ramnit | 815e55850982ba8ef596047737c5ee717dfbe1bc68887a46fc78ed7962201dde

Analysis

max time kernel
26s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2024 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97572437b6a78aaaa9d7925a3e3c48a3_JaffaCakes118.dll
Size

252KB
MD5

97572437b6a78aaaa9d7925a3e3c48a3
SHA1

20ec3cfc185ce474f4d86bf87a6dded70183ef61
SHA256

815e55850982ba8ef596047737c5ee717dfbe1bc68887a46fc78ed7962201dde
SHA512

cd757eec776d091a4a8265d6a9be0cceb07bd618405f81b32435ba54765fdf98081cb1316526a97cfa7bc2369cc445415854eefb74994bc5a9d93fc4577b1d78
SSDEEP

6144:dTa12CoCckAe8a0jbUjmJmdG/i8OJQvdjl2psxtd89:ik3djbo4mAK8eQvJ4psx89

Score

10^/10

ramnit sality backdoor banker discovery evasion persistence privilege_escalation spyware stealer trojan upx worm

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit
Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Sality family
sality

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WaterMark.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32mgr.exe

Disables RegEdit via registry modification 3 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	rundll32mgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	WaterMark.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	IEXPLORE.EXE

Disables Task Manager via registry modification
evasion

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5028	netsh.exe
4516	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
4724	rundll32mgr.exe
5096	WaterMark.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32mgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WaterMark.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4724-8-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4724-9-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4724-7-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4724-10-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4724-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4724-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4724-11-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4724-6-0x00000000031B0000-0x00000000041E0000-memory.dmp	upx
behavioral2/memory/5096-34-0x00000000030E0000-0x0000000004110000-memory.dmp	upx
behavioral2/memory/5096-39-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/5096-25-0x00000000030E0000-0x0000000004110000-memory.dmp	upx
behavioral2/memory/4724-16-0x00000000031B0000-0x00000000041E0000-memory.dmp	upx
behavioral2/memory/5096-45-0x00000000030E0000-0x0000000004110000-memory.dmp	upx
behavioral2/memory/5096-56-0x00000000030E0000-0x0000000004110000-memory.dmp	upx
behavioral2/memory/5096-59-0x00000000030E0000-0x0000000004110000-memory.dmp	upx
behavioral2/memory/5096-66-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/5096-65-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5096-80-0x00000000030E0000-0x0000000004110000-memory.dmp	upx
behavioral2/memory/5096-85-0x00000000030E0000-0x0000000004110000-memory.dmp	upx
behavioral2/memory/5096-88-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/5096-91-0x00000000030E0000-0x0000000004110000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\pxAF1C.tmp	rundll32mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	WaterMark.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	WaterMark.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	rundll32mgr.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2184	1152	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B8A35780-AAAC-11EF-B9D5-E26222BAF6A3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B8A0F634-AAAC-11EF-B9D5-E26222BAF6A3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
5096	WaterMark.exe
5096	WaterMark.exe
5096	WaterMark.exe
5096	WaterMark.exe
5096	WaterMark.exe
5096	WaterMark.exe
5096	WaterMark.exe
5096	WaterMark.exe
5096	WaterMark.exe
5096	WaterMark.exe
5096	WaterMark.exe
5096	WaterMark.exe
5096	WaterMark.exe
5096	WaterMark.exe
5096	WaterMark.exe
5096	WaterMark.exe
5096	WaterMark.exe
5096	WaterMark.exe
5096	WaterMark.exe
5096	WaterMark.exe
1240	IEXPLORE.EXE
1240	IEXPLORE.EXE

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	5096	WaterMark.exe
Token: SeDebugPrivilege	5096	WaterMark.exe
Token: SeDebugPrivilege	5096	WaterMark.exe
Token: SeDebugPrivilege	5096	WaterMark.exe
Token: SeDebugPrivilege	5096	WaterMark.exe
Token: SeDebugPrivilege	5096	WaterMark.exe
Token: SeDebugPrivilege	5096	WaterMark.exe
Token: SeDebugPrivilege	5096	WaterMark.exe
Token: SeDebugPrivilege	5096	WaterMark.exe
Token: SeDebugPrivilege	5096	WaterMark.exe
Token: SeDebugPrivilege	5096	WaterMark.exe
Token: SeDebugPrivilege	5096	WaterMark.exe
Token: SeDebugPrivilege	5096	WaterMark.exe
Token: SeDebugPrivilege	5096	WaterMark.exe
Token: SeDebugPrivilege	5096	WaterMark.exe
Token: SeDebugPrivilege	5096	WaterMark.exe
Token: SeDebugPrivilege	5096	WaterMark.exe
Token: SeDebugPrivilege	5096	WaterMark.exe
Token: SeDebugPrivilege	5096	WaterMark.exe
Token: SeDebugPrivilege	5096	WaterMark.exe
Token: SeDebugPrivilege	5096	WaterMark.exe
Token: SeDebugPrivilege	5096	WaterMark.exe
Token: SeDebugPrivilege	5096	WaterMark.exe
Token: SeDebugPrivilege	1240	IEXPLORE.EXE
Token: SeDebugPrivilege	1240	IEXPLORE.EXE
Token: SeDebugPrivilege	1240	IEXPLORE.EXE
Token: SeDebugPrivilege	1240	IEXPLORE.EXE
Token: SeDebugPrivilege	1240	IEXPLORE.EXE
Token: SeDebugPrivilege	1240	IEXPLORE.EXE
Token: SeDebugPrivilege	1240	IEXPLORE.EXE
Token: SeDebugPrivilege	1240	IEXPLORE.EXE
Token: SeDebugPrivilege	1240	IEXPLORE.EXE
Token: SeDebugPrivilege	1240	IEXPLORE.EXE
Token: SeDebugPrivilege	1240	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3652	iexplore.exe
5004	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
5004	iexplore.exe
5004	iexplore.exe
3652	iexplore.exe
3652	iexplore.exe
1240	IEXPLORE.EXE
1240	IEXPLORE.EXE
216	IEXPLORE.EXE
216	IEXPLORE.EXE
1240	IEXPLORE.EXE
1240	IEXPLORE.EXE

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4724	rundll32mgr.exe
5096	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 1152	3608	rundll32.exe	82
PID 3608 wrote to memory of 1152	3608	rundll32.exe	82
PID 3608 wrote to memory of 1152	3608	rundll32.exe	82
PID 1152 wrote to memory of 4724	1152	rundll32.exe	83
PID 1152 wrote to memory of 4724	1152	rundll32.exe	83
PID 1152 wrote to memory of 4724	1152	rundll32.exe	83
PID 4724 wrote to memory of 5096	4724	rundll32mgr.exe	85
PID 4724 wrote to memory of 5096	4724	rundll32mgr.exe	85
PID 4724 wrote to memory of 5096	4724	rundll32mgr.exe	85
PID 5096 wrote to memory of 3488	5096	WaterMark.exe	87
PID 5096 wrote to memory of 3488	5096	WaterMark.exe	87
PID 5096 wrote to memory of 3488	5096	WaterMark.exe	87
PID 5096 wrote to memory of 3488	5096	WaterMark.exe	87
PID 5096 wrote to memory of 3488	5096	WaterMark.exe	87
PID 5096 wrote to memory of 3488	5096	WaterMark.exe	87
PID 5096 wrote to memory of 3488	5096	WaterMark.exe	87
PID 5096 wrote to memory of 3488	5096	WaterMark.exe	87
PID 5096 wrote to memory of 3488	5096	WaterMark.exe	87
PID 5096 wrote to memory of 5028	5096	WaterMark.exe	88
PID 5096 wrote to memory of 5028	5096	WaterMark.exe	88
PID 5096 wrote to memory of 5028	5096	WaterMark.exe	88
PID 5096 wrote to memory of 768	5096	WaterMark.exe	8
PID 5096 wrote to memory of 776	5096	WaterMark.exe	9
PID 5096 wrote to memory of 64	5096	WaterMark.exe	13
PID 5096 wrote to memory of 2636	5096	WaterMark.exe	44
PID 5096 wrote to memory of 2648	5096	WaterMark.exe	45
PID 5096 wrote to memory of 2828	5096	WaterMark.exe	51
PID 5096 wrote to memory of 3432	5096	WaterMark.exe	56
PID 5096 wrote to memory of 3560	5096	WaterMark.exe	57
PID 5096 wrote to memory of 3744	5096	WaterMark.exe	58
PID 5096 wrote to memory of 3860	5096	WaterMark.exe	59
PID 5096 wrote to memory of 3928	5096	WaterMark.exe	60
PID 5096 wrote to memory of 4008	5096	WaterMark.exe	61
PID 5096 wrote to memory of 4108	5096	WaterMark.exe	62
PID 5096 wrote to memory of 4348	5096	WaterMark.exe	64
PID 5096 wrote to memory of 4416	5096	WaterMark.exe	76
PID 5096 wrote to memory of 3608	5096	WaterMark.exe	81
PID 5096 wrote to memory of 1152	5096	WaterMark.exe	82
PID 5096 wrote to memory of 1152	5096	WaterMark.exe	82
PID 5096 wrote to memory of 5056	5096	WaterMark.exe
PID 5096 wrote to memory of 3652	5096	WaterMark.exe	91
PID 5096 wrote to memory of 3652	5096	WaterMark.exe	91
PID 5096 wrote to memory of 5004	5096	WaterMark.exe	92
PID 5096 wrote to memory of 5004	5096	WaterMark.exe	92
PID 5004 wrote to memory of 216	5004	iexplore.exe	93
PID 5004 wrote to memory of 216	5004	iexplore.exe	93
PID 5004 wrote to memory of 216	5004	iexplore.exe	93
PID 3652 wrote to memory of 1240	3652	iexplore.exe	94
PID 3652 wrote to memory of 1240	3652	iexplore.exe	94
PID 3652 wrote to memory of 1240	3652	iexplore.exe	94
PID 5096 wrote to memory of 768	5096	WaterMark.exe	8
PID 5096 wrote to memory of 776	5096	WaterMark.exe	9
PID 5096 wrote to memory of 64	5096	WaterMark.exe	13
PID 5096 wrote to memory of 2636	5096	WaterMark.exe	44
PID 5096 wrote to memory of 2648	5096	WaterMark.exe	45
PID 5096 wrote to memory of 2828	5096	WaterMark.exe	51
PID 5096 wrote to memory of 3432	5096	WaterMark.exe	56
PID 5096 wrote to memory of 3560	5096	WaterMark.exe	57
PID 5096 wrote to memory of 3744	5096	WaterMark.exe	58
PID 5096 wrote to memory of 3860	5096	WaterMark.exe	59
PID 5096 wrote to memory of 3928	5096	WaterMark.exe	60
PID 5096 wrote to memory of 4008	5096	WaterMark.exe	61
PID 5096 wrote to memory of 4108	5096	WaterMark.exe	62
PID 5096 wrote to memory of 4348	5096	WaterMark.exe	64

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32mgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WaterMark.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:768

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:776

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:64

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2648

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2828

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3432
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\97572437b6a78aaaa9d7925a3e3c48a3_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\97572437b6a78aaaa9d7925a3e3c48a3_JaffaCakes118.dll,#1
    3⤵
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1152
  - - C:\Windows\SysWOW64\rundll32mgr.exe
      C:\Windows\SysWOW64\rundll32mgr.exe
      4⤵
      UAC bypass
      Disables RegEdit via registry modification
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4724
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        UAC bypass
        Disables RegEdit via registry modification
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:5096
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        
        PID:3488
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall set opmode disable
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:5028
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3652
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3652 CREDAT:17410 /prefetch:2
        7⤵
        UAC bypass
        Disables RegEdit via registry modification
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1240
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall set opmode disable
        8⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4516
        
        C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE"
        8⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE"
        8⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE"
        8⤵
        
        PID:1680
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5004 CREDAT:17410 /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:216
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 608
      4⤵
      Program crash
      PID:2184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3560

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3744

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3860

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3928

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4008

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4108

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4348

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1152 -ip 1152
1⤵
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
539399c9f7153f78b67cde1bcdea163f

SHA1
6cb6e4936d546c17549aec9431a2af7c31bb3c3a

SHA256
27b9528028887b2d852cae2cb55efb965fc13dfa0882f85d6236814f7eb0ad65

SHA512
11836ba1429de7d15b9eb33b4852b0c71872149e9d448959c366aca1db75796446a86ee5c40b274ac3102d5395c7197d4dc2cd11b32754538aa6883e0ebdbf17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
e8501e15064a24e323c8fd718d5e3083

SHA1
904ac96b6b298efb8904bf52fdd4b6b50eefbafd

SHA256
20d1d1e00d3507b68cd48cd2187b150637fe3f6149b1a9bcd07a6414afe29a5f

SHA512
317499143aa7e73d0080c7d279a8317794faccbf080668be7511779523e151bc8a1813cc15e582ba93b3d13944ebbb4c69038f9a0c430b51e1d672458cdda94a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B8A0F634-AAAC-11EF-B9D5-E26222BAF6A3}.dat

Filesize
5KB

MD5
640e522d69ac2994690fec9ee94b28ce

SHA1
df102316b81c1f643b7b64ef7807c5be214c74f5

SHA256
3ed5377d387efd7f4caa1ac47406316b417a8f69c9b755334c65b56446bafcf3

SHA512
7d348665698899c3460d883e60bab8e3b20db0234ae5bf6123b1c93db162f1002995a3c845b41d5c9910501b3a1e4ca6142443e6a7ffa1eac8a7c2d977af35d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B8A35780-AAAC-11EF-B9D5-E26222BAF6A3}.dat

Filesize
3KB

MD5
3eea06e5652cfb88329b9e51f8adf8ed

SHA1
230bbbc15266f3f9ca9d0552b48179d67a31684a

SHA256
acfe597e82b850843c27d7f5e1cadf9f214259f55b39802a652274c790e61e86

SHA512
38db594a83c6849897dc7d75e68a4d25ee9d4009df020096bbb1d9a4dd8345238207a12dd89ff90726e220fb414973b24e3ea8ec3ccecdf5df71f5650bca9b1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver3459.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FQRZN8O7\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Windows\SYSTEM.INI

Filesize
255B

MD5
ce78647cb79816e1a7107b364fc97d6c

SHA1
4af4b4786a6b1031733919ff4577b83bf7458872

SHA256
8b8b0c651eb3548b24260fb0aad9bc301a5215fbd5512e3892a34e2f174428c3

SHA512
39e3213534c6e84297bfb6ced9b757e03ff63a1876d117683627c3073d8f81882fba79e8ac916de2a59cae314a53efe42bcdb404048003c6b816ec28f112b924

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
187KB

MD5
27fdabf7c440551ce0d41832bb40e0e4

SHA1
c3a6f07789562c1edbea44197a3f6cb3f6d345c9

SHA256
52f26137f9a813c374e5bca7ae97f2f31c1f8084276944fdc5e97df7a69a86c4

SHA512
4c13cfe5ed6741933d83ba0af39bd9cc544033328fe015b5ec1f1eff358e54764814f60085c0b4528034e2e8ab2f94694e186b27d9e66e42e01391ba20f38df5

Download Submit
memory/1152-54-0x0000000002290000-0x0000000002292000-memory.dmp

Filesize
8KB

Download
memory/1152-1-0x000000006D100000-0x000000006D13F000-memory.dmp

Filesize
252KB

Download
memory/1152-49-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/1152-48-0x0000000002290000-0x0000000002292000-memory.dmp

Filesize
8KB

Download
memory/1152-77-0x0000000002290000-0x0000000002292000-memory.dmp

Filesize
8KB

Download
memory/1152-81-0x0000000002290000-0x0000000002292000-memory.dmp

Filesize
8KB

Download
memory/1152-52-0x0000000002290000-0x0000000002292000-memory.dmp

Filesize
8KB

Download
memory/1152-84-0x000000006D100000-0x000000006D13F000-memory.dmp

Filesize
252KB

Download
memory/4724-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4724-6-0x00000000031B0000-0x00000000041E0000-memory.dmp

Filesize
16.2MB

Download
memory/4724-11-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4724-62-0x00000000031B0000-0x00000000041E0000-memory.dmp

Filesize
16.2MB

Download
memory/4724-16-0x00000000031B0000-0x00000000041E0000-memory.dmp

Filesize
16.2MB

Download
memory/4724-24-0x0000000000401000-0x0000000000416000-memory.dmp

Filesize
84KB

Download
memory/4724-23-0x0000000000416000-0x0000000000420000-memory.dmp

Filesize
40KB

Download
memory/4724-22-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/4724-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4724-10-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4724-7-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4724-9-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4724-8-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4724-4-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5096-51-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download
memory/5096-53-0x0000000004B80000-0x0000000004B82000-memory.dmp

Filesize
8KB

Download
memory/5096-56-0x00000000030E0000-0x0000000004110000-memory.dmp

Filesize
16.2MB

Download
memory/5096-58-0x0000000005200000-0x0000000005201000-memory.dmp

Filesize
4KB

Download
memory/5096-59-0x00000000030E0000-0x0000000004110000-memory.dmp

Filesize
16.2MB

Download
memory/5096-55-0x0000000004B80000-0x0000000004B82000-memory.dmp

Filesize
8KB

Download
memory/5096-45-0x00000000030E0000-0x0000000004110000-memory.dmp

Filesize
16.2MB

Download
memory/5096-63-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/5096-25-0x00000000030E0000-0x0000000004110000-memory.dmp

Filesize
16.2MB

Download
memory/5096-66-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/5096-65-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5096-69-0x0000000077172000-0x0000000077173000-memory.dmp

Filesize
4KB

Download
memory/5096-78-0x0000000004B80000-0x0000000004B82000-memory.dmp

Filesize
8KB

Download
memory/5096-39-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/5096-80-0x00000000030E0000-0x0000000004110000-memory.dmp

Filesize
16.2MB

Download
memory/5096-40-0x00000000028C0000-0x00000000028C1000-memory.dmp

Filesize
4KB

Download
memory/5096-34-0x00000000030E0000-0x0000000004110000-memory.dmp

Filesize
16.2MB

Download
memory/5096-85-0x00000000030E0000-0x0000000004110000-memory.dmp

Filesize
16.2MB

Download
memory/5096-88-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/5096-95-0x0000000004B80000-0x0000000004B82000-memory.dmp

Filesize
8KB

Download
memory/5096-91-0x00000000030E0000-0x0000000004110000-memory.dmp

Filesize
16.2MB

Download
memory/5096-41-0x0000000077172000-0x0000000077173000-memory.dmp

Filesize
4KB

Download
memory/5096-37-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/5096-27-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/5096-26-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download