ramnit | e4821aa28f185f2c899996739e86b5adcd5a17a388a85c467f88cf17681d4098

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03-01-2025 05:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6a71f243c13e963370b3196b01e53ca4.dll
Size

156KB
MD5

6a71f243c13e963370b3196b01e53ca4
SHA1

b85e155768fd9f2bb48190f2cabfcb73cf358ac3
SHA256

e4821aa28f185f2c899996739e86b5adcd5a17a388a85c467f88cf17681d4098
SHA512

8398702af2cb25ca05d69fd75fe824c09c1909c9e81035ebd97ef4e10bcbb85ed10e43a6e87840d4544a7e1978d25a2fa85d39bee34144f1e99143303961ec64
SSDEEP

3072:sL0gO/xayIkAbmhoydJbsXRvxRqEQmP5y:OockkmhoydJsXHgcP5y

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
696	regsvr32mgr.exe
2468	WaterMark.exe

Loads dropped DLL 4 IoCs

pid	Process
2524	regsvr32.exe
2524	regsvr32.exe
696	regsvr32mgr.exe
696	regsvr32mgr.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\regsvr32mgr.exe	regsvr32.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/696-15-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/696-14-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/696-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/696-20-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/696-18-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/696-17-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/696-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2468-39-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2468-41-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2468-82-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2468-630-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Printing.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libavi_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libflacsys_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_vc1_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\libarchive_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libdirectory_demux_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\WMPDMC.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\ONLNTCOMLIB.DLL	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\qipcap64.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IO.Log.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsBase.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_avi_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libextract_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libvoc_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGM.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libmkv_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.ServiceModel.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClientsideProviders.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmirror_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\glib-lite.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationBuildTasks.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationTypes.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsdec_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libau_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Net.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\liblibmpeg2_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\picturePuzzle.html	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\misc\libexport_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\Microsoft.Ink.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACECORE.DLL	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\README.html	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\awt.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Luna.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libinflate_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACERCLR.DLL	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubstx3g_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libgl_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\DirectDB.dll	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtospdif_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmid.exe	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C19A613-BBC0-434D-889A-AD5F32C64857}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C19A613-BBC0-434D-889A-AD5F32C64857}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_6a71f243c13e963370b3196b01e53ca4.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C19A613-BBC0-434D-889A-AD5F32C64857}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C19A613-BBC0-434D-889A-AD5F32C64857}\ = "PSFactoryBuffer"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C19A613-BBC0-434D-889A-AD5F32C64857}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C19A613-BBC0-434D-889A-AD5F32C64857}\ProxyStubClsid32\ = "{6C19A613-BBC0-434D-889A-AD5F32C64857}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C19A613-BBC0-434D-889A-AD5F32C64857}\NumMethods\ = "10"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{38DF9356-47C1-40EF-89CE-AF1D019B0BAA}\ProxyStubClsid32\ = "{6C19A613-BBC0-434D-889A-AD5F32C64857}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{38DF9356-47C1-40EF-89CE-AF1D019B0BAA}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C19A613-BBC0-434D-889A-AD5F32C64857}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C19A613-BBC0-434D-889A-AD5F32C64857}\ = "IRichVideoTool"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C19A613-BBC0-434D-889A-AD5F32C64857}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{38DF9356-47C1-40EF-89CE-AF1D019B0BAA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{38DF9356-47C1-40EF-89CE-AF1D019B0BAA}\ = "IRVInterface"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{38DF9356-47C1-40EF-89CE-AF1D019B0BAA}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{38DF9356-47C1-40EF-89CE-AF1D019B0BAA}\NumMethods\ = "56"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6C19A613-BBC0-434D-889A-AD5F32C64857}	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2468	WaterMark.exe
2468	WaterMark.exe
2468	WaterMark.exe
2468	WaterMark.exe
2468	WaterMark.exe
2468	WaterMark.exe
2468	WaterMark.exe
2468	WaterMark.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe
2688	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2468	WaterMark.exe
Token: SeDebugPrivilege	2688	svchost.exe
Token: SeDebugPrivilege	2468	WaterMark.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
696	regsvr32mgr.exe
2468	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2524	2408	regsvr32.exe	30
PID 2408 wrote to memory of 2524	2408	regsvr32.exe	30
PID 2408 wrote to memory of 2524	2408	regsvr32.exe	30
PID 2408 wrote to memory of 2524	2408	regsvr32.exe	30
PID 2408 wrote to memory of 2524	2408	regsvr32.exe	30
PID 2408 wrote to memory of 2524	2408	regsvr32.exe	30
PID 2408 wrote to memory of 2524	2408	regsvr32.exe	30
PID 2524 wrote to memory of 696	2524	regsvr32.exe	31
PID 2524 wrote to memory of 696	2524	regsvr32.exe	31
PID 2524 wrote to memory of 696	2524	regsvr32.exe	31
PID 2524 wrote to memory of 696	2524	regsvr32.exe	31
PID 696 wrote to memory of 2468	696	regsvr32mgr.exe	32
PID 696 wrote to memory of 2468	696	regsvr32mgr.exe	32
PID 696 wrote to memory of 2468	696	regsvr32mgr.exe	32
PID 696 wrote to memory of 2468	696	regsvr32mgr.exe	32
PID 2468 wrote to memory of 3020	2468	WaterMark.exe	33
PID 2468 wrote to memory of 3020	2468	WaterMark.exe	33
PID 2468 wrote to memory of 3020	2468	WaterMark.exe	33
PID 2468 wrote to memory of 3020	2468	WaterMark.exe	33
PID 2468 wrote to memory of 3020	2468	WaterMark.exe	33
PID 2468 wrote to memory of 3020	2468	WaterMark.exe	33
PID 2468 wrote to memory of 3020	2468	WaterMark.exe	33
PID 2468 wrote to memory of 3020	2468	WaterMark.exe	33
PID 2468 wrote to memory of 3020	2468	WaterMark.exe	33
PID 2468 wrote to memory of 3020	2468	WaterMark.exe	33
PID 2468 wrote to memory of 2688	2468	WaterMark.exe	34
PID 2468 wrote to memory of 2688	2468	WaterMark.exe	34
PID 2468 wrote to memory of 2688	2468	WaterMark.exe	34
PID 2468 wrote to memory of 2688	2468	WaterMark.exe	34
PID 2468 wrote to memory of 2688	2468	WaterMark.exe	34
PID 2468 wrote to memory of 2688	2468	WaterMark.exe	34
PID 2468 wrote to memory of 2688	2468	WaterMark.exe	34
PID 2468 wrote to memory of 2688	2468	WaterMark.exe	34
PID 2468 wrote to memory of 2688	2468	WaterMark.exe	34
PID 2468 wrote to memory of 2688	2468	WaterMark.exe	34
PID 2688 wrote to memory of 256	2688	svchost.exe	1
PID 2688 wrote to memory of 256	2688	svchost.exe	1
PID 2688 wrote to memory of 256	2688	svchost.exe	1
PID 2688 wrote to memory of 256	2688	svchost.exe	1
PID 2688 wrote to memory of 256	2688	svchost.exe	1
PID 2688 wrote to memory of 332	2688	svchost.exe	2
PID 2688 wrote to memory of 332	2688	svchost.exe	2
PID 2688 wrote to memory of 332	2688	svchost.exe	2
PID 2688 wrote to memory of 332	2688	svchost.exe	2
PID 2688 wrote to memory of 332	2688	svchost.exe	2
PID 2688 wrote to memory of 380	2688	svchost.exe	3
PID 2688 wrote to memory of 380	2688	svchost.exe	3
PID 2688 wrote to memory of 380	2688	svchost.exe	3
PID 2688 wrote to memory of 380	2688	svchost.exe	3
PID 2688 wrote to memory of 380	2688	svchost.exe	3
PID 2688 wrote to memory of 396	2688	svchost.exe	4
PID 2688 wrote to memory of 396	2688	svchost.exe	4
PID 2688 wrote to memory of 396	2688	svchost.exe	4
PID 2688 wrote to memory of 396	2688	svchost.exe	4
PID 2688 wrote to memory of 396	2688	svchost.exe	4
PID 2688 wrote to memory of 432	2688	svchost.exe	5
PID 2688 wrote to memory of 432	2688	svchost.exe	5
PID 2688 wrote to memory of 432	2688	svchost.exe	5
PID 2688 wrote to memory of 432	2688	svchost.exe	5
PID 2688 wrote to memory of 432	2688	svchost.exe	5
PID 2688 wrote to memory of 480	2688	svchost.exe	6
PID 2688 wrote to memory of 480	2688	svchost.exe	6
PID 2688 wrote to memory of 480	2688	svchost.exe	6
PID 2688 wrote to memory of 480	2688	svchost.exe	6

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:380
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:480
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:600
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:996
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1772
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:676
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:752
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:816
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1112
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:864
  - - C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      4⤵
      PID:2724
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:972
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:272
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1048
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1060
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1140
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:764
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2496
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2484
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:488
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:496

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:396

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1188
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a71f243c13e963370b3196b01e53ca4.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\regsvr32.exe
    /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a71f243c13e963370b3196b01e53ca4.dll
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Windows\SysWOW64\regsvr32mgr.exe
      C:\Windows\SysWOW64\regsvr32mgr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:696
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:2468
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:3020
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
259KB

MD5
219046a5ddc513a5b79ea10e964c00ef

SHA1
d533084baadce91d5a04017aeb802f99f6ad0805

SHA256
8d05d72fbbbded49a0066e7986114a1fef49d092664f929cdd49105a4c86471b

SHA512
758237f7e919d9f5defec6498f7b76281832882389bedf34d7bbc60bfc74aec2cedde6f79bc9601c46b2b199458e6c015639688e581bdbcac428ad0b7cf570a0

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
255KB

MD5
62d560c8c95fd0e58144d77d61eaccd7

SHA1
e68d78f23f3ae1a39e61defe8d7f1536d09bac01

SHA256
a0eb0769366af1bfac7e925739a09135a878a510d30109e5976cf317a3407bb2

SHA512
2c17ee03492651ab3ca11264458507b37c20cfa79e8a254a4da82da0a3f7b2c693ede8ca422e5f70498e8abad0f0a56505066e3e68f9f0fe107539fbd4ecfdcf

Download Submit
\Windows\SysWOW64\regsvr32mgr.exe

Filesize
123KB

MD5
802af05d58761292aee899887e81e6bf

SHA1
fd43ce2b6c1e12fcc8c4a75aca419dc57870ddd0

SHA256
cac5028c0bf81944266f6601f5d0bcd4df6340c721d97fc56ad69d89ffdaa307

SHA512
3ca20672e254ebfa22cd0aa73ff12ce894c7dc5fe87b64172d4c41c3f64358804674d3a8d093dd37019aec4be45fb0c0ace4dfc3c09fe9a5f9e642787488210c

Download Submit
memory/696-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/696-11-0x0000000000400000-0x0000000000429F7C-memory.dmp

Filesize
167KB

Download
memory/696-15-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/696-24-0x0000000000050000-0x000000000007A000-memory.dmp

Filesize
168KB

Download
memory/696-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/696-20-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/696-18-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/696-17-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/696-16-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/696-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2468-83-0x000000007762F000-0x0000000077630000-memory.dmp

Filesize
4KB

Download
memory/2468-71-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2468-39-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2468-42-0x000000007762F000-0x0000000077630000-memory.dmp

Filesize
4KB

Download
memory/2468-41-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2468-40-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/2468-630-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2468-31-0x0000000000400000-0x0000000000429F7C-memory.dmp

Filesize
167KB

Download
memory/2468-82-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2524-10-0x0000000000120000-0x000000000014A000-memory.dmp

Filesize
168KB

Download
memory/2524-4-0x0000000000120000-0x000000000014A000-memory.dmp

Filesize
168KB

Download
memory/2524-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/2688-90-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2688-93-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2688-94-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2688-73-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2688-89-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2688-91-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2688-84-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2688-88-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2688-92-0x0000000077630000-0x0000000077631000-memory.dmp

Filesize
4KB

Download
memory/3020-61-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/3020-46-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/3020-65-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/3020-67-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/3020-56-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/3020-367-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/3020-54-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/3020-55-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/3020-44-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download