ramnit | 7d303510d1eb72e62f8cc5978e1dbfed7d789cd701bf8a1b8dd7864db953edd0

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-01-2025 06:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_14ad43217a55a86f51b05be8f0bf574b.dll
Size

211KB
MD5

14ad43217a55a86f51b05be8f0bf574b
SHA1

999cfe432875832d12820162c13a40f32c4754fc
SHA256

7d303510d1eb72e62f8cc5978e1dbfed7d789cd701bf8a1b8dd7864db953edd0
SHA512

1cd04c3f3fb7e343d181bba8f0cc31bbb1378a57ad95d8d28eab2dcfdfa6f317bef03ce71593fded91c2f38d0fb22d35beb980654c8ef6442a125a8aa6856118
SSDEEP

1536:FkWv+m3NWbVQqtfTsbgrlNBPFsdaOjTCsD1nzf/9r:FkTm3NWbVQqxob6uTDBzVr

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 2 IoCs

pid	Process
2536	regsvr32mgr.exe
2320	WaterMark.exe

Loads dropped DLL 4 IoCs

pid	Process
2148	regsvr32.exe
2148	regsvr32.exe
2536	regsvr32mgr.exe
2536	regsvr32mgr.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\regsvr32mgr.exe	regsvr32.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2320-40-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2536-18-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2536-17-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2536-20-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2536-15-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2536-14-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2536-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2536-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2320-83-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2320-641-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2536-3541-0x0000000000430000-0x00000000004BD000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libtransform_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	svchost.exe
File opened for modification	C:\Program Files\Windows Mail\msoe.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_10_p010_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\settings.html	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\ITIRCL55.DLL	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msadds.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_rtp_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-runtime-l1-1-0.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationCore.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\libarchive_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\EURO\MSOEURO.DLL	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACER3X.DLL	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Design.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libdirectory_demux_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Design.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\logger\libfile_logger_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\Microsoft.Ink.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODEXL.DLL	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\freebl3.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Design.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\calendar.html	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javaws.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\msvcr100.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2iexp.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\JAWTAccessBridge-64.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\hxdsui.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\calendar.html	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\MCESidebarCtrl.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\Microsoft.Ink.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\t2k.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\ucrtbase.dll	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\mozglue.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libd3d11va_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\picturePuzzle.html	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACECORE.DLL	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javafx-iio.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Defender\MpRTP.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\CoolType.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Selectors.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudio_format_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\settings.html	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2320	WaterMark.exe
2320	WaterMark.exe
2320	WaterMark.exe
2320	WaterMark.exe
2320	WaterMark.exe
2320	WaterMark.exe
2320	WaterMark.exe
2320	WaterMark.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe
2736	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2320	WaterMark.exe
Token: SeDebugPrivilege	2736	svchost.exe
Token: SeDebugPrivilege	2320	WaterMark.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2536	regsvr32mgr.exe
2320	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2148	2068	regsvr32.exe	30
PID 2068 wrote to memory of 2148	2068	regsvr32.exe	30
PID 2068 wrote to memory of 2148	2068	regsvr32.exe	30
PID 2068 wrote to memory of 2148	2068	regsvr32.exe	30
PID 2068 wrote to memory of 2148	2068	regsvr32.exe	30
PID 2068 wrote to memory of 2148	2068	regsvr32.exe	30
PID 2068 wrote to memory of 2148	2068	regsvr32.exe	30
PID 2148 wrote to memory of 2536	2148	regsvr32.exe	31
PID 2148 wrote to memory of 2536	2148	regsvr32.exe	31
PID 2148 wrote to memory of 2536	2148	regsvr32.exe	31
PID 2148 wrote to memory of 2536	2148	regsvr32.exe	31
PID 2536 wrote to memory of 2320	2536	regsvr32mgr.exe	32
PID 2536 wrote to memory of 2320	2536	regsvr32mgr.exe	32
PID 2536 wrote to memory of 2320	2536	regsvr32mgr.exe	32
PID 2536 wrote to memory of 2320	2536	regsvr32mgr.exe	32
PID 2320 wrote to memory of 2828	2320	WaterMark.exe	33
PID 2320 wrote to memory of 2828	2320	WaterMark.exe	33
PID 2320 wrote to memory of 2828	2320	WaterMark.exe	33
PID 2320 wrote to memory of 2828	2320	WaterMark.exe	33
PID 2320 wrote to memory of 2828	2320	WaterMark.exe	33
PID 2320 wrote to memory of 2828	2320	WaterMark.exe	33
PID 2320 wrote to memory of 2828	2320	WaterMark.exe	33
PID 2320 wrote to memory of 2828	2320	WaterMark.exe	33
PID 2320 wrote to memory of 2828	2320	WaterMark.exe	33
PID 2320 wrote to memory of 2828	2320	WaterMark.exe	33
PID 2320 wrote to memory of 2736	2320	WaterMark.exe	35
PID 2320 wrote to memory of 2736	2320	WaterMark.exe	35
PID 2320 wrote to memory of 2736	2320	WaterMark.exe	35
PID 2320 wrote to memory of 2736	2320	WaterMark.exe	35
PID 2320 wrote to memory of 2736	2320	WaterMark.exe	35
PID 2320 wrote to memory of 2736	2320	WaterMark.exe	35
PID 2320 wrote to memory of 2736	2320	WaterMark.exe	35
PID 2320 wrote to memory of 2736	2320	WaterMark.exe	35
PID 2320 wrote to memory of 2736	2320	WaterMark.exe	35
PID 2320 wrote to memory of 2736	2320	WaterMark.exe	35
PID 2736 wrote to memory of 256	2736	svchost.exe	1
PID 2736 wrote to memory of 256	2736	svchost.exe	1
PID 2736 wrote to memory of 256	2736	svchost.exe	1
PID 2736 wrote to memory of 256	2736	svchost.exe	1
PID 2736 wrote to memory of 256	2736	svchost.exe	1
PID 2736 wrote to memory of 332	2736	svchost.exe	2
PID 2736 wrote to memory of 332	2736	svchost.exe	2
PID 2736 wrote to memory of 332	2736	svchost.exe	2
PID 2736 wrote to memory of 332	2736	svchost.exe	2
PID 2736 wrote to memory of 332	2736	svchost.exe	2
PID 2736 wrote to memory of 380	2736	svchost.exe	3
PID 2736 wrote to memory of 380	2736	svchost.exe	3
PID 2736 wrote to memory of 380	2736	svchost.exe	3
PID 2736 wrote to memory of 380	2736	svchost.exe	3
PID 2736 wrote to memory of 380	2736	svchost.exe	3
PID 2736 wrote to memory of 400	2736	svchost.exe	4
PID 2736 wrote to memory of 400	2736	svchost.exe	4
PID 2736 wrote to memory of 400	2736	svchost.exe	4
PID 2736 wrote to memory of 400	2736	svchost.exe	4
PID 2736 wrote to memory of 400	2736	svchost.exe	4
PID 2736 wrote to memory of 436	2736	svchost.exe	5
PID 2736 wrote to memory of 436	2736	svchost.exe	5
PID 2736 wrote to memory of 436	2736	svchost.exe	5
PID 2736 wrote to memory of 436	2736	svchost.exe	5
PID 2736 wrote to memory of 436	2736	svchost.exe	5
PID 2736 wrote to memory of 480	2736	svchost.exe	6
PID 2736 wrote to memory of 480	2736	svchost.exe	6
PID 2736 wrote to memory of 480	2736	svchost.exe	6
PID 2736 wrote to memory of 480	2736	svchost.exe	6

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:380
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:480
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:596
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:500
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1940
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:676
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:756
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:820
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1172
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:856
  - - C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      4⤵
      PID:2620
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:968
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:276
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:108
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1032
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1116
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1788
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2384
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:1728
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:496
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:504

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:400

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:436

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1236
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_14ad43217a55a86f51b05be8f0bf574b.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\SysWOW64\regsvr32.exe
    /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_14ad43217a55a86f51b05be8f0bf574b.dll
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Windows\SysWOW64\regsvr32mgr.exe
      C:\Windows\SysWOW64\regsvr32mgr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:2536
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:2320
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:2828
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
422KB

MD5
298ce678928f24034b3257010d0e2620

SHA1
ee8805d599188e3f768919602a3cc531688d02e7

SHA256
0e617289e06813ac96cf64009ee9455988aedb7275667f09cf592fffc71053d5

SHA512
41961cb573d137f1c67b7770c2d8f2dfd0c1a8b8ab068ae25bc26b7304f685b2137cebe6b35ff8796682bc37baf0097d5eca67faab5e0877bb36c48dec28ee21

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
418KB

MD5
68bdd3be97d024aee6ca9a86b60400e1

SHA1
28bb7aa1e5333932fe4d68d5fe7120e81d12cbee

SHA256
72cfeaf726509b5fb86beb022984dcbfc254b6125cbf1914808876978f2c3475

SHA512
a9dc3f67c8bba52e3eae7a14c4305a22b4b8f897e7131cfb424bacd524483c7672bd6b7e2313784ce0d4ca4046c6a8ff59c7f1f340facb28210d1d92c47f14ea

Download Submit
C:\Windows\SysWOW64\regsvr32mgr.exe

Filesize
204KB

MD5
2adc5366ba8cb74ff49d3ce3ec5a79c8

SHA1
3b6540f48f0c77d609ad5938158afd7a8f4d5155

SHA256
38f30d351ad68266118057ef971bd45af0d6a02fbd27c90da108e6c75bb07490

SHA512
07f09ee289b6d15357b66c4600eeb14cb07b7af231ebe56d45ce31879cce80427486c01c4becfce162a3ba7c05c3f96783e20f75fe0a08871fb44f1e75f10722

Download Submit
memory/2148-9-0x0000000000530000-0x00000000005BD000-memory.dmp

Filesize
564KB

Download
memory/2148-8-0x0000000000530000-0x00000000005BD000-memory.dmp

Filesize
564KB

Download
memory/2148-1-0x0000000074FC0000-0x0000000074FF9000-memory.dmp

Filesize
228KB

Download
memory/2320-40-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2320-35-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2320-72-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2320-641-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2320-83-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2320-86-0x00000000779EF000-0x00000000779F0000-memory.dmp

Filesize
4KB

Download
memory/2320-42-0x00000000779EF000-0x00000000779F0000-memory.dmp

Filesize
4KB

Download
memory/2320-41-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2536-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2536-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2536-11-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/2536-20-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2536-3541-0x0000000000430000-0x00000000004BD000-memory.dmp

Filesize
564KB

Download
memory/2536-17-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2536-16-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2536-18-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2536-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2536-15-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2736-93-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2736-92-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2736-91-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2736-74-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2736-90-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2736-94-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2736-84-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2736-89-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2736-95-0x00000000779F0000-0x00000000779F1000-memory.dmp

Filesize
4KB

Download
memory/2828-46-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2828-55-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2828-61-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2828-63-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2828-68-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2828-378-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2828-56-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2828-60-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/2828-54-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/2828-44-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download