ramnit | 8e391de9a25deb468cc578d68edd6c4cf73398d14443985dd4fabbe585f322cc

Analysis

max time kernel
93s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2024, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
352a65e90d429a1578cf35181cc385ff_JaffaCakes118.exe
Size 353KB
Sample241011-raq2ga1bqr
SHA256 8e391de9a25deb468cc578d68edd6c4cf73398d14443985dd4fabbe585f322cc
MD5 352a65e90d429a1578cf35181cc385ff
SHA1 5a12b7310b1a736dfa41a123392b9060cda7e53b
SHA512 9fe1b058c5af15337724d0e06234b83b3b037219855927494924f3f17b4f6147476ea5e26bb286f0d6f0f4da858dfac612e2bffd43cf863344f58f462e4ed0b1
SSDEEP 3072:6R2xn3k0CdM1vabyzJYWqSQSP6EBciGenKkiZytjeGwMp+XSdPEnF/SFcE:6R2J0LS6Vd05ciGenKEleGHMSRY/KcE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 13 IoCs

pid	Process
4036	352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgr.exe
3724	352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgrmgr.exe
2380	WaterMark.exe
3924	WaterMark.exe
1100	WaterMarkmgr.exe
1668	WaterMarkmgrmgr.exe
3116	WaterMark.exe
3756	WaterMark.exe
116	WaterMark.exe
848	WaterMarkmgr.exe
4052	WaterMarkmgrmgr.exe
3172	WaterMark.exe
3412	WaterMark.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3396-15-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3396-21-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1668-100-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3924-159-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3412-158-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/3172-157-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/4052-142-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/3924-141-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/2380-140-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/848-131-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/3756-108-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/1100-96-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3116-95-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/1668-93-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/3924-75-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2380-73-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/1100-72-0x0000000000400000-0x0000000000459000-memory.dmp	upx
behavioral2/memory/2380-51-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/3724-50-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4036-49-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3724-48-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral2/memory/3396-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3396-9-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3396-8-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3396-7-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3396-14-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/2380-181-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	WaterMarkmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	WaterMarkmgrmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px8CAF.tmp	WaterMarkmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	352a65e90d429a1578cf35181cc385ff_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	352a65e90d429a1578cf35181cc385ff_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMarkmgrmgr.exe	WaterMarkmgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px8D4C.tmp	WaterMarkmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px8C61.tmp	352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgrmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgrmgr.exe	WaterMarkmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	WaterMarkmgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px8D5B.tmp	WaterMarkmgrmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px8C13.tmp	352a65e90d429a1578cf35181cc385ff_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px8C42.tmp	352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgrmgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px8CBF.tmp	WaterMarkmgrmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	WaterMarkmgrmgr.exe

Program crash 4 IoCs

pid	pid_target	Process
4784	2308	WerFault.exe
3744	1572	WerFault.exe
4672	4656	WerFault.exe
2204	4064	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMarkmgrmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	352a65e90d429a1578cf35181cc385ff_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMarkmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMarkmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMarkmgrmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgrmgr.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31136741"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31136741"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{11BF4AF1-87D9-11EF-B9D5-FE5A08828E79} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3866738207"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3860175949"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3860175949"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31136741"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3860957076"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31136741"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3866738207"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3866738207"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{11BF23E1-87D9-11EF-B9D5-FE5A08828E79} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435420160"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31136741"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3866738207"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3924	WaterMark.exe
3924	WaterMark.exe
3924	WaterMark.exe
3924	WaterMark.exe
2380	WaterMark.exe
2380	WaterMark.exe
2380	WaterMark.exe
2380	WaterMark.exe
3116	WaterMark.exe
3116	WaterMark.exe
3756	WaterMark.exe
3756	WaterMark.exe
3116	WaterMark.exe
3756	WaterMark.exe
3756	WaterMark.exe
116	WaterMark.exe
116	WaterMark.exe
116	WaterMark.exe
116	WaterMark.exe
3116	WaterMark.exe
3172	WaterMark.exe
3172	WaterMark.exe
3172	WaterMark.exe
3172	WaterMark.exe
3412	WaterMark.exe
3412	WaterMark.exe
3412	WaterMark.exe
3412	WaterMark.exe
2380	WaterMark.exe
3924	WaterMark.exe
3924	WaterMark.exe
2380	WaterMark.exe
2380	WaterMark.exe
2380	WaterMark.exe
3924	WaterMark.exe
3924	WaterMark.exe
3924	WaterMark.exe
2380	WaterMark.exe
3924	WaterMark.exe
2380	WaterMark.exe
3924	WaterMark.exe
3924	WaterMark.exe
2380	WaterMark.exe
2380	WaterMark.exe
3924	WaterMark.exe
3924	WaterMark.exe
2380	WaterMark.exe
2380	WaterMark.exe
3924	WaterMark.exe
3924	WaterMark.exe
2380	WaterMark.exe
2380	WaterMark.exe
3756	WaterMark.exe
3756	WaterMark.exe
3756	WaterMark.exe
3756	WaterMark.exe
3756	WaterMark.exe
3756	WaterMark.exe
3756	WaterMark.exe
3756	WaterMark.exe
3756	WaterMark.exe
3756	WaterMark.exe
3756	WaterMark.exe
3756	WaterMark.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3924	WaterMark.exe
Token: SeDebugPrivilege	2380	WaterMark.exe
Token: SeDebugPrivilege	3116	WaterMark.exe
Token: SeDebugPrivilege	3756	WaterMark.exe
Token: SeDebugPrivilege	116	WaterMark.exe
Token: SeDebugPrivilege	3172	WaterMark.exe
Token: SeDebugPrivilege	3412	WaterMark.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4036	iexplore.exe
4336	iexplore.exe
1924	iexplore.exe
1424	iexplore.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
1924	iexplore.exe
1924	iexplore.exe
1424	iexplore.exe
1424	iexplore.exe
4336	iexplore.exe
4336	iexplore.exe
4036	iexplore.exe
4036	iexplore.exe
3728	IEXPLORE.EXE
3728	IEXPLORE.EXE
1476	IEXPLORE.EXE
1476	IEXPLORE.EXE
3960	IEXPLORE.EXE
3960	IEXPLORE.EXE
3284	IEXPLORE.EXE
3284	IEXPLORE.EXE
1476	IEXPLORE.EXE
1476	IEXPLORE.EXE

Suspicious use of UnmapMainImage 14 IoCs

pid	Process
3396	352a65e90d429a1578cf35181cc385ff_JaffaCakes118.exe
4036	352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgr.exe
3724	352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgrmgr.exe
2380	WaterMark.exe
3924	WaterMark.exe
1100	WaterMarkmgr.exe
1668	WaterMarkmgrmgr.exe
3116	WaterMark.exe
3756	WaterMark.exe
116	WaterMark.exe
848	WaterMarkmgr.exe
4052	WaterMarkmgrmgr.exe
3172	WaterMark.exe
3412	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 4036	3396	352a65e90d429a1578cf35181cc385ff_JaffaCakes118.exe	84
PID 3396 wrote to memory of 4036	3396	352a65e90d429a1578cf35181cc385ff_JaffaCakes118.exe	84
PID 3396 wrote to memory of 4036	3396	352a65e90d429a1578cf35181cc385ff_JaffaCakes118.exe	84
PID 4036 wrote to memory of 3724	4036	352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgr.exe	85
PID 4036 wrote to memory of 3724	4036	352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgr.exe	85
PID 4036 wrote to memory of 3724	4036	352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgr.exe	85
PID 3396 wrote to memory of 2380	3396	352a65e90d429a1578cf35181cc385ff_JaffaCakes118.exe	86
PID 3396 wrote to memory of 2380	3396	352a65e90d429a1578cf35181cc385ff_JaffaCakes118.exe	86
PID 3396 wrote to memory of 2380	3396	352a65e90d429a1578cf35181cc385ff_JaffaCakes118.exe	86
PID 4036 wrote to memory of 3924	4036	352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgr.exe	87
PID 4036 wrote to memory of 3924	4036	352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgr.exe	87
PID 4036 wrote to memory of 3924	4036	352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgr.exe	87
PID 2380 wrote to memory of 1100	2380	WaterMark.exe	88
PID 2380 wrote to memory of 1100	2380	WaterMark.exe	88
PID 2380 wrote to memory of 1100	2380	WaterMark.exe	88
PID 3724 wrote to memory of 3116	3724	352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgrmgr.exe	89
PID 3724 wrote to memory of 3116	3724	352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgrmgr.exe	89
PID 3724 wrote to memory of 3116	3724	352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgrmgr.exe	89
PID 1100 wrote to memory of 1668	1100	WaterMarkmgr.exe	90
PID 1100 wrote to memory of 1668	1100	WaterMarkmgr.exe	90
PID 1100 wrote to memory of 1668	1100	WaterMarkmgr.exe	90
PID 1100 wrote to memory of 116	1100	WaterMarkmgr.exe	91
PID 1100 wrote to memory of 116	1100	WaterMarkmgr.exe	91
PID 1100 wrote to memory of 116	1100	WaterMarkmgr.exe	91
PID 3924 wrote to memory of 4620	3924	WaterMark.exe	92
PID 3924 wrote to memory of 4620	3924	WaterMark.exe	92
PID 3924 wrote to memory of 4620	3924	WaterMark.exe	92
PID 3924 wrote to memory of 4620	3924	WaterMark.exe	92
PID 3924 wrote to memory of 4620	3924	WaterMark.exe	92
PID 3924 wrote to memory of 4620	3924	WaterMark.exe	92
PID 3924 wrote to memory of 4620	3924	WaterMark.exe	92
PID 3924 wrote to memory of 4620	3924	WaterMark.exe	92
PID 3924 wrote to memory of 4620	3924	WaterMark.exe	92
PID 2380 wrote to memory of 4656	2380	WaterMark.exe	93
PID 2380 wrote to memory of 4656	2380	WaterMark.exe	93
PID 2380 wrote to memory of 4656	2380	WaterMark.exe	93
PID 2380 wrote to memory of 4656	2380	WaterMark.exe	93
PID 2380 wrote to memory of 4656	2380	WaterMark.exe	93
PID 2380 wrote to memory of 4656	2380	WaterMark.exe	93
PID 2380 wrote to memory of 4656	2380	WaterMark.exe	93
PID 2380 wrote to memory of 4656	2380	WaterMark.exe	93
PID 2380 wrote to memory of 4656	2380	WaterMark.exe	93
PID 1668 wrote to memory of 3756	1668	WaterMarkmgrmgr.exe	94
PID 1668 wrote to memory of 3756	1668	WaterMarkmgrmgr.exe	94
PID 1668 wrote to memory of 3756	1668	WaterMarkmgrmgr.exe	94
PID 116 wrote to memory of 848	116	WaterMark.exe	95
PID 116 wrote to memory of 848	116	WaterMark.exe	95
PID 116 wrote to memory of 848	116	WaterMark.exe	95
PID 3756 wrote to memory of 4064	3756	WaterMark.exe	96
PID 3756 wrote to memory of 4064	3756	WaterMark.exe	96
PID 3756 wrote to memory of 4064	3756	WaterMark.exe	96
PID 3756 wrote to memory of 4064	3756	WaterMark.exe	96
PID 3756 wrote to memory of 4064	3756	WaterMark.exe	96
PID 3756 wrote to memory of 4064	3756	WaterMark.exe	96
PID 3756 wrote to memory of 4064	3756	WaterMark.exe	96
PID 3756 wrote to memory of 4064	3756	WaterMark.exe	96
PID 3756 wrote to memory of 4064	3756	WaterMark.exe	96
PID 848 wrote to memory of 4052	848	WaterMarkmgr.exe	97
PID 848 wrote to memory of 4052	848	WaterMarkmgr.exe	97
PID 848 wrote to memory of 4052	848	WaterMarkmgr.exe	97
PID 116 wrote to memory of 3188	116	WaterMark.exe	98
PID 116 wrote to memory of 3188	116	WaterMark.exe	98
PID 116 wrote to memory of 3188	116	WaterMark.exe	98
PID 116 wrote to memory of 3188	116	WaterMark.exe	98

C:\Users\Admin\AppData\Local\Temp\352a65e90d429a1578cf35181cc385ff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\352a65e90d429a1578cf35181cc385ff_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Users\Admin\AppData\Local\Temp\352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgr.exe
  C:\Users\Admin\AppData\Local\Temp\352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgr.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Users\Admin\AppData\Local\Temp\352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgrmgr.exe
    C:\Users\Admin\AppData\Local\Temp\352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgrmgr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:3724
  - - C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of UnmapMainImage
      PID:3116
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        
        PID:2308
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 204
        6⤵
        Program crash
        
        PID:4784
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        
        PID:5100
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        
        PID:4552
- - C:\Program Files (x86)\Microsoft\WaterMark.exe
    "C:\Program Files (x86)\Microsoft\WaterMark.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:3924
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      PID:4620
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:4336
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4336 CREDAT:17410 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1476
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1924
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:17410 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3960
- C:\Program Files (x86)\Microsoft\WaterMark.exe
  "C:\Program Files (x86)\Microsoft\WaterMark.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe
    "C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Program Files (x86)\Microsoft\WaterMarkmgrmgr.exe
      "C:\Program Files (x86)\Microsoft\WaterMarkmgrmgr.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:1668
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:3756
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 204
        7⤵
        Program crash
        
        PID:2204
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        
        PID:60
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        
        PID:1636
  - - C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:116
    - - C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:848
      - C:\Program Files (x86)\Microsoft\WaterMarkmgrmgr.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMarkmgrmgr.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious use of UnmapMainImage
        
        PID:4052
        
        C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        
        PID:3412
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        8⤵
        
        PID:2460
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        Modifies Internet Explorer settings
        
        PID:1404
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        8⤵
        
        PID:3548
      - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        
        PID:3172
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        7⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 204
        8⤵
        Program crash
        
        PID:3744
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        Modifies Internet Explorer settings
        
        PID:184
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        Modifies Internet Explorer settings
        
        PID:4416
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        
        PID:3188
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        
        PID:744
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1808
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4656
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 204
      4⤵
      Program crash
      PID:4672
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:4036
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4036 CREDAT:17410 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3728
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:1424
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1424 CREDAT:17410 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1572 -ip 1572
1⤵
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2460 -ip 2460
1⤵
PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2308 -ip 2308
1⤵
PID:2652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3188 -ip 3188
1⤵
PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4064 -ip 4064
1⤵
PID:552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4620 -ip 4620
1⤵
PID:2360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4656 -ip 4656
1⤵
PID:5112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WaterMark.exe

Path C:\Program Files (x86)\Microsoft\WaterMark.exe
Size 353KB
SHA256 8e391de9a25deb468cc578d68edd6c4cf73398d14443985dd4fabbe585f322cc
MD5 352a65e90d429a1578cf35181cc385ff
SHA1 5a12b7310b1a736dfa41a123392b9060cda7e53b
SHA512 9fe1b058c5af15337724d0e06234b83b3b037219855927494924f3f17b4f6147476ea5e26bb286f0d6f0f4da858dfac612e2bffd43cf863344f58f462e4ed0b1
SSDEEP 3072:6R2xn3k0CdM1vabyzJYWqSQSP6EBciGenKkiZytjeGwMp+XSdPEnF/SFcE:6R2J0LS6Vd05ciGenKEleGHMSRY/KcE
MD5 SHA1 SHA512 SSDEEP

Submit Download

WaterMarkmgrmgr.exe

Path C:\Program Files (x86)\Microsoft\WaterMarkmgrmgr.exe
Size 116KB
SHA256 b9d75d71f61d31de963a29114d370d6495a18c81e78c78ce89c77ef134f8e6e8
MD5 fd6899e36fcc5f26903dea1c0519a8fd
SHA1 af249681be87eed2b680baa7d9b514c051d6d4a7
SHA512 78980b599fe5cd62fdaf6165a38e16c629cf0e7864f45bbdbc8c95b1ed1967f1cfdfdecaa879a5b5656f57ced55919082c4bd5fcd7a4a7f4fa6ac64fca58a16d
SSDEEP 768:i06R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9Y:oR0vxn3Pc0LCH9MtbvabUDzJYWu3B
MD5 SHA1 SHA512 SSDEEP

Submit Download

RecoveryStore.{11BF23E1-87D9-11EF-B9D5-FE5A08828E79}.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{11BF23E1-87D9-11EF-B9D5-FE5A08828E79}.dat
Size 5KB
SHA256 6fd3bb218b5bd6e4c4afc97e17e2e10cab68c2e6482b8d5a7a76916b43acac28
MD5 c9f40ffdfec87b9a63fe3cc6995eff06
SHA1 3f640884753024a5198a60d25e8bc9a3cc6ed30f
SHA512 975e6cf320a2b9f32b363858a0687cd243dd21e5dd4ee9549f55f3a797daab8f031dd5518ffba94905c38bf39762fa36d2012e13a6b58d3e05c45ba8457cf29f
SSDEEP 24:r2Go/QCkZiGo/GkZEZ879lWBnGVE9lWBnGVc:r2Go40GoZC8b8
MD5 SHA1 SHA512 SSDEEP

Submit Download

RecoveryStore.{11BF7201-87D9-11EF-B9D5-FE5A08828E79}.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{11BF7201-87D9-11EF-B9D5-FE5A08828E79}.dat
Size 5KB
SHA256 a452a6336b4181f508090c58a81bcf91d2a0d7e6b1723bd22f5c91091f744e27
MD5 29558fc6eb8806804eefdd9b85c62354
SHA1 f42675f0eeee22b5a122fc6d471f342291a03c6d
SHA512 74073c6b634ca82781236fb08cdcd2c8f65f41ab4a484daea06a458db7aa7e6378a50083eae5661e372c8118ce47734c6ad44e4f72a9d194ecd7a861c568ce8d
SSDEEP 24:rh6Go/Qo+ZgdGo/8+Zz+Z879lW+0vkE9lW+0vkv:r8Go4QGoxCtit
MD5 SHA1 SHA512 SSDEEP

Submit Download

RecoveryStore.{11BF9911-87D9-11EF-B9D5-FE5A08828E79}.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{11BF9911-87D9-11EF-B9D5-FE5A08828E79}.dat
Size 5KB
SHA256 c0aeb748e45ca5818f87fa2882465e671c18f8095a4d4acfa969df958def021c
MD5 b1009614c50a038b22814df4323ca2ad
SHA1 661ceabe3517adba4df95429263490f425292abc
SHA512 dccc76ab87018304eb1cff0006c7dc7b63efe0672ef16ff5c02b3ec62819ce95383dd98dca6beb7f48fbc646559c63166514030cb00a410b9f5895cb6e329271
SSDEEP 24:r2Go/QqgZiGo/egZRgZ879lWzFwZcE9lWzFwZchc:r2Go4qbGoG43Cy8y
MD5 SHA1 SHA512 SSDEEP

Submit Download

verEB1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verEB1.tmp
Size 15KB
SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
MD5 1a545d0052b581fbb2ab4c52133846bc
SHA1 62f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA512 bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
SSDEEP 384:79Jv9DF9/C9qc9/J9V791T9TK9Xf9Nm9xQ95a9BR9fV:79Jv9DF9/C9qc9/J9V791T9TK9Xf9NmT
MD5 SHA1 SHA512 SSDEEP

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FQRZN8O7\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgr.exe

Path C:\Users\Admin\AppData\Local\Temp\352a65e90d429a1578cf35181cc385ff_JaffaCakes118mgr.exe
Size 234KB
SHA256 e898c9afe93f94d2b0183582a583386aa33a3765fd40caf82ea37c01832e12e6
MD5 c3a6eaa4a1cbbe625a1f4ed4f486ce15
SHA1 c7810ef979cf5242d99ad79b29849604c7508b99
SHA512 461ba410a006f47760c0f8368955b5c66f1789ba33546e3d9b704f9197b86b465f3328dd704e1c1904efdf8d460bb74a1190d0c69cfb2d4adcf1982a5c286942
SSDEEP 3072:NR2xn3k0CdM1vabyzJYWqS4or/NRw2ZFA:NR2J0LS6V0r/NR9A
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/848-131-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/1100-96-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1100-72-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/1668-100-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1668-93-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/2380-181-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2380-51-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2380-140-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2380-73-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2380-92-0x0000000000060000-0x0000000000061000-memory.dmp

Download

memory/3116-95-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3172-157-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3396-0-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3396-13-0x00000000008E0000-0x00000000008E1000-memory.dmp

Download

memory/3396-21-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3396-8-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3396-9-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3396-4-0x0000000000401000-0x0000000000402000-memory.dmp

Download

memory/3396-14-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3396-12-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3396-7-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3396-15-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3412-158-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3724-48-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/3724-50-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3756-108-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3924-74-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/3924-52-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3924-57-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3924-75-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3924-76-0x0000000077502000-0x0000000077503000-memory.dmp

Download

memory/3924-141-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3924-159-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4036-49-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4036-5-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/4052-142-0x0000000000400000-0x000000000043B000-memory.dmp

Download