Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
25-06-2024 22:08
Static task
static1
Behavioral task
behavioral1
Sample
0fb4592b984f1368f11e6016321bc133_JaffaCakes118.dll
Resource
win7-20240611-en
General
-
Target
0fb4592b984f1368f11e6016321bc133_JaffaCakes118.dll
-
Size
209KB
-
MD5
0fb4592b984f1368f11e6016321bc133
-
SHA1
c25d9873fef6283c2d6b21b641a7a0ddc51d4280
-
SHA256
db645e6a5ddee95966ee10e01c0876fc300d2cafdc305b0cb69b43b8ffa731ae
-
SHA512
8ad9275d3cd0726c65c4885990f67c7dde8a5d6eaffd60ab23bea8c1db05ff21d3f8a3bfca7b170533287d6a2bbab83ae1d96d1d7e8493ff7a86ed8a491b2623
-
SSDEEP
3072:sTU56gVxj27Ne2RMqIgNytCMxA6LeERHP0E1WVKjbsTb:/4fWlBtCAA6LoFAPe
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 2 IoCs
pid Process 2096 regsvr32mgr.exe 2748 WaterMark.exe -
Loads dropped DLL 4 IoCs
pid Process 2216 regsvr32.exe 2216 regsvr32.exe 2096 regsvr32mgr.exe 2096 regsvr32mgr.exe -
resource yara_rule behavioral1/memory/2096-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2096-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2096-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2096-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2096-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2096-19-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2096-22-0x00000000001A0000-0x00000000001CE000-memory.dmp upx behavioral1/memory/2096-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2748-38-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2748-565-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\librawvid_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradient_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\settings.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack.dll svchost.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\liboldrc_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libflaschen_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\currency.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\imjplm.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libzvbi_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libvhs_plugin.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\sqmapi.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\settings.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mshwgst.dll svchost.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\Shvl.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsFormsIntegration.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Linq.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\liboggspots_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\IACOM2.DLL svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdarem.dll svchost.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe svchost.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe svchost.exe File opened for modification C:\Program Files\Windows Media Player\WMPDMCCore.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\flyout.html svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\libEGL.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_plugin.dll svchost.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\Chkr.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatialaudio_plugin.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\F12Resources.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\hprof.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.DataSetExtensions.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\calendar.html svchost.exe File opened for modification C:\Program Files\Common Files\System\ado\msadox.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Selectors.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libstereo_widen_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libdummy_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libnoseek_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\Microsoft.Ink.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libmpc_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jfxwebkit.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Design.resources.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\ssv.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHEV.DLL svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\softokn3.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\libsubsdelay_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadcs.dll svchost.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 2748 WaterMark.exe 2748 WaterMark.exe 2748 WaterMark.exe 2748 WaterMark.exe 2748 WaterMark.exe 2748 WaterMark.exe 2748 WaterMark.exe 2748 WaterMark.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe 1036 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2748 WaterMark.exe Token: SeDebugPrivilege 1036 svchost.exe Token: SeDebugPrivilege 2748 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2096 regsvr32mgr.exe 2748 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2216 2180 regsvr32.exe 28 PID 2180 wrote to memory of 2216 2180 regsvr32.exe 28 PID 2180 wrote to memory of 2216 2180 regsvr32.exe 28 PID 2180 wrote to memory of 2216 2180 regsvr32.exe 28 PID 2180 wrote to memory of 2216 2180 regsvr32.exe 28 PID 2180 wrote to memory of 2216 2180 regsvr32.exe 28 PID 2180 wrote to memory of 2216 2180 regsvr32.exe 28 PID 2216 wrote to memory of 2096 2216 regsvr32.exe 29 PID 2216 wrote to memory of 2096 2216 regsvr32.exe 29 PID 2216 wrote to memory of 2096 2216 regsvr32.exe 29 PID 2216 wrote to memory of 2096 2216 regsvr32.exe 29 PID 2096 wrote to memory of 2748 2096 regsvr32mgr.exe 30 PID 2096 wrote to memory of 2748 2096 regsvr32mgr.exe 30 PID 2096 wrote to memory of 2748 2096 regsvr32mgr.exe 30 PID 2096 wrote to memory of 2748 2096 regsvr32mgr.exe 30 PID 2748 wrote to memory of 2572 2748 WaterMark.exe 31 PID 2748 wrote to memory of 2572 2748 WaterMark.exe 31 PID 2748 wrote to memory of 2572 2748 WaterMark.exe 31 PID 2748 wrote to memory of 2572 2748 WaterMark.exe 31 PID 2748 wrote to memory of 2572 2748 WaterMark.exe 31 PID 2748 wrote to memory of 2572 2748 WaterMark.exe 31 PID 2748 wrote to memory of 2572 2748 WaterMark.exe 31 PID 2748 wrote to memory of 2572 2748 WaterMark.exe 31 PID 2748 wrote to memory of 2572 2748 WaterMark.exe 31 PID 2748 wrote to memory of 2572 2748 WaterMark.exe 31 PID 2748 wrote to memory of 1036 2748 WaterMark.exe 32 PID 2748 wrote to memory of 1036 2748 WaterMark.exe 32 PID 2748 wrote to memory of 1036 2748 WaterMark.exe 32 PID 2748 wrote to memory of 1036 2748 WaterMark.exe 32 PID 2748 wrote to memory of 1036 2748 WaterMark.exe 32 PID 2748 wrote to memory of 1036 2748 WaterMark.exe 32 PID 2748 wrote to memory of 1036 2748 WaterMark.exe 32 PID 2748 wrote to memory of 1036 2748 WaterMark.exe 32 PID 2748 wrote to memory of 1036 2748 WaterMark.exe 32 PID 2748 wrote to memory of 1036 2748 WaterMark.exe 32 PID 1036 wrote to memory of 256 1036 svchost.exe 1 PID 1036 wrote to memory of 256 1036 svchost.exe 1 PID 1036 wrote to memory of 256 1036 svchost.exe 1 PID 1036 wrote to memory of 256 1036 svchost.exe 1 PID 1036 wrote to memory of 256 1036 svchost.exe 1 PID 1036 wrote to memory of 336 1036 svchost.exe 2 PID 1036 wrote to memory of 336 1036 svchost.exe 2 PID 1036 wrote to memory of 336 1036 svchost.exe 2 PID 1036 wrote to memory of 336 1036 svchost.exe 2 PID 1036 wrote to memory of 336 1036 svchost.exe 2 PID 1036 wrote to memory of 384 1036 svchost.exe 3 PID 1036 wrote to memory of 384 1036 svchost.exe 3 PID 1036 wrote to memory of 384 1036 svchost.exe 3 PID 1036 wrote to memory of 384 1036 svchost.exe 3 PID 1036 wrote to memory of 384 1036 svchost.exe 3 PID 1036 wrote to memory of 396 1036 svchost.exe 4 PID 1036 wrote to memory of 396 1036 svchost.exe 4 PID 1036 wrote to memory of 396 1036 svchost.exe 4 PID 1036 wrote to memory of 396 1036 svchost.exe 4 PID 1036 wrote to memory of 396 1036 svchost.exe 4 PID 1036 wrote to memory of 432 1036 svchost.exe 5 PID 1036 wrote to memory of 432 1036 svchost.exe 5 PID 1036 wrote to memory of 432 1036 svchost.exe 5 PID 1036 wrote to memory of 432 1036 svchost.exe 5 PID 1036 wrote to memory of 432 1036 svchost.exe 5 PID 1036 wrote to memory of 476 1036 svchost.exe 6 PID 1036 wrote to memory of 476 1036 svchost.exe 6 PID 1036 wrote to memory of 476 1036 svchost.exe 6 PID 1036 wrote to memory of 476 1036 svchost.exe 6
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:256
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:336
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:596
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1640
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵PID:1064
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:676
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:748
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:812
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1360
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:848
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵PID:1180
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:988
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:296
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:880
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:276
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1304
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:1892
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:1916
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:396
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1388
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0fb4592b984f1368f11e6016321bc133_JaffaCakes118.dll2⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0fb4592b984f1368f11e6016321bc133_JaffaCakes118.dll3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
PID:2572
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize292KB
MD5c4d4f24d42ef2ddfa1933ebc4fd9938e
SHA1f9c5736eb404940ed5edaa82a9c840ac936c7e52
SHA256a6af247bc7c87e44430133c400a543e3662951949ab4ce35c886927b475fa0c2
SHA512a63dcdc54106c9345fb3b65d9be936c9beba71cb8f4921396df3c9db82633b55d193654b8291d7707385cf01a85538cd2ba0a012fd038264676bbfd190f6de5e
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize288KB
MD508a0beeddb555e4f905749a3e30828d9
SHA1231d196b15e5246d23496aa19d3e85ded22aadbc
SHA2562149a312169b69a1fceb50f495b13ca6b160e2cf037380593fd758583c52afc7
SHA512466123e4b40b9a1dfb9370fa4687946985aecb55f6aa86527cb80557391912b1ab2d06c4892bcf9a256156d088ff8672e37c48b712e7bbdbe88fea0821bf223a
-
Filesize
139KB
MD503f2a314cd1c598c38a1de2663e1aebb
SHA1aff058f29943df223cc418ed6544ab0f176e5762
SHA25664ff2387190101102b4f140065c12780ea9ad822a1c05444a552164cc30a3392
SHA512950368f5a8eacdee919ca7d2c93c1939f9fc120602fd7347e16ae6a67e382cec7b2525adc652ac2ce39e08a614437248d1ff83d44171075ce8333016bf45ae45