General
-
Target
JaffaCakes118_77e6391148fdd981304ccdb6b35a73b4
-
Size
278KB
-
Sample
250315-zr8xlss1ex
-
MD5
77e6391148fdd981304ccdb6b35a73b4
-
SHA1
ac5f4bb0ade0cfdad9421c4bfc766fa4073cc754
-
SHA256
bacaa1d75bb44e36e42e5934a85501d6466b0eb0842d3c4ce2809cadc688210d
-
SHA512
311a77b93031aab0b92bfb05143c22ba68d44e88f10dc080eaee35288d5c7d23317ef2efd6fd3c9c43e7115d87d0e78fb377fd0e862b0109f2e74c977b2a2d20
-
SSDEEP
6144:ViMqc2Yr6H5NtSfFDfyOPDpSlSAMtJPJ7D/JmiL5BRG:QMKk6kRfyUDA0JPJHBmiLhG
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_77e6391148fdd981304ccdb6b35a73b4.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
JaffaCakes118_77e6391148fdd981304ccdb6b35a73b4.exe
Resource
win10v2004-20250314-en
Malware Config
Targets
-
-
Target
JaffaCakes118_77e6391148fdd981304ccdb6b35a73b4
-
Size
278KB
-
MD5
77e6391148fdd981304ccdb6b35a73b4
-
SHA1
ac5f4bb0ade0cfdad9421c4bfc766fa4073cc754
-
SHA256
bacaa1d75bb44e36e42e5934a85501d6466b0eb0842d3c4ce2809cadc688210d
-
SHA512
311a77b93031aab0b92bfb05143c22ba68d44e88f10dc080eaee35288d5c7d23317ef2efd6fd3c9c43e7115d87d0e78fb377fd0e862b0109f2e74c977b2a2d20
-
SSDEEP
6144:ViMqc2Yr6H5NtSfFDfyOPDpSlSAMtJPJ7D/JmiL5BRG:QMKk6kRfyUDA0JPJHBmiLhG
-
Blackshades family
-
Blackshades payload
-
Modifies firewall policy service
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1