ramnit | 2a183891c79b8856f1e08c70d779b10f4bac309fc5dfd2c2c79eb51fe6269c97

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-01-2025 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_c6c1ab7b686d51ec291e850324485acd.exe
Size

92KB
MD5

c6c1ab7b686d51ec291e850324485acd
SHA1

5f7345c765692e2b7e1d7cff2f27c7a082c31e54
SHA256

2a183891c79b8856f1e08c70d779b10f4bac309fc5dfd2c2c79eb51fe6269c97
SHA512

6585e8162783c13d19ca9a6754223e83b18eb9e492df1feb3aa663984977bc8ffa55482e0d5189d566c2a601132cfa43be0fe2a245d607520bcb11cbffc32197
SSDEEP

1536:zVZnxm6MG9xgfrvEaoiT/GyphjXDYjKwttoswRmhApE:rnxwgxgfR/DVG7wBpE

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 1 IoCs

pid	Process
836	WaterMark.exe

Loads dropped DLL 2 IoCs

pid	Process
2028	JaffaCakes118_c6c1ab7b686d51ec291e850324485acd.exe
2028	JaffaCakes118_c6c1ab7b686d51ec291e850324485acd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2028-3-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2028-2-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2028-9-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2028-7-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2028-6-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2028-4-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2028-20-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/836-29-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/836-30-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/836-72-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/836-608-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationBuildTasks.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_description_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmirror_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\IA2Marshal.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsFormsIntegration.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.DataSetExtensions.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libwingdi_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\instrument.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Management.Instrumentation.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libscreen_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_sse2_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Defender\MpOAV.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\calendar.html	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dcpr.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_a52_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\slideShow.html	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Management.Instrumentation.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_nv12_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ViewerPS.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html	svchost.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\ShvlRes.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Journal\InkSeg.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\calendar.html	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1655.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l2-1-0.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libnsc_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\setup_wm.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msador15.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jfxmedia.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Design.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libamem_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libswscale_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\settings.html	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Design.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	svchost.exe
File opened for modification	C:\Program Files\Windows Defender\MpAsDesc.dll	svchost.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\wordpad.exe	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\settings.html	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\README.html	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jfr.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\profilerinterface.dll	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c6c1ab7b686d51ec291e850324485acd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
836	WaterMark.exe
836	WaterMark.exe
836	WaterMark.exe
836	WaterMark.exe
836	WaterMark.exe
836	WaterMark.exe
836	WaterMark.exe
836	WaterMark.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe
2796	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	836	WaterMark.exe
Token: SeDebugPrivilege	2796	svchost.exe
Token: SeDebugPrivilege	836	WaterMark.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2028	JaffaCakes118_c6c1ab7b686d51ec291e850324485acd.exe
836	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 836	2028	JaffaCakes118_c6c1ab7b686d51ec291e850324485acd.exe	31
PID 2028 wrote to memory of 836	2028	JaffaCakes118_c6c1ab7b686d51ec291e850324485acd.exe	31
PID 2028 wrote to memory of 836	2028	JaffaCakes118_c6c1ab7b686d51ec291e850324485acd.exe	31
PID 2028 wrote to memory of 836	2028	JaffaCakes118_c6c1ab7b686d51ec291e850324485acd.exe	31
PID 836 wrote to memory of 2000	836	WaterMark.exe	32
PID 836 wrote to memory of 2000	836	WaterMark.exe	32
PID 836 wrote to memory of 2000	836	WaterMark.exe	32
PID 836 wrote to memory of 2000	836	WaterMark.exe	32
PID 836 wrote to memory of 2000	836	WaterMark.exe	32
PID 836 wrote to memory of 2000	836	WaterMark.exe	32
PID 836 wrote to memory of 2000	836	WaterMark.exe	32
PID 836 wrote to memory of 2000	836	WaterMark.exe	32
PID 836 wrote to memory of 2000	836	WaterMark.exe	32
PID 836 wrote to memory of 2000	836	WaterMark.exe	32
PID 836 wrote to memory of 2796	836	WaterMark.exe	33
PID 836 wrote to memory of 2796	836	WaterMark.exe	33
PID 836 wrote to memory of 2796	836	WaterMark.exe	33
PID 836 wrote to memory of 2796	836	WaterMark.exe	33
PID 836 wrote to memory of 2796	836	WaterMark.exe	33
PID 836 wrote to memory of 2796	836	WaterMark.exe	33
PID 836 wrote to memory of 2796	836	WaterMark.exe	33
PID 836 wrote to memory of 2796	836	WaterMark.exe	33
PID 836 wrote to memory of 2796	836	WaterMark.exe	33
PID 836 wrote to memory of 2796	836	WaterMark.exe	33
PID 2796 wrote to memory of 256	2796	svchost.exe	1
PID 2796 wrote to memory of 256	2796	svchost.exe	1
PID 2796 wrote to memory of 256	2796	svchost.exe	1
PID 2796 wrote to memory of 256	2796	svchost.exe	1
PID 2796 wrote to memory of 256	2796	svchost.exe	1
PID 2796 wrote to memory of 332	2796	svchost.exe	2
PID 2796 wrote to memory of 332	2796	svchost.exe	2
PID 2796 wrote to memory of 332	2796	svchost.exe	2
PID 2796 wrote to memory of 332	2796	svchost.exe	2
PID 2796 wrote to memory of 332	2796	svchost.exe	2
PID 2796 wrote to memory of 380	2796	svchost.exe	3
PID 2796 wrote to memory of 380	2796	svchost.exe	3
PID 2796 wrote to memory of 380	2796	svchost.exe	3
PID 2796 wrote to memory of 380	2796	svchost.exe	3
PID 2796 wrote to memory of 380	2796	svchost.exe	3
PID 2796 wrote to memory of 392	2796	svchost.exe	4
PID 2796 wrote to memory of 392	2796	svchost.exe	4
PID 2796 wrote to memory of 392	2796	svchost.exe	4
PID 2796 wrote to memory of 392	2796	svchost.exe	4
PID 2796 wrote to memory of 392	2796	svchost.exe	4
PID 2796 wrote to memory of 428	2796	svchost.exe	5
PID 2796 wrote to memory of 428	2796	svchost.exe	5
PID 2796 wrote to memory of 428	2796	svchost.exe	5
PID 2796 wrote to memory of 428	2796	svchost.exe	5
PID 2796 wrote to memory of 428	2796	svchost.exe	5
PID 2796 wrote to memory of 476	2796	svchost.exe	6
PID 2796 wrote to memory of 476	2796	svchost.exe	6
PID 2796 wrote to memory of 476	2796	svchost.exe	6
PID 2796 wrote to memory of 476	2796	svchost.exe	6
PID 2796 wrote to memory of 476	2796	svchost.exe	6
PID 2796 wrote to memory of 484	2796	svchost.exe	7
PID 2796 wrote to memory of 484	2796	svchost.exe	7
PID 2796 wrote to memory of 484	2796	svchost.exe	7
PID 2796 wrote to memory of 484	2796	svchost.exe	7
PID 2796 wrote to memory of 484	2796	svchost.exe	7
PID 2796 wrote to memory of 492	2796	svchost.exe	8
PID 2796 wrote to memory of 492	2796	svchost.exe	8
PID 2796 wrote to memory of 492	2796	svchost.exe	8
PID 2796 wrote to memory of 492	2796	svchost.exe	8
PID 2796 wrote to memory of 492	2796	svchost.exe	8

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:380
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:600
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:992
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1756
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe -Embedding
      4⤵
      PID:1008
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:680
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:756
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:816
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1096
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:856
  - - \\?\C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      4⤵
      PID:1824
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:964
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:268
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1040
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1068
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1132
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:768
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2560
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2284
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:484
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:492

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:428

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1172
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c6c1ab7b686d51ec291e850324485acd.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c6c1ab7b686d51ec291e850324485acd.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Program Files (x86)\Microsoft\WaterMark.exe
    "C:\Program Files (x86)\Microsoft\WaterMark.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:836
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Drops file in System32 directory
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:2000
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
92KB

MD5
c6c1ab7b686d51ec291e850324485acd

SHA1
5f7345c765692e2b7e1d7cff2f27c7a082c31e54

SHA256
2a183891c79b8856f1e08c70d779b10f4bac309fc5dfd2c2c79eb51fe6269c97

SHA512
6585e8162783c13d19ca9a6754223e83b18eb9e492df1feb3aa663984977bc8ffa55482e0d5189d566c2a601132cfa43be0fe2a245d607520bcb11cbffc32197

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
197KB

MD5
e295384be3d74ae32d39b8aa1513a927

SHA1
d209f9a0fcf28510b1098664459478ca62e87419

SHA256
b28f0153820aaf494cb57de60d8ed89cfcd1d317695945fa642a9ad5c00657f5

SHA512
5ee70aa52beacfd7f4e4cd5ce5bc9625e4b4c7c3c33f2ed73b5d032a070a768aab2a97565aadd43d3823da3318a4155c9c662966ecf85bf66253aa5af49aa4e2

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
193KB

MD5
0843f233436db5eb7cc31732ea7c2968

SHA1
d71bd3dd222d4d59b342fef0630160e83b3b83f1

SHA256
3a6245df8a1832cf9b62307f873faa92731a83222d8add47484e6fbb3e84cbb4

SHA512
ac06dfccc5c7a3d3113fa2240895a0ac52a912591683e1355826861ee8f5b0f442b1d626d7038292e8e28e55bbc014c4ac32038cd81c53b6b1fc9f0658c313ad

Download Submit
memory/836-33-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/836-31-0x0000000000050000-0x0000000000051000-memory.dmp

Filesize
4KB

Download
memory/836-72-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/836-83-0x000000007766F000-0x0000000077670000-memory.dmp

Filesize
4KB

Download
memory/836-61-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/836-30-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/836-608-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/836-32-0x000000007766F000-0x0000000077670000-memory.dmp

Filesize
4KB

Download
memory/836-29-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2000-57-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2000-52-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2000-345-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2000-45-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2000-34-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2000-36-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2000-44-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2000-43-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2000-49-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2000-50-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2028-20-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2028-6-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2028-14-0x0000000000890000-0x0000000000913000-memory.dmp

Filesize
524KB

Download
memory/2028-1-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2028-3-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2028-2-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2028-9-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2028-4-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2028-7-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2028-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2796-81-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2796-79-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2796-78-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2796-73-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2796-80-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2796-82-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2796-84-0x0000000077670000-0x0000000077671000-memory.dmp

Filesize
4KB

Download
memory/2796-77-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2796-63-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download