ramnit | 1fe248257d555e7f55c2875397c928207c018da428dcb6f1ae42a14c3d7bf17f

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
26/06/2024, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
Size 161KB
Sample240626-v358msvbqc
SHA256 1fe248257d555e7f55c2875397c928207c018da428dcb6f1ae42a14c3d7bf17f
MD5 12ce85d8cd7f9d68cf1db642ee90c140
SHA1 a0de3808b5982f4fee4ed347fa3432d86fb7138b
SHA512 c6b97aa164e1d86213f0471dcdf7ffc5baf86235149af204a7013cb60ef720f02cccb0be8269756c6e1206a50c743572f54ddf30b14083908960690e9cdcdaab
SSDEEP 3072:y6lXWN336MdMfLirVQW0/nyyplKgy330wN6qb3MAxwgKT:PXgqqULirVT01g0wRb37xg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Control Panel\International\Geo\Nation	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
2216	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118mgr.exe
2616	WaterMark.exe

Loads dropped DLL 4 IoCs

pid	Process
2208	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
2208	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
2216	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118mgr.exe
2216	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118mgr.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2216-19-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2216-18-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2216-16-0x0000000000400000-0x0000000000435000-memory.dmp	upx
behavioral1/memory/2216-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2216-11-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2216-10-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2216-9-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2216-29-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2616-42-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2616-692-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Pictures\desktop.ini	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened for modification	C:\Users\Public\desktop.ini	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened (read-only)	\??\E:	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened (read-only)	\??\G:	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened (read-only)	\??\M:	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened (read-only)	\??\N:	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened (read-only)	\??\P:	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened (read-only)	\??\Q:	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened (read-only)	\??\V:	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened (read-only)	\??\J:	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened (read-only)	\??\Y:	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened (read-only)	\??\U:	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened (read-only)	\??\B:	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened (read-only)	\??\H:	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened (read-only)	\??\I:	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened (read-only)	\??\L:	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened (read-only)	\??\O:	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened (read-only)	\??\R:	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened (read-only)	\??\T:	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened (read-only)	\??\X:	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened (read-only)	\??\A:	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened (read-only)	\??\K:	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened (read-only)	\??\S:	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
File opened (read-only)	\??\Z:	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Windows.Presentation.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libequalizer_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libskiptags_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\settings.html	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Conversion.v3.5.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libimage_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_10_p010_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jawt.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Utilities.v3.5.resources.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\hxdsui.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-private-l1-1-0.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libanaglyph_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\settings.html	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Design.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\mpvis.DLL	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\VISSHE.DLL	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libqsv_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\d3d11\libdirect3d11_filters_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\settings.html	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libfreeze_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\Microsoft.Ink.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\npdeployJava1.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\t2k.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libftp_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\settings.html	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsound.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\WMPMediaSharing.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradfun_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\F12Tools.dll	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\jsprofilerui.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\PhotoBase.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html	svchost.exe
File opened for modification	C:\Program Files\Windows Mail\msoe.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsimple_channel_mixer_plugin.dll	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}"	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2616	WaterMark.exe
2616	WaterMark.exe
2616	WaterMark.exe
2616	WaterMark.exe
2616	WaterMark.exe
2616	WaterMark.exe
2616	WaterMark.exe
2616	WaterMark.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe
2828	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2616	WaterMark.exe
Token: SeDebugPrivilege	2828	svchost.exe
Token: SeDebugPrivilege	2208	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
Token: SeDebugPrivilege	2616	WaterMark.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2216	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118mgr.exe
2616	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2216	2208	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe	28
PID 2208 wrote to memory of 2216	2208	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe	28
PID 2208 wrote to memory of 2216	2208	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe	28
PID 2208 wrote to memory of 2216	2208	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe	28
PID 2216 wrote to memory of 2616	2216	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118mgr.exe	29
PID 2216 wrote to memory of 2616	2216	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118mgr.exe	29
PID 2216 wrote to memory of 2616	2216	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118mgr.exe	29
PID 2216 wrote to memory of 2616	2216	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118mgr.exe	29
PID 2616 wrote to memory of 2780	2616	WaterMark.exe	30
PID 2616 wrote to memory of 2780	2616	WaterMark.exe	30
PID 2616 wrote to memory of 2780	2616	WaterMark.exe	30
PID 2616 wrote to memory of 2780	2616	WaterMark.exe	30
PID 2616 wrote to memory of 2780	2616	WaterMark.exe	30
PID 2616 wrote to memory of 2780	2616	WaterMark.exe	30
PID 2616 wrote to memory of 2780	2616	WaterMark.exe	30
PID 2616 wrote to memory of 2780	2616	WaterMark.exe	30
PID 2616 wrote to memory of 2780	2616	WaterMark.exe	30
PID 2616 wrote to memory of 2780	2616	WaterMark.exe	30
PID 2208 wrote to memory of 1584	2208	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe	31
PID 2208 wrote to memory of 1584	2208	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe	31
PID 2208 wrote to memory of 1584	2208	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe	31
PID 2208 wrote to memory of 1584	2208	12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe	31
PID 2616 wrote to memory of 2828	2616	WaterMark.exe	32
PID 2616 wrote to memory of 2828	2616	WaterMark.exe	32
PID 2616 wrote to memory of 2828	2616	WaterMark.exe	32
PID 2616 wrote to memory of 2828	2616	WaterMark.exe	32
PID 2616 wrote to memory of 2828	2616	WaterMark.exe	32
PID 2616 wrote to memory of 2828	2616	WaterMark.exe	32
PID 2616 wrote to memory of 2828	2616	WaterMark.exe	32
PID 2616 wrote to memory of 2828	2616	WaterMark.exe	32
PID 2616 wrote to memory of 2828	2616	WaterMark.exe	32
PID 2616 wrote to memory of 2828	2616	WaterMark.exe	32
PID 2828 wrote to memory of 256	2828	svchost.exe	1
PID 2828 wrote to memory of 256	2828	svchost.exe	1
PID 2828 wrote to memory of 256	2828	svchost.exe	1
PID 2828 wrote to memory of 256	2828	svchost.exe	1
PID 2828 wrote to memory of 256	2828	svchost.exe	1
PID 2828 wrote to memory of 332	2828	svchost.exe	2
PID 2828 wrote to memory of 332	2828	svchost.exe	2
PID 2828 wrote to memory of 332	2828	svchost.exe	2
PID 2828 wrote to memory of 332	2828	svchost.exe	2
PID 2828 wrote to memory of 332	2828	svchost.exe	2
PID 2828 wrote to memory of 368	2828	svchost.exe	3
PID 2828 wrote to memory of 368	2828	svchost.exe	3
PID 2828 wrote to memory of 368	2828	svchost.exe	3
PID 2828 wrote to memory of 368	2828	svchost.exe	3
PID 2828 wrote to memory of 368	2828	svchost.exe	3
PID 2828 wrote to memory of 380	2828	svchost.exe	4
PID 2828 wrote to memory of 380	2828	svchost.exe	4
PID 2828 wrote to memory of 380	2828	svchost.exe	4
PID 2828 wrote to memory of 380	2828	svchost.exe	4
PID 2828 wrote to memory of 380	2828	svchost.exe	4
PID 2828 wrote to memory of 416	2828	svchost.exe	5
PID 2828 wrote to memory of 416	2828	svchost.exe	5
PID 2828 wrote to memory of 416	2828	svchost.exe	5
PID 2828 wrote to memory of 416	2828	svchost.exe	5
PID 2828 wrote to memory of 416	2828	svchost.exe	5
PID 2828 wrote to memory of 464	2828	svchost.exe	6
PID 2828 wrote to memory of 464	2828	svchost.exe	6
PID 2828 wrote to memory of 464	2828	svchost.exe	6
PID 2828 wrote to memory of 464	2828	svchost.exe	6
PID 2828 wrote to memory of 464	2828	svchost.exe	6
PID 2828 wrote to memory of 472	2828	svchost.exe	7
PID 2828 wrote to memory of 472	2828	svchost.exe	7

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:464
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:576
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1176
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
      4⤵
      PID:2260
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe -Embedding
      4⤵
      PID:1336
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:656
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:740
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:800
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1168
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:832
  - - C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      4⤵
      PID:1596
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:980
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:272
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:276
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1028
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1104
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:1536
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2244
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:472
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:480

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1240
- C:\Users\Admin\AppData\Local\Temp\12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Users\Admin\AppData\Local\Temp\12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118mgr.exe
    C:\Users\Admin\AppData\Local\Temp\12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:2616
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        Drops file in Program Files directory
        
        PID:2780
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2828
- - C:\Program Files (x86)\Windows Media Player\wmpshare.exe
    "C:\Program Files (x86)\Windows Media Player\wmpshare.exe"
    3⤵
    PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

epl-v10.html

Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Size 206KB
SHA256 a4eb9407e58ac153d2b924c4ef173a8fad94e1ca0cce146bed0ba1c079b0b031
MD5 ebc9aaee0758f70b83cc6df9ec1b2cc3
SHA1 e306ff45024383db9d8095cb6b2d08fc2b1f89d6
SHA512 c77810c29bcce126896d7a9c1b2fbee2bf2b08fd681fb9c31c04871921cd604d350336833cda29306c4a090eeacc15b5e4003ff8579a2c55ae8c968e8b2be1ef
SSDEEP 1536:+0GEXp1NSM1zSZsUj61WAO+ibqjEo7WMk45zHFjMe++uIUFYDnMZTEnYhJccAfz1:+QNWu1WAzxSqztM1wB41bE7Dx
MD5 SHA1 SHA512 SSDEEP

Submit Download

license.html

Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Size 202KB
SHA256 23585a6ccc9c19153a685a6299528db30ed4a33608c158c18e91ec9f775b2283
MD5 0e3e0fc05b4003117f1a871e328658ae
SHA1 17281cfcb4cdba7a95d39c42c6971de9b30e28b3
SHA512 710bfef32154eedc6f604ad801ca44fd8ea7b9397dcd5bcff4924c65ad35bf89d0d9052b3c44c9b86f4e0cae02cd8339205e181dffdd5c4dd6591baf37f89d84
SSDEEP 1536:BK1Sy6KBEXp1NSM1zSZsUj61WAO+ibqjEo7WMk45zHFjMe++uIUFYDnMZTEnYhJo:sCNWu1WAzxSqztM1wB41bE7D5
MD5 SHA1 SHA512 SSDEEP

Submit Download

{DD5507C8-E8FF-4857-A8F0-666222991E0A}.jpg

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\Art Cache\LocalMLS\{DD5507C8-E8FF-4857-A8F0-666222991E0A}.jpg
Size 23KB
SHA256 a26544648ef8ceffad6c789a3677031be3c515918627d7c8f8e0587d3033c431
MD5 fd5fd28e41676618aac733b243ad54db
SHA1 b2d69ad6a2e22c30ef1806ac4f990790c3b44763
SHA512 4c32623796679be7066b719f231d08d24341784ecfd5d6461e8140379f5b394216e446865df56e05b5f1e36962c9d34d2b5041275366aeabcd606f4536217fe4
SSDEEP 384:fILIFuUH3LXABb6hjZHI0MMiSIK5aX2ilpTGJl/S8NKDUYd6I:fIsHbwx6hK0nYK5aJ0mkQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

{DE4D1881-8833-419C-A98E-9AA31B1B6B57}.jpg

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\Art Cache\LocalMLS\{DE4D1881-8833-419C-A98E-9AA31B1B6B57}.jpg
Size 22KB
SHA256 98c49a68ee578e10947209ebc17c0ad188ed39c7d0c91a2b505f317259c0c9b2
MD5 35e787587cd3fa8ed360036c9fca3df2
SHA1 84c76a25c6fe336f6559c033917a4c327279886d
SHA512 aeec3eed5a52670f4cc35935005bb04bb435964a1975e489b8e101adfbce278142fd1a6c475860b7ccb414afe5e24613361a66d92f457937de9b21a7a112e1f9
SSDEEP 384:fTbktU399Ws56dh2hcI6USMpzRyy7QmHG8+IGoIlRknj5jr1FVB5QzFmVVe:fTwWms5a2meScPQmNnnVHvv5QRmV4
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg

Path C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg
Size 32KB
SHA256 6ecf98adb3cd0931ec803f3a56a9563c7d60bb86ec1886b21e3d0f7eb25198d9
MD5 84bba83cfbc0233517407678bb842686
SHA1 1c617de788de380d28c52dc733ad580c3745a1c1
SHA512 a6a80c00a28c43c1c427018e6fb6dac4682d299d2f50202f520af0b1bca803546c850f04094ed2f532ff8775f6d45f2a40e4f5e069937bcaa0326a80bd818e0e
SSDEEP 768:fh+n3LiArKg3Safmy1ugyLr9Anj70i7j7bqvaYABtgglM:fcnYgCaVQgyLr9IwoHOSjlM
MD5 SHA1 SHA512 SSDEEP

Submit Download

12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118mgr.exe

Path \Users\Admin\AppData\Local\Temp\12ce85d8cd7f9d68cf1db642ee90c140_JaffaCakes118mgr.exe
Size 96KB
SHA256 528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
MD5 8c51fd9d6daa7b6137634de19a49452c
SHA1 db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA512 b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837
SSDEEP 768:L06R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9f:ZR0vxn3Pc0LCH9MtbvabUDzJYWu3Bg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2208-1153-0x0000000000080000-0x0000000000081000-memory.dmp

Download

memory/2208-62-0x0000000000080000-0x0000000000081000-memory.dmp

Download

memory/2208-15-0x0000000000080000-0x00000000000B5000-memory.dmp

Download

memory/2208-14-0x0000000000080000-0x00000000000B5000-memory.dmp

Download

memory/2208-0-0x00000000000C0000-0x00000000000EC000-memory.dmp

Download

memory/2216-11-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2216-9-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2216-10-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2216-30-0x0000000000401000-0x0000000000416000-memory.dmp

Download

memory/2216-29-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2216-12-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2216-16-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2216-17-0x0000000000140000-0x0000000000141000-memory.dmp

Download

memory/2216-18-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2216-19-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2216-689-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2616-41-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/2616-692-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2616-42-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2616-43-0x0000000077DBF000-0x0000000077DC0000-memory.dmp

Download

memory/2616-32-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2616-77-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/2780-64-0x0000000020010000-0x0000000020022000-memory.dmp

Download

memory/2780-56-0x00000000000A0000-0x00000000000A1000-memory.dmp

Download

memory/2780-49-0x0000000000080000-0x0000000000081000-memory.dmp

Download

memory/2780-47-0x0000000020010000-0x0000000020022000-memory.dmp

Download

memory/2780-1384-0x0000000020010000-0x0000000020022000-memory.dmp

Download

memory/2780-57-0x0000000000080000-0x0000000000081000-memory.dmp

Download

memory/2780-63-0x0000000000090000-0x0000000000091000-memory.dmp

Download

memory/2780-58-0x0000000020010000-0x0000000020022000-memory.dmp

Download

memory/2780-66-0x0000000020010000-0x0000000020022000-memory.dmp

Download

memory/2780-71-0x0000000020010000-0x0000000020022000-memory.dmp

Download

memory/2828-96-0x00000000000F0000-0x00000000000F1000-memory.dmp

Download

memory/2828-97-0x0000000020010000-0x000000002001B000-memory.dmp

Download

memory/2828-93-0x00000000000E0000-0x00000000000E1000-memory.dmp

Download

memory/2828-79-0x0000000020010000-0x000000002001B000-memory.dmp

Download

memory/2828-95-0x0000000020010000-0x000000002001B000-memory.dmp

Download

memory/2828-94-0x0000000020010000-0x000000002001B000-memory.dmp

Download

memory/2828-92-0x0000000020010000-0x000000002001B000-memory.dmp

Download

memory/2828-89-0x0000000020010000-0x000000002001B000-memory.dmp

Download