ramnit | 06cbb6b395d1af86ef83564eb83c34d3b145d6166392529f764c25dccce798f5

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_409e4b610d3a88cc14d376d50b4d5809.dll
Size

252KB
MD5

409e4b610d3a88cc14d376d50b4d5809
SHA1

cbe2ad8367205a203c8c0815ee6ac5f3813cc045
SHA256

06cbb6b395d1af86ef83564eb83c34d3b145d6166392529f764c25dccce798f5
SHA512

f9bacb0d8ecf16f22786fbff2fa24f8c9ec749ae01e3b053f55adb7266259da83d2a86de6ed7a7a313a5879d14f4f1e2514295d1098559832ecad943ba3ce7da
SSDEEP

3072:DvXmimD0k0QRW1PhI1sItKOgGdX3DUPs6FMGPyaUQ2DIK:D+fD/0QSzItKOgGFY00D3K7

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
2880	rundll32mgr.exe
2732	WaterMark.exe

Loads dropped DLL 4 IoCs

pid	Process
2060	rundll32.exe
2060	rundll32.exe
2880	rundll32mgr.exe
2880	rundll32mgr.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2880-22-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2880-19-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2880-18-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2732-36-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/memory/2732-43-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2732-40-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2880-16-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2880-15-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2880-14-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2880-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2732-84-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2732-569-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre7\bin\npt.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmid.exe	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\ucrtbase.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationProvider.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_wav_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1655.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\sqlite.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_transcode_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\glass.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jp2iexp.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libkate_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_autodel_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libposterize_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\msvcr100.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\orbd.exe	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libcdda_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libdeinterlace_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\RSSFeeds.html	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\F12Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\pdmproxy100.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\server\jvm.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-core-synch-l1-2-0.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Luna.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\misc\libaudioscrobbler_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libyuv_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\settings.html	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\msitss55.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libdmo_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_dummy_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libdshow_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Utilities.v3.5.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\logger\libconsole_logger_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\settings.html	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\MSSOAPR3.DLL	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libvmem_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEOLEDB.DLL	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\IA2Marshal.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Defender\MpCommu.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libinvert_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEDAO.DLL	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_gather_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\currency.html	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libwebvtt_plugin.dll	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2732	WaterMark.exe
2732	WaterMark.exe
2732	WaterMark.exe
2732	WaterMark.exe
2732	WaterMark.exe
2732	WaterMark.exe
2732	WaterMark.exe
2732	WaterMark.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe
1680	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2732	WaterMark.exe
Token: SeDebugPrivilege	1680	svchost.exe
Token: SeDebugPrivilege	2732	WaterMark.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2880	rundll32mgr.exe
2732	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2060	2284	rundll32.exe	28
PID 2284 wrote to memory of 2060	2284	rundll32.exe	28
PID 2284 wrote to memory of 2060	2284	rundll32.exe	28
PID 2284 wrote to memory of 2060	2284	rundll32.exe	28
PID 2284 wrote to memory of 2060	2284	rundll32.exe	28
PID 2284 wrote to memory of 2060	2284	rundll32.exe	28
PID 2284 wrote to memory of 2060	2284	rundll32.exe	28
PID 2060 wrote to memory of 2880	2060	rundll32.exe	29
PID 2060 wrote to memory of 2880	2060	rundll32.exe	29
PID 2060 wrote to memory of 2880	2060	rundll32.exe	29
PID 2060 wrote to memory of 2880	2060	rundll32.exe	29
PID 2880 wrote to memory of 2732	2880	rundll32mgr.exe	30
PID 2880 wrote to memory of 2732	2880	rundll32mgr.exe	30
PID 2880 wrote to memory of 2732	2880	rundll32mgr.exe	30
PID 2880 wrote to memory of 2732	2880	rundll32mgr.exe	30
PID 2732 wrote to memory of 2788	2732	WaterMark.exe	31
PID 2732 wrote to memory of 2788	2732	WaterMark.exe	31
PID 2732 wrote to memory of 2788	2732	WaterMark.exe	31
PID 2732 wrote to memory of 2788	2732	WaterMark.exe	31
PID 2732 wrote to memory of 2788	2732	WaterMark.exe	31
PID 2732 wrote to memory of 2788	2732	WaterMark.exe	31
PID 2732 wrote to memory of 2788	2732	WaterMark.exe	31
PID 2732 wrote to memory of 2788	2732	WaterMark.exe	31
PID 2732 wrote to memory of 2788	2732	WaterMark.exe	31
PID 2732 wrote to memory of 2788	2732	WaterMark.exe	31
PID 2732 wrote to memory of 1680	2732	WaterMark.exe	32
PID 2732 wrote to memory of 1680	2732	WaterMark.exe	32
PID 2732 wrote to memory of 1680	2732	WaterMark.exe	32
PID 2732 wrote to memory of 1680	2732	WaterMark.exe	32
PID 2732 wrote to memory of 1680	2732	WaterMark.exe	32
PID 2732 wrote to memory of 1680	2732	WaterMark.exe	32
PID 2732 wrote to memory of 1680	2732	WaterMark.exe	32
PID 2732 wrote to memory of 1680	2732	WaterMark.exe	32
PID 2732 wrote to memory of 1680	2732	WaterMark.exe	32
PID 2732 wrote to memory of 1680	2732	WaterMark.exe	32
PID 1680 wrote to memory of 256	1680	svchost.exe	1
PID 1680 wrote to memory of 256	1680	svchost.exe	1
PID 1680 wrote to memory of 256	1680	svchost.exe	1
PID 1680 wrote to memory of 256	1680	svchost.exe	1
PID 1680 wrote to memory of 256	1680	svchost.exe	1
PID 1680 wrote to memory of 336	1680	svchost.exe	2
PID 1680 wrote to memory of 336	1680	svchost.exe	2
PID 1680 wrote to memory of 336	1680	svchost.exe	2
PID 1680 wrote to memory of 336	1680	svchost.exe	2
PID 1680 wrote to memory of 336	1680	svchost.exe	2
PID 1680 wrote to memory of 384	1680	svchost.exe	3
PID 1680 wrote to memory of 384	1680	svchost.exe	3
PID 1680 wrote to memory of 384	1680	svchost.exe	3
PID 1680 wrote to memory of 384	1680	svchost.exe	3
PID 1680 wrote to memory of 384	1680	svchost.exe	3
PID 1680 wrote to memory of 392	1680	svchost.exe	4
PID 1680 wrote to memory of 392	1680	svchost.exe	4
PID 1680 wrote to memory of 392	1680	svchost.exe	4
PID 1680 wrote to memory of 392	1680	svchost.exe	4
PID 1680 wrote to memory of 392	1680	svchost.exe	4
PID 1680 wrote to memory of 432	1680	svchost.exe	5
PID 1680 wrote to memory of 432	1680	svchost.exe	5
PID 1680 wrote to memory of 432	1680	svchost.exe	5
PID 1680 wrote to memory of 432	1680	svchost.exe	5
PID 1680 wrote to memory of 432	1680	svchost.exe	5
PID 1680 wrote to memory of 480	1680	svchost.exe	6
PID 1680 wrote to memory of 480	1680	svchost.exe	6
PID 1680 wrote to memory of 480	1680	svchost.exe	6
PID 1680 wrote to memory of 480	1680	svchost.exe	6

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:336

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:480
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:612
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1692
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe -Embedding
      4⤵
      PID:1952
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:692
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:776
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:832
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1180
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:872
  - - C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      4⤵
      PID:2800
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:980
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:268
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:344
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1060
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1120
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2116
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:544
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:488
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:496

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_409e4b610d3a88cc14d376d50b4d5809.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_409e4b610d3a88cc14d376d50b4d5809.dll,#1
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Windows\SysWOW64\rundll32mgr.exe
      C:\Windows\SysWOW64\rundll32mgr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:2880
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:2732
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:2788
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
333KB

MD5
e036437b684975027dc6df08c9066272

SHA1
2114a567510eb620348bef8a73a3592723d2b145

SHA256
a34f9e9596fd7d1f90b4c8de66bc58bb3269b2a242e0264dcf8e89970e968937

SHA512
9a76e8d735079a4876f861af972325517883cc9235108999f5c892f8a2eb52562781520841d18fd88c80132963cd36c5463e0166deed3a754496bcfdc114d34b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
330KB

MD5
794ff443dedf40302556ac08ec0840e8

SHA1
6d68482651b80d4af98ffd7d19a531aac11b8373

SHA256
7ee5925297667724e25d64b2ebdf95f146fc4b91d78c08256eb470d37588944f

SHA512
d610937cfbae1a0e0ee98441b166316ecd0e7013c58da0517de8421ac80eb824f29fa4576bd18495b49df8ab017cab7448063e621cb8b01f2370fcf0aae66745

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
160KB

MD5
022b0d9bbbee34248b59093de69716ae

SHA1
958cdf59094e03777035f08a5eebaf983df1e035

SHA256
87e12e626859a809288172460d7a2626a3e0eca4dd7703277c20f52e8c3edc72

SHA512
595340361e147673c74cd9a7498cf87f3353d10f78cc3bcdd0aef26270fbe25b00a29281970db23d8a0ad9146a1c0a2ec7f41cce7f6c54d6f6b0dabe4a0be3f0

Download Submit
memory/1680-94-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1680-95-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1680-75-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1680-91-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/1680-92-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1680-90-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1680-96-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1680-85-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1680-93-0x00000000770E0000-0x00000000770E1000-memory.dmp

Filesize
4KB

Download
memory/2060-1-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2060-10-0x0000000000240000-0x0000000000272000-memory.dmp

Filesize
200KB

Download
memory/2060-11-0x0000000000240000-0x0000000000272000-memory.dmp

Filesize
200KB

Download
memory/2060-70-0x0000000000240000-0x0000000000272000-memory.dmp

Filesize
200KB

Download
memory/2060-0-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/2732-41-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2732-73-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2732-569-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2732-36-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2732-42-0x00000000770DF000-0x00000000770E0000-memory.dmp

Filesize
4KB

Download
memory/2732-40-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2732-43-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2732-84-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2732-89-0x00000000770DF000-0x00000000770E0000-memory.dmp

Filesize
4KB

Download
memory/2788-63-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2788-45-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2788-61-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2788-56-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2788-60-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2788-336-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2788-68-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2788-55-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2788-54-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2788-47-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2880-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2880-16-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2880-15-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2880-17-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2880-18-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2880-12-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2880-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2880-19-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2880-22-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download