ramnit | 27267e680d8fc52082d6f9c9fc7a12d8d2a1466052562c969b666c82dd61252e

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 18:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_f56f756a338e466f4beab48f3e1ec24d.exe
Size

95KB
MD5

f56f756a338e466f4beab48f3e1ec24d
SHA1

51345b181c907d4014bb966ae3c947dd762807c3
SHA256

27267e680d8fc52082d6f9c9fc7a12d8d2a1466052562c969b666c82dd61252e
SHA512

99d5f7dd7ebf65fc0f755bc1732e5e09f4e403e1a7d7f498bed195d9b803ad5efe9290d3146bfa58fdcfad407cdfba679ffc23986bb1d63ede2557de4c275e3e
SSDEEP

768:I06R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9Y:GR0vxn3Pc0LCH9MtbvabUDzJYWu3B

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 1 IoCs

pid	Process
1808	WaterMark.exe

Loads dropped DLL 2 IoCs

pid	Process
1292	JaffaCakes118_f56f756a338e466f4beab48f3e1ec24d.exe
1292	JaffaCakes118_f56f756a338e466f4beab48f3e1ec24d.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1292-4-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1292-3-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1292-2-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1292-1-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1292-8-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1292-7-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1292-9-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1808-27-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1808-28-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1808-70-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1808-599-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\fxplugins.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\MSOINTL.DLL	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\Timeline.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libflacsys_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\settings.html	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\hxdsui.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libgrey_yuv_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\settings.html	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\zip.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\libxml2.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\net.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationCore.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jli.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\orbd.exe	svchost.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ChkrRes.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Engine.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libantiflicker_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\pdm.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_display_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\settings.html	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\tnameserv.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.RunTime.Serialization.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_livehttp_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libscene_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXSLE.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\wab32.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\mpvis.DLL	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\slideShow.html	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\authplay.dll	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-multibyte-l1-1-0.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\librawaud_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DBGHELP.DLL	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\extensibility.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_gather_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuvp_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Utilities.v3.5.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\libntservice_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Mail\WinMail.exe	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\settings.html	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_f56f756a338e466f4beab48f3e1ec24d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
1808	WaterMark.exe
1808	WaterMark.exe
1808	WaterMark.exe
1808	WaterMark.exe
1808	WaterMark.exe
1808	WaterMark.exe
1808	WaterMark.exe
1808	WaterMark.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe
2884	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1808	WaterMark.exe
Token: SeDebugPrivilege	2884	svchost.exe
Token: SeDebugPrivilege	1808	WaterMark.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1292	JaffaCakes118_f56f756a338e466f4beab48f3e1ec24d.exe
1808	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 1808	1292	JaffaCakes118_f56f756a338e466f4beab48f3e1ec24d.exe	30
PID 1292 wrote to memory of 1808	1292	JaffaCakes118_f56f756a338e466f4beab48f3e1ec24d.exe	30
PID 1292 wrote to memory of 1808	1292	JaffaCakes118_f56f756a338e466f4beab48f3e1ec24d.exe	30
PID 1292 wrote to memory of 1808	1292	JaffaCakes118_f56f756a338e466f4beab48f3e1ec24d.exe	30
PID 1808 wrote to memory of 2288	1808	WaterMark.exe	31
PID 1808 wrote to memory of 2288	1808	WaterMark.exe	31
PID 1808 wrote to memory of 2288	1808	WaterMark.exe	31
PID 1808 wrote to memory of 2288	1808	WaterMark.exe	31
PID 1808 wrote to memory of 2288	1808	WaterMark.exe	31
PID 1808 wrote to memory of 2288	1808	WaterMark.exe	31
PID 1808 wrote to memory of 2288	1808	WaterMark.exe	31
PID 1808 wrote to memory of 2288	1808	WaterMark.exe	31
PID 1808 wrote to memory of 2288	1808	WaterMark.exe	31
PID 1808 wrote to memory of 2288	1808	WaterMark.exe	31
PID 1808 wrote to memory of 2884	1808	WaterMark.exe	32
PID 1808 wrote to memory of 2884	1808	WaterMark.exe	32
PID 1808 wrote to memory of 2884	1808	WaterMark.exe	32
PID 1808 wrote to memory of 2884	1808	WaterMark.exe	32
PID 1808 wrote to memory of 2884	1808	WaterMark.exe	32
PID 1808 wrote to memory of 2884	1808	WaterMark.exe	32
PID 1808 wrote to memory of 2884	1808	WaterMark.exe	32
PID 1808 wrote to memory of 2884	1808	WaterMark.exe	32
PID 1808 wrote to memory of 2884	1808	WaterMark.exe	32
PID 1808 wrote to memory of 2884	1808	WaterMark.exe	32
PID 2884 wrote to memory of 256	2884	svchost.exe	1
PID 2884 wrote to memory of 256	2884	svchost.exe	1
PID 2884 wrote to memory of 256	2884	svchost.exe	1
PID 2884 wrote to memory of 256	2884	svchost.exe	1
PID 2884 wrote to memory of 256	2884	svchost.exe	1
PID 2884 wrote to memory of 332	2884	svchost.exe	2
PID 2884 wrote to memory of 332	2884	svchost.exe	2
PID 2884 wrote to memory of 332	2884	svchost.exe	2
PID 2884 wrote to memory of 332	2884	svchost.exe	2
PID 2884 wrote to memory of 332	2884	svchost.exe	2
PID 2884 wrote to memory of 384	2884	svchost.exe	3
PID 2884 wrote to memory of 384	2884	svchost.exe	3
PID 2884 wrote to memory of 384	2884	svchost.exe	3
PID 2884 wrote to memory of 384	2884	svchost.exe	3
PID 2884 wrote to memory of 384	2884	svchost.exe	3
PID 2884 wrote to memory of 392	2884	svchost.exe	4
PID 2884 wrote to memory of 392	2884	svchost.exe	4
PID 2884 wrote to memory of 392	2884	svchost.exe	4
PID 2884 wrote to memory of 392	2884	svchost.exe	4
PID 2884 wrote to memory of 392	2884	svchost.exe	4
PID 2884 wrote to memory of 432	2884	svchost.exe	5
PID 2884 wrote to memory of 432	2884	svchost.exe	5
PID 2884 wrote to memory of 432	2884	svchost.exe	5
PID 2884 wrote to memory of 432	2884	svchost.exe	5
PID 2884 wrote to memory of 432	2884	svchost.exe	5
PID 2884 wrote to memory of 476	2884	svchost.exe	6
PID 2884 wrote to memory of 476	2884	svchost.exe	6
PID 2884 wrote to memory of 476	2884	svchost.exe	6
PID 2884 wrote to memory of 476	2884	svchost.exe	6
PID 2884 wrote to memory of 476	2884	svchost.exe	6
PID 2884 wrote to memory of 492	2884	svchost.exe	7
PID 2884 wrote to memory of 492	2884	svchost.exe	7
PID 2884 wrote to memory of 492	2884	svchost.exe	7
PID 2884 wrote to memory of 492	2884	svchost.exe	7
PID 2884 wrote to memory of 492	2884	svchost.exe	7
PID 2884 wrote to memory of 500	2884	svchost.exe	8
PID 2884 wrote to memory of 500	2884	svchost.exe	8
PID 2884 wrote to memory of 500	2884	svchost.exe	8
PID 2884 wrote to memory of 500	2884	svchost.exe	8
PID 2884 wrote to memory of 500	2884	svchost.exe	8

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:612
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:812
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1288
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:688
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:768
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:820
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1176
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:860
  - - C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      4⤵
      PID:2420
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:976
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:296
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:920
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1080
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1120
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1572
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2232
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2280
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:492
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:392

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f56f756a338e466f4beab48f3e1ec24d.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f56f756a338e466f4beab48f3e1ec24d.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Program Files (x86)\Microsoft\WaterMark.exe
    "C:\Program Files (x86)\Microsoft\WaterMark.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Drops file in System32 directory
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:2288
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
204KB

MD5
8021bdf7cf4967b8fed040a858b69450

SHA1
2a473d1f7fd94447371081f36b5e8839cc4fc6e5

SHA256
7c5b266a7ac67fc2ae74176330d5339796553ccd15d7d16bd6e285d961e0dc76

SHA512
2578175bc9a4ccb65c746eeb936fd032208ad24714096aab17bd0bd49050e5c0bb2c3cc71470fde5ebf5440e3596367de0709b2b952c9f3b0de36c20bd538143

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
200KB

MD5
61fb195bc7f045b85c511554e25f5d7c

SHA1
2313f3b5cb850123b07107b48b387bb0a57a8ee3

SHA256
465503f1257f115d60a7c657fa4224a6d12c2dfe6351f1bf5970b4715321afcb

SHA512
76b49fa5c67f9977562526a7362c0e8cf9b4efe51b2e05348e823416997308d259758c166e01dbe75c90b39950f8d8c79a52590e45e83d732d6ff9723a84018b

Download Submit
\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
95KB

MD5
f56f756a338e466f4beab48f3e1ec24d

SHA1
51345b181c907d4014bb966ae3c947dd762807c3

SHA256
27267e680d8fc52082d6f9c9fc7a12d8d2a1466052562c969b666c82dd61252e

SHA512
99d5f7dd7ebf65fc0f755bc1732e5e09f4e403e1a7d7f498bed195d9b803ad5efe9290d3146bfa58fdcfad407cdfba679ffc23986bb1d63ede2557de4c275e3e

Download Submit
memory/1292-8-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1292-1-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1292-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1292-7-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1292-9-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1292-6-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/1292-2-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1292-4-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1292-3-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1808-30-0x00000000772CF000-0x00000000772D0000-memory.dmp

Filesize
4KB

Download
memory/1808-29-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/1808-28-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1808-27-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1808-599-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1808-76-0x00000000772CF000-0x00000000772D0000-memory.dmp

Filesize
4KB

Download
memory/1808-70-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1808-59-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/1808-31-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2288-34-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2288-336-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2288-54-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2288-41-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2288-50-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2288-42-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2288-48-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2288-43-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2288-47-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2288-32-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2884-81-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2884-78-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2884-77-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2884-75-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2884-80-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2884-79-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2884-82-0x00000000772D0000-0x00000000772D1000-memory.dmp

Filesize
4KB

Download
memory/2884-71-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2884-61-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download