Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29/10/2024, 04:41
Static task
static1
Behavioral task
behavioral1
Sample
7bcd9f2c6a2709ab2cff279e2942047a_JaffaCakes118.dll
Resource
win7-20241010-en
General
-
Target
7bcd9f2c6a2709ab2cff279e2942047a_JaffaCakes118.dll
-
Size
352KB
-
MD5
7bcd9f2c6a2709ab2cff279e2942047a
-
SHA1
214473ce7a0eb1cbda087f56598cb0d3998f6717
-
SHA256
c58f710dae497c8f686c66372a5b311e9a266b3d88a7d195ee694b2517ccd2eb
-
SHA512
4263aec369c19b21e987948e7f1aae4ffc1df92078cc1d155fe04402d2a323ffc10ecf33a19b66b32d5df7c8df2fc41b9aae1e07b977fadb97a42874000eeb5d
-
SSDEEP
6144:LqNwDq2Po2/K2uA4MXW1wShvmZ79ylRFDwGLVEF2UW+zS317K:Igqko2i2uAbW/hvA79CCGLXb31O
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Ramnit family
-
Executes dropped EXE 2 IoCs
pid Process 1592 rundll32mgr.exe 2196 WaterMark.exe -
Loads dropped DLL 4 IoCs
pid Process 612 rundll32.exe 612 rundll32.exe 1592 rundll32mgr.exe 1592 rundll32mgr.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched = "\"1\\bin\\jusched.exe\"" rundll32.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} rundll32.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
resource yara_rule behavioral1/memory/1592-29-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1592-27-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1592-26-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1592-24-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1592-23-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1592-22-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1592-21-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2196-50-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2196-53-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2196-94-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2196-578-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libmjpeg_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Journal\MSPVWCTL.DLL svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libjpeg_plugin.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\ReachFramework.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Design.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IO.Log.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpsychedelic_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationFramework.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\liblogo_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows NT\Accessories\WordpadFilter.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\Microsoft.Ink.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProvider.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\librtpvideo_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\librotate_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\settings.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\dcpr.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\glass.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\j2pcsc.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jsdt.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\server\jvm.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_wasapi_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunec.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libgestures_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_rtp_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\settings.html svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\xul.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Linq.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libvhs_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\atl.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\nss3.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationFramework.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libcc_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_transcode_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadcfr.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-math-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgrain_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingEngine.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libdirectsound_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libts_plugin.dll svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}\InprocServer32\ = "1\\bin\\ssv.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\InprocServer32\ = "1\\bin\\npjpi160.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.jar\ = "jarfile" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jarfile rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ = "Java Plug-in 1.6.0" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\MiscStatus\1 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}\MiscStatus\1\ = "2449" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}\MiscStatus\1\ = "2449" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}\MiscStatus\1 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC} rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-java-jnlp-file rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\InprocServer32 rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\JNLPFile\EditFlags = 00000100 rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JNLPFile\Shell\Open rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\MiscStatus\ = "0" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\MiscStatus rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JavaPlugin.FamilyVersionSupport rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.jnlp\ = "JNLPFile" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JNLPFile rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}\InprocServer32 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\ = "Executable Jar File" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.jnlp rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93} rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\ = "Java Plug-in" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}\ = "Java Plug-in" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\MiscStatus\1 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\MiscStatus\1\ = "2449" rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-java-jnlp-file rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\ = "Java Plug-in 1.6.0" rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.jar rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\jarfile rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JNLPFile\Shell\Open rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JNLPFile\Shell\Open\ = "&Launch" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}\ = "Java Plug-in 1.6.0" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}\InprocServer32\ = "1\\bin\\npjpi160.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InprocServer32\ = "1\\bin\\npjpi160.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.jnlp\Content Type = "application/x-java-jnlp-file" rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JNLPFile\Shell rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JavaPlugin.160\CLSID rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC}\InprocServer32\ = "1\\bin\\npjpi160.dll" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}\MiscStatus\1 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-FFFF-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}\ = "Java Plug-in" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0015-0000-FFFF-ABCDEFFEDCBA}\MiscStatus\ = "0" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\ = "SSVHelper Class" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JavaPlugin\CLSID\ = "{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.jar rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\InprocServer32 rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\shell\open rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\InprocServer32\ = "1\\bin\\npjpi160.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JavaPlugin.FamilyVersionSupport\CLSID\ = "{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}\InprocServer32\ = "1\\bin\\ssv.dll" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JNLPFile\Shell\Open\Command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CAFEEFAC-0014-0002-FFFF-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JavaPlugin\CLSID rundll32.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 2196 WaterMark.exe 2196 WaterMark.exe 2196 WaterMark.exe 2196 WaterMark.exe 2196 WaterMark.exe 2196 WaterMark.exe 2196 WaterMark.exe 2196 WaterMark.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe 2636 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2196 WaterMark.exe Token: SeDebugPrivilege 2636 svchost.exe Token: SeDebugPrivilege 2196 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1592 rundll32mgr.exe 2196 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2844 wrote to memory of 612 2844 rundll32.exe 28 PID 2844 wrote to memory of 612 2844 rundll32.exe 28 PID 2844 wrote to memory of 612 2844 rundll32.exe 28 PID 2844 wrote to memory of 612 2844 rundll32.exe 28 PID 2844 wrote to memory of 612 2844 rundll32.exe 28 PID 2844 wrote to memory of 612 2844 rundll32.exe 28 PID 2844 wrote to memory of 612 2844 rundll32.exe 28 PID 612 wrote to memory of 1592 612 rundll32.exe 29 PID 612 wrote to memory of 1592 612 rundll32.exe 29 PID 612 wrote to memory of 1592 612 rundll32.exe 29 PID 612 wrote to memory of 1592 612 rundll32.exe 29 PID 1592 wrote to memory of 2196 1592 rundll32mgr.exe 30 PID 1592 wrote to memory of 2196 1592 rundll32mgr.exe 30 PID 1592 wrote to memory of 2196 1592 rundll32mgr.exe 30 PID 1592 wrote to memory of 2196 1592 rundll32mgr.exe 30 PID 2196 wrote to memory of 2792 2196 WaterMark.exe 31 PID 2196 wrote to memory of 2792 2196 WaterMark.exe 31 PID 2196 wrote to memory of 2792 2196 WaterMark.exe 31 PID 2196 wrote to memory of 2792 2196 WaterMark.exe 31 PID 2196 wrote to memory of 2792 2196 WaterMark.exe 31 PID 2196 wrote to memory of 2792 2196 WaterMark.exe 31 PID 2196 wrote to memory of 2792 2196 WaterMark.exe 31 PID 2196 wrote to memory of 2792 2196 WaterMark.exe 31 PID 2196 wrote to memory of 2792 2196 WaterMark.exe 31 PID 2196 wrote to memory of 2792 2196 WaterMark.exe 31 PID 2196 wrote to memory of 2636 2196 WaterMark.exe 32 PID 2196 wrote to memory of 2636 2196 WaterMark.exe 32 PID 2196 wrote to memory of 2636 2196 WaterMark.exe 32 PID 2196 wrote to memory of 2636 2196 WaterMark.exe 32 PID 2196 wrote to memory of 2636 2196 WaterMark.exe 32 PID 2196 wrote to memory of 2636 2196 WaterMark.exe 32 PID 2196 wrote to memory of 2636 2196 WaterMark.exe 32 PID 2196 wrote to memory of 2636 2196 WaterMark.exe 32 PID 2196 wrote to memory of 2636 2196 WaterMark.exe 32 PID 2196 wrote to memory of 2636 2196 WaterMark.exe 32 PID 2636 wrote to memory of 256 2636 svchost.exe 1 PID 2636 wrote to memory of 256 2636 svchost.exe 1 PID 2636 wrote to memory of 256 2636 svchost.exe 1 PID 2636 wrote to memory of 256 2636 svchost.exe 1 PID 2636 wrote to memory of 256 2636 svchost.exe 1 PID 2636 wrote to memory of 336 2636 svchost.exe 2 PID 2636 wrote to memory of 336 2636 svchost.exe 2 PID 2636 wrote to memory of 336 2636 svchost.exe 2 PID 2636 wrote to memory of 336 2636 svchost.exe 2 PID 2636 wrote to memory of 336 2636 svchost.exe 2 PID 2636 wrote to memory of 384 2636 svchost.exe 3 PID 2636 wrote to memory of 384 2636 svchost.exe 3 PID 2636 wrote to memory of 384 2636 svchost.exe 3 PID 2636 wrote to memory of 384 2636 svchost.exe 3 PID 2636 wrote to memory of 384 2636 svchost.exe 3 PID 2636 wrote to memory of 392 2636 svchost.exe 4 PID 2636 wrote to memory of 392 2636 svchost.exe 4 PID 2636 wrote to memory of 392 2636 svchost.exe 4 PID 2636 wrote to memory of 392 2636 svchost.exe 4 PID 2636 wrote to memory of 392 2636 svchost.exe 4 PID 2636 wrote to memory of 432 2636 svchost.exe 5 PID 2636 wrote to memory of 432 2636 svchost.exe 5 PID 2636 wrote to memory of 432 2636 svchost.exe 5 PID 2636 wrote to memory of 432 2636 svchost.exe 5 PID 2636 wrote to memory of 432 2636 svchost.exe 5 PID 2636 wrote to memory of 476 2636 svchost.exe 6 PID 2636 wrote to memory of 476 2636 svchost.exe 6 PID 2636 wrote to memory of 476 2636 svchost.exe 6 PID 2636 wrote to memory of 476 2636 svchost.exe 6
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:256
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:336
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:596
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1572
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵PID:1776
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:676
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:756
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:808
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1132
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:856
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵PID:2536
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:968
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:272
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:1052
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1060
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1148
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:1428
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2704
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:392
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7bcd9f2c6a2709ab2cff279e2942047a_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7bcd9f2c6a2709ab2cff279e2942047a_JaffaCakes118.dll,#13⤵
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2792
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize251KB
MD58775eeb4a88a60b25a5c87212dbe4541
SHA1494f4df1959911d9b91bab28a839263501da6137
SHA25661c21d40051e2982957b2256807b20e5f7679989c4b1afd1c148082f55508907
SHA512b40161f44a33782e65bae232709a331fe92670e4a76a2140869fb49a122410c01256fe917ac5ea4a33710212da41b1a7ba98d7945a397333830dced41a3bb89b
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize247KB
MD5e583367bc9fc3c76266bd83aefa4cc8d
SHA14c17b9b43ca9c7b8725b21e852988d486d433fa2
SHA2568ecf45ee11b5dd0fc79186636d11ef4487681173f5c958e454232a9d6c6767ac
SHA512b8554ae17442cd9568bbda263caffeacb4ef1b76154ef9f1566de7c739fe80e4e1980c19691177dbacce835a66962e0ed222e116df1732532a5aed4966cfdd28
-
Filesize
4KB
MD51545b166d2f9c3c5fcd58f1ac904a051
SHA131739ba0e1d5171615fa817b8eb8dbd3e34f1dc0
SHA2567eeffc594ea91bc524980b34e3ad87c09f16a91edd160129987cd8fd74973e96
SHA5128e89a36a2cfff443e542e5104ef51ab9ea245deb00ef7cf371a11e8c109b62f15e50b658ed45bee463f81443f9607d311e9f13daa1477c151ab8b88870d725c8
-
Filesize
119KB
MD5b313c611c4280feba76564194b05c1eb
SHA116d9cbab9fb369ddcd6f6e33cdaf977fe3d34c8c
SHA256bd7b3cb1c8d032fe5dddbe74ce0cba8df770b7545e550f6bf216ab2cdd4ff87f
SHA512691d9d8f27e83df242216087362f45d35e7387ec56169bd9af5b9309838be70c5c042fe6bc9c0152db870696df0a0e4f369950dd9d18c65403c72d8293f74f0b