wrote to memory of 2416 1760 jusched.exe 95 PID 1760 wrote to memory of 2416 1760 jusched.exe 95 PID 1760 wrote to memory of 2416 1760 jusched.exe 95 PID 3196 wrote to memory of 4568 3196 jusched.exe 96 PID 3196 wrote to memory of 4568 3196 jusched.exe 96 PID 3196 wrote to memory of 4568 3196 jusched.exe 96 PID 3196 wrote to memory of 1564 3196 jusched.exe 97 PID 3196 wrote to memory of 1564 3196 jusched.exe 97 PID 3196 wrote to memory of 1564 3196 jusched.exe 97 PID 3196 wrote to memory of 2784 3196 jusched.exe 99 PID 3196 wrote to memory of 2784 3196 jusched.exe 99 PID 3196 wrote to memory of 2784 3196 jusched.exe 99 PID 3196 wrote to memory of 1484 3196 jusched.exe 101 PID 3196 wrote to memory of 1484 3196 jusched.exe 101 PID 3196 wrote to memory of 1484 3196 jusched.exe 101 PID 4568 wrote to memory of 2288 4568 cmd.exe 104 PID 4568 wrote to memory of 2288 4568 cmd.exe 104 PID 4568 wrote to memory of 2288 4568 cmd.exe 104 PID 1564 wrote to memory of 944 1564 cmd.exe 105 PID 1564 wrote to memory of 944 1564 cmd.exe 105 PID 1564 wrote to memory of 944 1564 cmd.exe 105 PID 2784 wrote to memory of 860 2784 cmd.exe 106 PID 2784 wrote to memory of 860 2784 cmd.exe 106 PID 2784 wrote to memory of 860 2784 cmd.exe 106 PID 1484 wrote to memory of 2344 1484 cmd.exe 107 PID 1484 wrote to memory of 2344 1484 cmd.exe 107 PID 1484 wrote to memory of 2344 1484 cmd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe"C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uPKZE.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java Machine" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4224
-
-
-
C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe"C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exeC:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2288
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:944
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:860
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2344
-
-
-
-
C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exeC:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2416
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
149B
MD5976ffa9a304b234c039c8739d97bb893
SHA1f70f7ede8b6e5d1b8a9b53c9bf43882485b55bd6
SHA2562b77cf051bb584aada8b9e5e07cba06e2077b42f009c33d10e31994ceec10384
SHA5121bd398b968736efbab740c81776781023a4ef0dc1c0191d6393a7582bd79b452666163691d82a27ee8989a1e293e6d6df57c303aa9b34497ae52be417f9e269c
-
Filesize
1.6MB
MD524c586d0e426c5c7525be04fa73ef631
SHA1c2b27e25615637a96931d1d82934c18e2a335912
SHA2566dd4f5a9e75605126b1d88448604550e42181163ebab68d538259f0c75955869
SHA512adbf8567ecb9cd5ad3b55860d1f8d35c28905e9c5142bfc629bd72d79251b947600c2f96522c8d1e71abdefdcb2b63ed8095691ed8b5dae340d66c117a273cf1