Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12/03/2025, 23:33

General

  • Target

    JaffaCakes118_6da594486142914ee4f78e001c9690ad.exe

  • Size

    500KB

  • MD5

    6da594486142914ee4f78e001c9690ad

  • SHA1

    b16634c756d83f1db811752a689644cfca5a8e2e

  • SHA256

    ad5c490bfa764f4ed62207e83ba8e99bc1559f03b1a0faabbc3d13399521ea13

  • SHA512

    caaeba6d91a2c711480a9c5142d58b1336d92353ec9355c696e9167d1255f55f1f58072370b4f58553e7a0079518820a9b69701768df177583f0f14d7f2d4e2a

  • SSDEEP

    12288:296gpTDWvhql11SdWieLja7/QAYzTpbKqTGp:c6CipySdWLabQ59bPG

Malware Config

Signatures

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

  • Blackshades family
  • Blackshades payload 13 IoCs
  • Modifies firewall policy service 3 TTPs 8 IoCs
  • Loads dropped DLL 3 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6da594486142914ee4f78e001c9690ad.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6da594486142914ee4f78e001c9690ad.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1892
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2708
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2872
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies firewall policy service
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:2284
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2724
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • Modifies firewall policy service
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:2096
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2688
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies firewall policy service
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:2620
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2844
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • Modifies firewall policy service
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:2400

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\lprjJlQBvkFvmzLtsgSt\lprjJlQBvkFvmzLtsgSt\1.0.1.1\kernel32.dll

    Filesize

    18KB

    MD5

    e4b4f52d91c49da13fc81a654763bb61

    SHA1

    75b42b5236cbe8ff240a98f3553b17dc4a8ad7cb

    SHA256

    45b2457fc46410edd11de51437e2561a661d37ebf2c3790db31876ad064be0d1

    SHA512

    bcbb042be2ee1d848525e10784b473702a06d7818ad1acfd77cd624bf0750f9aa2d8d172bfe3a916b33561e20ce69a07009f23fbfffb509a54014cd2a58bd288

  • memory/1892-27-0x0000000073FE0000-0x000000007458B000-memory.dmp

    Filesize

    5.7MB

  • memory/1892-1-0x0000000073FE0000-0x000000007458B000-memory.dmp

    Filesize

    5.7MB

  • memory/1892-2-0x0000000073FE0000-0x000000007458B000-memory.dmp

    Filesize

    5.7MB

  • memory/1892-0-0x0000000073FE1000-0x0000000073FE2000-memory.dmp

    Filesize

    4KB

  • memory/2708-33-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/2708-36-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/2708-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2708-24-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/2708-20-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/2708-18-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/2708-34-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/2708-21-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/2708-37-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/2708-38-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/2708-39-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/2708-40-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/2708-41-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/2708-42-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/2708-43-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/2708-44-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB