ramnit | 02d2d004f30e2022c652cb1e92b92ed5326cb5d0c49a3983bdcb480ae6012fe9

Analysis

max time kernel
26s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-02-2025 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_b80f7658ffb704350faf5060b1d92d66.dll
Size

424KB
MD5

b80f7658ffb704350faf5060b1d92d66
SHA1

2ad9d0776d0e38c306af1d40660045b1a98a8f04
SHA256

02d2d004f30e2022c652cb1e92b92ed5326cb5d0c49a3983bdcb480ae6012fe9
SHA512

61d95373a6d46c36e35b4f32d412440f54c9eecbaf04d596cd3da9b9144b0470588c241199ad2e08bd423d955e0a68ff7ee113bfcce9d82f759dc6dcc1709d1d
SSDEEP

6144:vl9XgnzxOP/sFR2h+9q1kih6ibUxrp3/vIyR5fih8JRmlM+9ZldLIsIyNk2uu6:vlCzcMg+9YkDiQ3/Q8Jud9f9jhuT

Score

10^/10

ramnit sality backdoor banker defense_evasion discovery persistence privilege_escalation spyware stealer trojan upx worm

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit
Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Sality family
sality

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WaterMark.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32mgr.exe

Disables RegEdit via registry modification 3 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	rundll32mgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	WaterMark.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	IEXPLORE.EXE

Disables Task Manager via registry modification
defense_evasion

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4420	netsh.exe
4892	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
4848	rundll32mgr.exe
3020	WaterMark.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32mgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WaterMark.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4848-6-0x0000000003580000-0x00000000045B0000-memory.dmp	upx
behavioral2/memory/4848-8-0x0000000003580000-0x00000000045B0000-memory.dmp	upx
behavioral2/memory/4848-33-0x0000000003580000-0x00000000045B0000-memory.dmp	upx
behavioral2/memory/4848-17-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4848-9-0x0000000003580000-0x00000000045B0000-memory.dmp	upx
behavioral2/memory/4848-18-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4848-16-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4848-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4848-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4848-11-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4848-10-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3020-57-0x0000000003190000-0x00000000041C0000-memory.dmp	upx
behavioral2/memory/3020-62-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3020-42-0x0000000003190000-0x00000000041C0000-memory.dmp	upx
behavioral2/memory/3020-44-0x0000000003190000-0x00000000041C0000-memory.dmp	upx
behavioral2/memory/3020-69-0x0000000003190000-0x00000000041C0000-memory.dmp	upx
behavioral2/memory/3020-71-0x0000000003190000-0x00000000041C0000-memory.dmp	upx
behavioral2/memory/3020-87-0x0000000003190000-0x00000000041C0000-memory.dmp	upx
behavioral2/memory/3020-89-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3020-91-0x0000000003190000-0x00000000041C0000-memory.dmp	upx
behavioral2/memory/3020-95-0x0000000003190000-0x00000000041C0000-memory.dmp	upx
behavioral2/memory/3020-118-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3020-119-0x0000000003190000-0x00000000041C0000-memory.dmp	upx

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\px903A.tmp	rundll32mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	WaterMark.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	WaterMark.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	WaterMark.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	rundll32mgr.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4264	4984	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BC296663-E55F-11EF-ADF2-4A034D48373C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BC24A083-E55F-11EF-ADF2-4A034D48373C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4848	rundll32mgr.exe
4848	rundll32mgr.exe
3020	WaterMark.exe
3020	WaterMark.exe
3020	WaterMark.exe
3020	WaterMark.exe
3020	WaterMark.exe
3020	WaterMark.exe
3020	WaterMark.exe
3020	WaterMark.exe
3020	WaterMark.exe
3020	WaterMark.exe
3020	WaterMark.exe
3020	WaterMark.exe
3020	WaterMark.exe
3020	WaterMark.exe
3020	WaterMark.exe
3020	WaterMark.exe
3020	WaterMark.exe
3020	WaterMark.exe
3020	WaterMark.exe
3020	WaterMark.exe
3416	IEXPLORE.EXE
3416	IEXPLORE.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe
Token: SeDebugPrivilege	4848	rundll32mgr.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4436	iexplore.exe
2212	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4436	iexplore.exe
4436	iexplore.exe
2212	iexplore.exe
2212	iexplore.exe
4588	IEXPLORE.EXE
4588	IEXPLORE.EXE
3416	IEXPLORE.EXE
3416	IEXPLORE.EXE
4588	IEXPLORE.EXE
4588	IEXPLORE.EXE

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4848	rundll32mgr.exe
3020	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 4984	1856	rundll32.exe	84
PID 1856 wrote to memory of 4984	1856	rundll32.exe	84
PID 1856 wrote to memory of 4984	1856	rundll32.exe	84
PID 4984 wrote to memory of 4848	4984	rundll32.exe	85
PID 4984 wrote to memory of 4848	4984	rundll32.exe	85
PID 4984 wrote to memory of 4848	4984	rundll32.exe	85
PID 4848 wrote to memory of 772	4848	rundll32mgr.exe	8
PID 4848 wrote to memory of 780	4848	rundll32mgr.exe	9
PID 4848 wrote to memory of 376	4848	rundll32mgr.exe	13
PID 4848 wrote to memory of 2896	4848	rundll32mgr.exe	50
PID 4848 wrote to memory of 2960	4848	rundll32mgr.exe	51
PID 4848 wrote to memory of 2376	4848	rundll32mgr.exe	52
PID 4848 wrote to memory of 3376	4848	rundll32mgr.exe	56
PID 4848 wrote to memory of 3560	4848	rundll32mgr.exe	57
PID 4848 wrote to memory of 3756	4848	rundll32mgr.exe	58
PID 4848 wrote to memory of 3856	4848	rundll32mgr.exe	59
PID 4848 wrote to memory of 3920	4848	rundll32mgr.exe	60
PID 4848 wrote to memory of 4016	4848	rundll32mgr.exe	61
PID 4848 wrote to memory of 4136	4848	rundll32mgr.exe	62
PID 4848 wrote to memory of 1604	4848	rundll32mgr.exe	74
PID 4848 wrote to memory of 2160	4848	rundll32mgr.exe	76
PID 4848 wrote to memory of 752	4848	rundll32mgr.exe	77
PID 4848 wrote to memory of 2140	4848	rundll32mgr.exe	78
PID 4848 wrote to memory of 1856	4848	rundll32mgr.exe	83
PID 4848 wrote to memory of 4984	4848	rundll32mgr.exe	84
PID 4848 wrote to memory of 4984	4848	rundll32mgr.exe	84
PID 4848 wrote to memory of 3020	4848	rundll32mgr.exe	87
PID 4848 wrote to memory of 3020	4848	rundll32mgr.exe	87
PID 4848 wrote to memory of 3020	4848	rundll32mgr.exe	87
PID 3020 wrote to memory of 772	3020	WaterMark.exe	8
PID 3020 wrote to memory of 780	3020	WaterMark.exe	9
PID 3020 wrote to memory of 376	3020	WaterMark.exe	13
PID 3020 wrote to memory of 2896	3020	WaterMark.exe	50
PID 3020 wrote to memory of 2960	3020	WaterMark.exe	51
PID 3020 wrote to memory of 2376	3020	WaterMark.exe	52
PID 3020 wrote to memory of 3376	3020	WaterMark.exe	56
PID 3020 wrote to memory of 3560	3020	WaterMark.exe	57
PID 3020 wrote to memory of 3756	3020	WaterMark.exe	58
PID 3020 wrote to memory of 3856	3020	WaterMark.exe	59
PID 3020 wrote to memory of 3920	3020	WaterMark.exe	60
PID 3020 wrote to memory of 4016	3020	WaterMark.exe	61
PID 3020 wrote to memory of 4136	3020	WaterMark.exe	62
PID 3020 wrote to memory of 4892	3020	WaterMark.exe	89
PID 3020 wrote to memory of 4892	3020	WaterMark.exe	89
PID 3020 wrote to memory of 4892	3020	WaterMark.exe	89
PID 3020 wrote to memory of 3576	3020	WaterMark.exe	90
PID 3020 wrote to memory of 3576	3020	WaterMark.exe	90
PID 3020 wrote to memory of 3576	3020	WaterMark.exe	90
PID 3020 wrote to memory of 3576	3020	WaterMark.exe	90
PID 3020 wrote to memory of 3576	3020	WaterMark.exe	90
PID 3020 wrote to memory of 3576	3020	WaterMark.exe	90
PID 3020 wrote to memory of 3576	3020	WaterMark.exe	90
PID 3020 wrote to memory of 3576	3020	WaterMark.exe	90
PID 3020 wrote to memory of 3576	3020	WaterMark.exe	90
PID 3020 wrote to memory of 1604	3020	WaterMark.exe	74
PID 3020 wrote to memory of 2160	3020	WaterMark.exe	76
PID 3020 wrote to memory of 752	3020	WaterMark.exe	77
PID 3020 wrote to memory of 2140	3020	WaterMark.exe	78
PID 3020 wrote to memory of 1856	3020	WaterMark.exe	83
PID 3020 wrote to memory of 4436	3020	WaterMark.exe	93
PID 3020 wrote to memory of 4436	3020	WaterMark.exe	93
PID 3020 wrote to memory of 2212	3020	WaterMark.exe	94
PID 3020 wrote to memory of 2212	3020	WaterMark.exe	94
PID 4436 wrote to memory of 4588	4436	iexplore.exe	95

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	rundll32mgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WaterMark.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:772

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:376

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2960

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2376

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3376
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b80f7658ffb704350faf5060b1d92d66.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b80f7658ffb704350faf5060b1d92d66.dll,#1
    3⤵
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\SysWOW64\rundll32mgr.exe
      C:\Windows\SysWOW64\rundll32mgr.exe
      4⤵
      UAC bypass
      Disables RegEdit via registry modification
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4848
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        UAC bypass
        Disables RegEdit via registry modification
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3020
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall set opmode disable
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4892
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        
        PID:3576
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4436
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4436 CREDAT:17410 /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4588
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:2212
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:17410 /prefetch:2
        7⤵
        UAC bypass
        Disables RegEdit via registry modification
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3416
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall set opmode disable
        8⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4420
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 612
      4⤵
      Program crash
      PID:4264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3560

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3756

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3856

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3920

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4016

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4136

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:1604

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2160

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:752

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4984 -ip 4984
1⤵
PID:3140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BC24A083-E55F-11EF-ADF2-4A034D48373C}.dat

Filesize
3KB

MD5
2493af7befda11771a3cee1e4ef2e441

SHA1
5c781cfe398f112d6738bd9d1352de7c8e5c0a4f

SHA256
b97790c7fc17363178d6172864fcddd77dec9caad9f6252de62876b65acf9761

SHA512
73aff0e7d1a7b728f19abd10f4cc16178655f778ddda7dcf472014af94e624608efcd2523e05ea6a35ea0e858a6d54c4d02483938297da74c9ffd325fc6b3391

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BC296663-E55F-11EF-ADF2-4A034D48373C}.dat

Filesize
5KB

MD5
77d2b9b8d5e1cd64c50f3cd5a3509bef

SHA1
125cf0132a31ce5371f47d29dd8d17752b02057f

SHA256
74fbd8e10a2e31e61c66836a490fee04c7e417c64d34f97bb732c828094d0687

SHA512
c0b37492fb1caea315de88df2bb1d5407ad17e67170802c83ca7c7a3b5337a18d918f6cb9fe914696c0578909916dc3d043b4b2ff9b63ddd0859879f0ee5ed59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PGH3GSHW\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Windows\SYSTEM.INI

Filesize
258B

MD5
112051e4c84a9e8da66b8c0a219add5c

SHA1
2a1b8d054fcf6f4150e6163e58a62fd40585614a

SHA256
09733e08397a00048dbcf07bee477285323e45a0ff6f8578d428cffe846be4ab

SHA512
309201a68fe7bfef40c65d41387ed4ea5e317cc6599feed4ec6be866fb104fcd44b8b082abdd4acc92b20422f852eee6399d0951d9d8fb2d537ee2186eef71c5

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
187KB

MD5
27fdabf7c440551ce0d41832bb40e0e4

SHA1
c3a6f07789562c1edbea44197a3f6cb3f6d345c9

SHA256
52f26137f9a813c374e5bca7ae97f2f31c1f8084276944fdc5e97df7a69a86c4

SHA512
4c13cfe5ed6741933d83ba0af39bd9cc544033328fe015b5ec1f1eff358e54764814f60085c0b4528034e2e8ab2f94694e186b27d9e66e42e01391ba20f38df5

Download Submit
memory/3020-71-0x0000000003190000-0x00000000041C0000-memory.dmp

Filesize
16.2MB

Download
memory/3020-67-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/3020-89-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3020-90-0x0000000077132000-0x0000000077133000-memory.dmp

Filesize
4KB

Download
memory/3020-87-0x0000000003190000-0x00000000041C0000-memory.dmp

Filesize
16.2MB

Download
memory/3020-84-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/3020-63-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/3020-94-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/3020-72-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/3020-95-0x0000000003190000-0x00000000041C0000-memory.dmp

Filesize
16.2MB

Download
memory/3020-69-0x0000000003190000-0x00000000041C0000-memory.dmp

Filesize
16.2MB

Download
memory/3020-57-0x0000000003190000-0x00000000041C0000-memory.dmp

Filesize
16.2MB

Download
memory/3020-44-0x0000000003190000-0x00000000041C0000-memory.dmp

Filesize
16.2MB

Download
memory/3020-40-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3020-118-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3020-42-0x0000000003190000-0x00000000041C0000-memory.dmp

Filesize
16.2MB

Download
memory/3020-119-0x0000000003190000-0x00000000041C0000-memory.dmp

Filesize
16.2MB

Download
memory/3020-41-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/3020-58-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/3020-61-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/3020-64-0x0000000077132000-0x0000000077133000-memory.dmp

Filesize
4KB

Download
memory/3020-91-0x0000000003190000-0x00000000041C0000-memory.dmp

Filesize
16.2MB

Download
memory/3020-62-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3020-68-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/3576-66-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/3576-65-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/4848-18-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4848-23-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/4848-10-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4848-11-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4848-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4848-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4848-36-0x0000000000401000-0x0000000000416000-memory.dmp

Filesize
84KB

Download
memory/4848-16-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4848-9-0x0000000003580000-0x00000000045B0000-memory.dmp

Filesize
16.2MB

Download
memory/4848-8-0x0000000003580000-0x00000000045B0000-memory.dmp

Filesize
16.2MB

Download
memory/4848-6-0x0000000003580000-0x00000000045B0000-memory.dmp

Filesize
16.2MB

Download
memory/4848-17-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4848-4-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4848-33-0x0000000003580000-0x00000000045B0000-memory.dmp

Filesize
16.2MB

Download
memory/4848-34-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/4848-35-0x0000000000416000-0x0000000000420000-memory.dmp

Filesize
40KB

Download
memory/4984-20-0x0000000000A80000-0x0000000000A82000-memory.dmp

Filesize
8KB

Download
memory/4984-80-0x0000000000A80000-0x0000000000A82000-memory.dmp

Filesize
8KB

Download
memory/4984-0-0x0000000074B30000-0x0000000074B9A000-memory.dmp

Filesize
424KB

Download
memory/4984-100-0x0000000074B30000-0x0000000074B9A000-memory.dmp

Filesize
424KB

Download
memory/4984-37-0x0000000000A80000-0x0000000000A82000-memory.dmp

Filesize
8KB

Download
memory/4984-30-0x0000000000A80000-0x0000000000A82000-memory.dmp

Filesize
8KB

Download
memory/4984-21-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Filesize
4KB

Download