ramnit | dc60d3a67b01f1a28916c318e31f29a50a87c0e85d36ea9e81bffe5bcd692d98

Analysis

max time kernel
104s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
23/03/2025, 22:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_88331fa7186eae321b6bdbd70156c660.dll
Size

675KB
MD5

88331fa7186eae321b6bdbd70156c660
SHA1

f9b89602f33eb826c5ac89d3a879b94f90bb102f
SHA256

dc60d3a67b01f1a28916c318e31f29a50a87c0e85d36ea9e81bffe5bcd692d98
SHA512

412d0f2c50e3254a87d8d4465e4edb26db478b3a8f320c205d378e7029c2f0df64a6cff54f55b90d6b16a114be133205c457c82d60e39aca2928ccf2f2f99387
SSDEEP

12288:B79qXvjRc5AoIY+NPUlWnoAsCZLZXdBbqO/r2:DqXvjRc5AoITcknoBCZLZXnbxi

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 6 IoCs

pid	Process
4236	rundll32mgr.exe
6108	rundll32mgrmgr.exe
3360	WaterMark.exe
4436	WaterMark.exe
4008	WaterMarkmgr.exe
5296	WaterMark.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\rundll32mgrmgr.exe	rundll32mgr.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4236-16-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3360-59-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4436-70-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/5296-82-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral2/memory/5296-88-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3360-89-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4008-74-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4008-56-0x0000000000400000-0x0000000000439000-memory.dmp	upx
behavioral2/memory/4436-55-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral2/memory/6108-35-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4236-21-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4236-17-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4236-14-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4236-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4236-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4236-11-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/5296-97-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/4436-100-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\px6D02.tmp	rundll32mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	WaterMarkmgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px6D31.tmp	rundll32mgrmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgrmgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px6D9E.tmp	WaterMarkmgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe	WaterMark.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4764	2352	WerFault.exe	94
4792	3560	WerFault.exe	97
4796	4836	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMarkmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgrmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WaterMark.exe

Modifies Internet Explorer settings 1 TTPs 59 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3E22697A-0835-11F0-AF5D-FA8BC9FE6385} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "449533496"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3E22908A-0835-11F0-AF5D-FA8BC9FE6385} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3E24CB78-0835-11F0-AF5D-FA8BC9FE6385} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff720000001a000000f80400007f020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3E200733-0835-11F0-AF5D-FA8BC9FE6385} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3360	WaterMark.exe
3360	WaterMark.exe
3360	WaterMark.exe
4436	WaterMark.exe
4436	WaterMark.exe
4436	WaterMark.exe
4436	WaterMark.exe
3360	WaterMark.exe
5296	WaterMark.exe
5296	WaterMark.exe
5296	WaterMark.exe
5296	WaterMark.exe
3360	WaterMark.exe
4436	WaterMark.exe
3360	WaterMark.exe
4436	WaterMark.exe
4436	WaterMark.exe
3360	WaterMark.exe
3360	WaterMark.exe
4436	WaterMark.exe
4436	WaterMark.exe
4436	WaterMark.exe
3360	WaterMark.exe
3360	WaterMark.exe
3360	WaterMark.exe
4436	WaterMark.exe
3360	WaterMark.exe
4436	WaterMark.exe
3360	WaterMark.exe
3360	WaterMark.exe
4436	WaterMark.exe
4436	WaterMark.exe
3360	WaterMark.exe
4436	WaterMark.exe
3360	WaterMark.exe
4436	WaterMark.exe
5296	WaterMark.exe
5296	WaterMark.exe
5296	WaterMark.exe
5296	WaterMark.exe
5296	WaterMark.exe
5296	WaterMark.exe
5296	WaterMark.exe
5296	WaterMark.exe
5296	WaterMark.exe
5296	WaterMark.exe
5296	WaterMark.exe
5296	WaterMark.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3360	WaterMark.exe
Token: SeDebugPrivilege	4436	WaterMark.exe
Token: SeDebugPrivilege	5296	WaterMark.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1808	iexplore.exe
5960	iexplore.exe
3592	iexplore.exe
1792	iexplore.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
1792	iexplore.exe
1792	iexplore.exe
3592	iexplore.exe
1808	iexplore.exe
3592	iexplore.exe
1808	iexplore.exe
5960	iexplore.exe
5960	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
3148	IEXPLORE.EXE
3148	IEXPLORE.EXE
748	IEXPLORE.EXE
748	IEXPLORE.EXE
3992	IEXPLORE.EXE
3992	IEXPLORE.EXE
3148	IEXPLORE.EXE
3148	IEXPLORE.EXE

Suspicious use of UnmapMainImage 6 IoCs

pid	Process
4236	rundll32mgr.exe
6108	rundll32mgrmgr.exe
3360	WaterMark.exe
4436	WaterMark.exe
4008	WaterMarkmgr.exe
5296	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 4356	1980	rundll32.exe	87
PID 1980 wrote to memory of 4356	1980	rundll32.exe	87
PID 1980 wrote to memory of 4356	1980	rundll32.exe	87
PID 4356 wrote to memory of 4236	4356	rundll32.exe	88
PID 4356 wrote to memory of 4236	4356	rundll32.exe	88
PID 4356 wrote to memory of 4236	4356	rundll32.exe	88
PID 4236 wrote to memory of 6108	4236	rundll32mgr.exe	89
PID 4236 wrote to memory of 6108	4236	rundll32mgr.exe	89
PID 4236 wrote to memory of 6108	4236	rundll32mgr.exe	89
PID 4236 wrote to memory of 3360	4236	rundll32mgr.exe	90
PID 4236 wrote to memory of 3360	4236	rundll32mgr.exe	90
PID 4236 wrote to memory of 3360	4236	rundll32mgr.exe	90
PID 6108 wrote to memory of 4436	6108	rundll32mgrmgr.exe	92
PID 6108 wrote to memory of 4436	6108	rundll32mgrmgr.exe	92
PID 6108 wrote to memory of 4436	6108	rundll32mgrmgr.exe	92
PID 3360 wrote to memory of 4008	3360	WaterMark.exe	91
PID 3360 wrote to memory of 4008	3360	WaterMark.exe	91
PID 3360 wrote to memory of 4008	3360	WaterMark.exe	91
PID 4436 wrote to memory of 4836	4436	WaterMark.exe	93
PID 4436 wrote to memory of 4836	4436	WaterMark.exe	93
PID 4436 wrote to memory of 4836	4436	WaterMark.exe	93
PID 4436 wrote to memory of 4836	4436	WaterMark.exe	93
PID 4436 wrote to memory of 4836	4436	WaterMark.exe	93
PID 4436 wrote to memory of 4836	4436	WaterMark.exe	93
PID 4436 wrote to memory of 4836	4436	WaterMark.exe	93
PID 4436 wrote to memory of 4836	4436	WaterMark.exe	93
PID 4436 wrote to memory of 4836	4436	WaterMark.exe	93
PID 3360 wrote to memory of 2352	3360	WaterMark.exe	94
PID 3360 wrote to memory of 2352	3360	WaterMark.exe	94
PID 3360 wrote to memory of 2352	3360	WaterMark.exe	94
PID 3360 wrote to memory of 2352	3360	WaterMark.exe	94
PID 3360 wrote to memory of 2352	3360	WaterMark.exe	94
PID 3360 wrote to memory of 2352	3360	WaterMark.exe	94
PID 3360 wrote to memory of 2352	3360	WaterMark.exe	94
PID 3360 wrote to memory of 2352	3360	WaterMark.exe	94
PID 3360 wrote to memory of 2352	3360	WaterMark.exe	94
PID 4008 wrote to memory of 5296	4008	WaterMarkmgr.exe	95
PID 4008 wrote to memory of 5296	4008	WaterMarkmgr.exe	95
PID 4008 wrote to memory of 5296	4008	WaterMarkmgr.exe	95
PID 5296 wrote to memory of 3560	5296	WaterMark.exe	97
PID 5296 wrote to memory of 3560	5296	WaterMark.exe	97
PID 5296 wrote to memory of 3560	5296	WaterMark.exe	97
PID 5296 wrote to memory of 3560	5296	WaterMark.exe	97
PID 5296 wrote to memory of 3560	5296	WaterMark.exe	97
PID 5296 wrote to memory of 3560	5296	WaterMark.exe	97
PID 5296 wrote to memory of 3560	5296	WaterMark.exe	97
PID 5296 wrote to memory of 3560	5296	WaterMark.exe	97
PID 5296 wrote to memory of 3560	5296	WaterMark.exe	97
PID 3360 wrote to memory of 1808	3360	WaterMark.exe	112
PID 3360 wrote to memory of 1808	3360	WaterMark.exe	112
PID 4436 wrote to memory of 3592	4436	WaterMark.exe	111
PID 4436 wrote to memory of 3592	4436	WaterMark.exe	111
PID 3360 wrote to memory of 5960	3360	WaterMark.exe	113
PID 3360 wrote to memory of 5960	3360	WaterMark.exe	113
PID 4436 wrote to memory of 1792	4436	WaterMark.exe	114
PID 4436 wrote to memory of 1792	4436	WaterMark.exe	114
PID 5296 wrote to memory of 2488	5296	WaterMark.exe	115
PID 5296 wrote to memory of 2488	5296	WaterMark.exe	115
PID 5296 wrote to memory of 4500	5296	WaterMark.exe	116
PID 5296 wrote to memory of 4500	5296	WaterMark.exe	116
PID 1792 wrote to memory of 3992	1792	iexplore.exe	117
PID 1792 wrote to memory of 3992	1792	iexplore.exe	117
PID 1792 wrote to memory of 3992	1792	iexplore.exe	117
PID 1808 wrote to memory of 2528	1808	iexplore.exe	119

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_88331fa7186eae321b6bdbd70156c660.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_88331fa7186eae321b6bdbd70156c660.dll,#1
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:4236
  - - C:\Windows\SysWOW64\rundll32mgrmgr.exe
      C:\Windows\SysWOW64\rundll32mgrmgr.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:6108
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:4436
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 204
        7⤵
        Program crash
        
        PID:4796
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:3592
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3592 CREDAT:17410 /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:748
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1792 CREDAT:17410 /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3992
  - - C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of UnmapMainImage
      Suspicious use of WriteProcessMemory
      PID:3360
    - - C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:4008
      - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of UnmapMainImage
        Suspicious use of WriteProcessMemory
        
        PID:5296
        
        C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        7⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 204
        8⤵
        Program crash
        
        PID:4792
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        Modifies Internet Explorer settings
        
        PID:2488
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        Modifies Internet Explorer settings
        
        PID:4500
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        
        PID:2352
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 204
        6⤵
        Program crash
        
        PID:4764
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1808
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1808 CREDAT:17410 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2528
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:5960
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5960 CREDAT:17410 /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3560 -ip 3560
1⤵
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4836 -ip 4836
1⤵
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2352 -ip 2352
1⤵
PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
471B

MD5
70f2cd5a40c53a24406bef59c4dca71a

SHA1
438a0730aab95862c097791a037678c5563c42cc

SHA256
a1c50f56a0ce0c9c0288e7a21a933e4b477de7d729666c884d3e6d734b087607

SHA512
f42fb79ad0075f05a4ad53d749a831f9d12f0d2b2d1016871734e19866b9c8406a041b84fc0085e422dcbbd17076f57ea2425e20a294124e24794d2262739e51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
412B

MD5
c8597872974b6fbbc41f138392cf9813

SHA1
37eb689165925bb7d538eb5f0e2097acd19c3ad4

SHA256
8698260fc7d5c15f0b92a6818f6449682cb35c1038bc4c5ed65f4a0c6d3fcaf5

SHA512
5ba123ebb1ff140d653acec6230e08ff1188c3cc4d2e71cbad44ecf4fc373e869e2f38aa2770bdb085ab8855ec674094bdc7f758d7d807adc290c28434b4f771

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
412B

MD5
d2cd634d7f21903a9f6fe9b23c1cb81f

SHA1
1aa1357791b1922f04bb1d4fbc05ceb02ba268a9

SHA256
d86c5e1c945d9046afe33a0f4cc8e398fcde584fe7362837f9a2272eea369b23

SHA512
24f559967b6a07b7f3f3bfd8be2c44a4ffb2f1b7b961e83d1b09271c0e6d983229a9dd92de016a45e5e2845afdafc305c09a1868d91ca4ee9897bdfc1c1ce832

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3E22697A-0835-11F0-AF5D-FA8BC9FE6385}.dat

Filesize
5KB

MD5
f654fddc7357724e1f893eb0f005b98b

SHA1
9c1053e3bac13012aa65e78b409096e2b19c8e5f

SHA256
abebdc19ec4b2d3cf32c9f0ff727691ad10851ecebbc4a8ae0f0ad7d2ccf53f1

SHA512
60b7579ac2fbe5cf0f815e47645893199aea8ef866fdda4165cc35b6c6dc5ac01d4356b667d380b2f4d3dfc6d361ccec00d8db48e49b335ca9b7e7079ed546dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3E22908A-0835-11F0-AF5D-FA8BC9FE6385}.dat

Filesize
4KB

MD5
3a26a3f06fa25377a6a5ed858b622af2

SHA1
5a28c47185ffc4584b7bb7d211f106ede215c769

SHA256
eda7feeac831e2c7e25d8d2a754fc1d3e2ef930fcbca4422afe5ff56a87c9444

SHA512
5d957397aec1c5c99b60626cc1e1d0b2ccdfab36bee79c808392ca76e5cdb9828711b7328006202ad2d0dd44d3bdb7c97f751a99b3ed591d47f598e72a0015d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3E22908A-0835-11F0-AF5D-FA8BC9FE6385}.dat

Filesize
5KB

MD5
61f57ee60d310c8696fc8b89a504c2a4

SHA1
fdb2ba5fd53598009f4ae76d8c8f86f9dd4b6e7b

SHA256
faa8c1d35244dae60e95698853175bff87e2ec11f4e7ad82552c9a66a13e9ccc

SHA512
b5269b398661bbddb8545b4f7ce3b87b8d84952efc53f1a394b8462da976bdbfc8f679e718173415c551c553b946dcbe196f1e4fb6dcb3fafbda6b5b07165450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\463FIIFI\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
339KB

MD5
86eaaa35132233d20e0f61f82748cc64

SHA1
cc6cf70f0c8f1b98d029d091406cee60e17d6af8

SHA256
47537bff845a5b844418ab0691f5931014e06d4de1ba64b39eebc5b76ae1a181

SHA512
c835343bd16509a7de958ffb8e71fc679ae8a9f251dc975b426125e058c583e7ab576975a4afc723b7763fedbc3ed3c2185043585103a555c4c60d10939fd38e

Download Submit
C:\Windows\SysWOW64\rundll32mgrmgr.exe

Filesize
168KB

MD5
0943b815c588255874985439061ba474

SHA1
31ad4cdb76003b35f553cb96c78d887e7c960eba

SHA256
7b1559c2f8d511f7be152a22809b358088048fc3e00d9963b92ad0ecb384bf51

SHA512
fce7596624b5c224cbaaae55c4b224ff995eea33ed0ca9d40c33cfb5ffaa98f387f267175788f5431ca7209c2c69ef1024b9541f7b53a1a3c6412b09a19bd601

Download Submit
memory/2352-75-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Filesize
4KB

Download
memory/2352-76-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/3360-89-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3360-59-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3360-37-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3360-90-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/3360-65-0x0000000077952000-0x0000000077953000-memory.dmp

Filesize
4KB

Download
memory/3360-60-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/4008-74-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4008-56-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4236-17-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4236-11-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4236-21-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4236-19-0x0000000002880000-0x0000000002881000-memory.dmp

Filesize
4KB

Download
memory/4236-5-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4236-16-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4236-15-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4236-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4236-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4236-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4236-10-0x0000000000403000-0x0000000000405000-memory.dmp

Filesize
8KB

Download
memory/4356-0-0x0000000010000000-0x00000000100AF000-memory.dmp

Filesize
700KB

Download
memory/4436-55-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4436-100-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4436-67-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/4436-70-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/5296-88-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/5296-97-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/5296-98-0x0000000077952000-0x0000000077953000-memory.dmp

Filesize
4KB

Download
memory/5296-86-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/5296-82-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/6108-9-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/6108-24-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/6108-35-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download