ramnit | e6fee907c6c145a33a4c51c7b124d6a3dd0929d9a3294ef9cc3f12677bc3d8ff

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-01-2025 16:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68c.exe
Size

241KB
MD5

7abf8011e768d7eb4ff7b840f09ee68c
SHA1

5255d7f19f56572501ad637a23509b40209fcf0d
SHA256

e6fee907c6c145a33a4c51c7b124d6a3dd0929d9a3294ef9cc3f12677bc3d8ff
SHA512

2deaf7818cbc1dc49b6fb50ef59e683773dc4162e5a55ea70387e6797df1f58656880f442475795061922fb51bcf33792f6e18ecc522c254c4651ecb0e5812e9
SSDEEP

3072:enxwgxgfR/DVG7wBpEZyIPgELHJAMxV47wM5RLqnKuKhzP:W+xDVG0BpQBLHbXwrrqKJhzP

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 3 IoCs

pid	Process
2064	JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68cmgr.exe
3032	WaterMark.exe
2136	WaterMark.exe

Loads dropped DLL 6 IoCs

pid	Process
1924	JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68c.exe
1924	JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68c.exe
1924	JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68c.exe
2064	JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68cmgr.exe
1924	JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68c.exe
2064	JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68cmgr.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1924-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1924-11-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1924-10-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1924-9-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3032-87-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2136-84-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3032-46-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1924-28-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2064-27-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2064-26-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/2064-23-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2064-21-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3032-632-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\penchs.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\tpcps.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Printing.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationCore.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationCore.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libmmdevice_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libcache_block_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunec.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\instrument.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libfloat_mixer_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libau_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Defender\MpClient.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libvcd_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mlp_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\PhotoBase.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\mshwjpnr.dll	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\pdm.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxwebkit.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javafx-iio.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-core-processthreads-l1-1-1.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpsychedelic_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MAPISHELL.DLL	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_dummy_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\flyout.html	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationFramework.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libwall_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libinteger_mixer_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Defender\MSASCui.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\journal.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\IACOM2.DLL	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msadcer.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\IA2Marshal.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEOLEDB.DLL	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmiregistry.exe	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationFramework.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libremap_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpCom.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACEINTL.DLL	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libaiff_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\keystore\libfile_keystore_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\mpvis.DLL	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jli.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationTypes.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\axvlc.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradfun_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\RSSFeeds.html	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEWDAT.DLL	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\F12Tools.dll	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68cmgr.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
3032	WaterMark.exe
3032	WaterMark.exe
3032	WaterMark.exe
3032	WaterMark.exe
3032	WaterMark.exe
3032	WaterMark.exe
3032	WaterMark.exe
3032	WaterMark.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe
1724	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3032	WaterMark.exe
Token: SeDebugPrivilege	1724	svchost.exe
Token: SeDebugPrivilege	3032	WaterMark.exe

Suspicious use of UnmapMainImage 4 IoCs

pid	Process
1924	JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68c.exe
2064	JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68cmgr.exe
3032	WaterMark.exe
2136	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2064	1924	JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68c.exe	30
PID 1924 wrote to memory of 2064	1924	JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68c.exe	30
PID 1924 wrote to memory of 2064	1924	JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68c.exe	30
PID 1924 wrote to memory of 2064	1924	JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68c.exe	30
PID 1924 wrote to memory of 3032	1924	JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68c.exe	31
PID 1924 wrote to memory of 3032	1924	JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68c.exe	31
PID 1924 wrote to memory of 3032	1924	JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68c.exe	31
PID 1924 wrote to memory of 3032	1924	JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68c.exe	31
PID 3032 wrote to memory of 2276	3032	WaterMark.exe	33
PID 3032 wrote to memory of 2276	3032	WaterMark.exe	33
PID 3032 wrote to memory of 2276	3032	WaterMark.exe	33
PID 3032 wrote to memory of 2276	3032	WaterMark.exe	33
PID 3032 wrote to memory of 2276	3032	WaterMark.exe	33
PID 3032 wrote to memory of 2276	3032	WaterMark.exe	33
PID 3032 wrote to memory of 2276	3032	WaterMark.exe	33
PID 3032 wrote to memory of 2276	3032	WaterMark.exe	33
PID 3032 wrote to memory of 2276	3032	WaterMark.exe	33
PID 3032 wrote to memory of 2276	3032	WaterMark.exe	33
PID 2064 wrote to memory of 2136	2064	JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68cmgr.exe	32
PID 2064 wrote to memory of 2136	2064	JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68cmgr.exe	32
PID 2064 wrote to memory of 2136	2064	JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68cmgr.exe	32
PID 2064 wrote to memory of 2136	2064	JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68cmgr.exe	32
PID 3032 wrote to memory of 1724	3032	WaterMark.exe	34
PID 3032 wrote to memory of 1724	3032	WaterMark.exe	34
PID 3032 wrote to memory of 1724	3032	WaterMark.exe	34
PID 3032 wrote to memory of 1724	3032	WaterMark.exe	34
PID 3032 wrote to memory of 1724	3032	WaterMark.exe	34
PID 3032 wrote to memory of 1724	3032	WaterMark.exe	34
PID 3032 wrote to memory of 1724	3032	WaterMark.exe	34
PID 3032 wrote to memory of 1724	3032	WaterMark.exe	34
PID 3032 wrote to memory of 1724	3032	WaterMark.exe	34
PID 3032 wrote to memory of 1724	3032	WaterMark.exe	34
PID 1724 wrote to memory of 256	1724	svchost.exe	1
PID 1724 wrote to memory of 256	1724	svchost.exe	1
PID 1724 wrote to memory of 256	1724	svchost.exe	1
PID 1724 wrote to memory of 256	1724	svchost.exe	1
PID 1724 wrote to memory of 256	1724	svchost.exe	1
PID 1724 wrote to memory of 336	1724	svchost.exe	2
PID 1724 wrote to memory of 336	1724	svchost.exe	2
PID 1724 wrote to memory of 336	1724	svchost.exe	2
PID 1724 wrote to memory of 336	1724	svchost.exe	2
PID 1724 wrote to memory of 336	1724	svchost.exe	2
PID 1724 wrote to memory of 384	1724	svchost.exe	3
PID 1724 wrote to memory of 384	1724	svchost.exe	3
PID 1724 wrote to memory of 384	1724	svchost.exe	3
PID 1724 wrote to memory of 384	1724	svchost.exe	3
PID 1724 wrote to memory of 384	1724	svchost.exe	3
PID 1724 wrote to memory of 396	1724	svchost.exe	4
PID 1724 wrote to memory of 396	1724	svchost.exe	4
PID 1724 wrote to memory of 396	1724	svchost.exe	4
PID 1724 wrote to memory of 396	1724	svchost.exe	4
PID 1724 wrote to memory of 396	1724	svchost.exe	4
PID 1724 wrote to memory of 432	1724	svchost.exe	5
PID 1724 wrote to memory of 432	1724	svchost.exe	5
PID 1724 wrote to memory of 432	1724	svchost.exe	5
PID 1724 wrote to memory of 432	1724	svchost.exe	5
PID 1724 wrote to memory of 432	1724	svchost.exe	5
PID 1724 wrote to memory of 480	1724	svchost.exe	6
PID 1724 wrote to memory of 480	1724	svchost.exe	6
PID 1724 wrote to memory of 480	1724	svchost.exe	6
PID 1724 wrote to memory of 480	1724	svchost.exe	6
PID 1724 wrote to memory of 480	1724	svchost.exe	6
PID 1724 wrote to memory of 488	1724	svchost.exe	7
PID 1724 wrote to memory of 488	1724	svchost.exe	7

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:336

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:480
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:608
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1300
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:284
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:688
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:772
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:820
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1168
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:856
  - - C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      4⤵
      PID:1332
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:968
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:108
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:356
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1064
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1108
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1632
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2256
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2980
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:488
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:496

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:396

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68c.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68c.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68cmgr.exe
    C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68cmgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of UnmapMainImage
      PID:2136
- - C:\Program Files (x86)\Microsoft\WaterMark.exe
    "C:\Program Files (x86)\Microsoft\WaterMark.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Drops file in System32 directory
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:2276
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
252KB

MD5
63b2de943cc218b0209ae2d2076e1fc2

SHA1
4ab61f12f23d25165ca31e2cab1a75f38decf414

SHA256
6f2422d566e17587ed3d25dc42abc7a22ed603162678c5d1aafbb068ddd97b9c

SHA512
49a238d137cc5c126ffa61cd139749b0c38dce34221b5e761b822f4f5fad43745cb9d38948cc0bb999a3c73f9d3e964e173e4d59af3e7dbd081d32499bca31f8

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
248KB

MD5
4da788a75ee01477a3ba01d095f2ad7a

SHA1
d54430ed049f35da3cee73e9e0d7a0e240cb856e

SHA256
e15111d1deefb08cb84df3dc2c532343f31f67b5abc13cd7744085dbea68cbd3

SHA512
a10c3153d7da1d1e67f6e1625472f44d2fc7a217d562150b0fcc490e47a652a4acc6cd9490e3e5398e3f829c0b8c45ffc39355b0b2addff9e6f58d035246dae7

Download Submit
\Users\Admin\AppData\Local\Temp\JaffaCakes118_7abf8011e768d7eb4ff7b840f09ee68cmgr.exe

Filesize
119KB

MD5
f73ba2c89c98d47fbd5c5cfb8124e8f6

SHA1
921ed73c5ee6ca1d19f0898aa01be34802a3e423

SHA256
d9095b08e764be81c8ef80c2fa78d8d0536af07ffcf3f6b43a40c9bd62cfbd3e

SHA512
4c0feb70fad08aa3ab4afdafadfc07823d137745c5491f3fcb7a8d6048eb2ef8ffbe605bce07362a649cd600f993c9721b89aa8d7d2a946cca3c68367de4651e

Download Submit
memory/1724-92-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1724-102-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1724-110-0x00000000773D0000-0x00000000773D1000-memory.dmp

Filesize
4KB

Download
memory/1924-14-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1924-11-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1924-9-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1924-13-0x0000000000120000-0x0000000000149000-memory.dmp

Filesize
164KB

Download
memory/1924-0-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1924-32-0x0000000000050000-0x0000000000079000-memory.dmp

Filesize
164KB

Download
memory/1924-28-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1924-4-0x0000000000120000-0x0000000000149000-memory.dmp

Filesize
164KB

Download
memory/1924-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1924-10-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2064-21-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2064-23-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2064-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2064-27-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2136-84-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2136-85-0x0000000000416000-0x0000000000420000-memory.dmp

Filesize
40KB

Download
memory/2136-86-0x0000000000401000-0x0000000000416000-memory.dmp

Filesize
84KB

Download
memory/2276-66-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2276-107-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2276-71-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2276-64-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2276-63-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2276-48-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2276-50-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2276-57-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2276-58-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2276-59-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/3032-90-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/3032-91-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/3032-46-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3032-44-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3032-37-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3032-629-0x00000000773CF000-0x00000000773D0000-memory.dmp

Filesize
4KB

Download
memory/3032-632-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3032-87-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3032-45-0x00000000773CF000-0x00000000773D0000-memory.dmp

Filesize
4KB

Download