Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 04:08
Static task
static1
Behavioral task
behavioral1
Sample
18b96b2d2bffff2d8ce43b80f99ee834_JaffaCakes118.dll
Resource
win7-20240611-en
General
-
Target
18b96b2d2bffff2d8ce43b80f99ee834_JaffaCakes118.dll
-
Size
193KB
-
MD5
18b96b2d2bffff2d8ce43b80f99ee834
-
SHA1
ac4b755033099a232fc5b36f7c007ff8a17155a7
-
SHA256
82a503d864ec7f8a240c207af5257cb64e4bd52015f80cab3924643a4d41e00e
-
SHA512
571139e8e539f27a708635981c6e77da7d0d322585c6e06443da7bd3434d3cb1f274293909be23d3affb0be4b7025da88241e03971462ca5b7bf079ae13471bd
-
SSDEEP
3072:n73MITL/9oSmkbx3ZtffjBTnIwanLMFylo7Ay+TZ5fq43Uk2grFL:7dTpountf75Iwksylo/OZ5SUUklV
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 2184 regsvr32mgr.exe 2396 WaterMark.exe -
Loads dropped DLL 4 IoCs
Processes:
regsvr32.exeregsvr32mgr.exepid process 1732 regsvr32.exe 1732 regsvr32.exe 2184 regsvr32mgr.exe 2184 regsvr32mgr.exe -
Processes:
resource yara_rule behavioral1/memory/2184-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2184-19-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2184-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2184-22-0x0000000000220000-0x0000000000255000-memory.dmp upx behavioral1/memory/2184-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2184-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2184-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2184-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2396-39-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2396-565-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
Processes:
svchost.exeregsvr32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 64 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-multibyte-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_http_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\hxdsui.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeLinguistic.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\logsession.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\icucnv36.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCH.DLL svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\management.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClient.resources.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\MSCDM.DLL svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\JavaAccessBridge-64.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libsftp_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\hxdsui.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\dt_socket.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_rist_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_display_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\slideShow.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ViewerPS.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdaremr.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\weather.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIB.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODTXT.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\ChkrRes.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_livehttp_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\Microsoft.Ink.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSSOAP30.DLL svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClient.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.ServiceModel.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libwin_hotkeys_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libxml_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\clock.html svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\MCESidebarCtrl.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pencht.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\ado\msadomd.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\IEAWSDC.DLL svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\ReachFramework.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Utilities.v3.5.resources.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Engine.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libdshow_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libpng_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_sse2_plugin.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsFormsIntegration.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libdiracsys_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Defender\MpSvc.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\EEINTL.DLL svchost.exe -
Modifies registry class 45 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\ = "IWMPDeskBandDispatch" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMP.DeskBand.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6DD1ED6-573F-40FD-99A1-F28D8BF23916}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WMP.DeskBand\CLSID\ = "{0A4286EA-E355-44FB-8086-AF3DF7645BD9}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\18b96b2d2bffff2d8ce43b80f99ee834_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6DD1ED6-573F-40FD-99A1-F28D8BF23916}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6DD1ED6-573F-40FD-99A1-F28D8BF23916} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6DD1ED6-573F-40FD-99A1-F28D8BF23916}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\VersionIndependentProgID\ = "WMP.DeskBand" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6DD1ED6-573F-40FD-99A1-F28D8BF23916}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6DD1ED6-573F-40FD-99A1-F28D8BF23916}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\18b96b2d2bffff2d8ce43b80f99ee834_JaffaCakes118.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMP.DeskBand regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\LocalizedString = "@C:\\Users\\Admin\\AppData\\Local\\Temp\\18b96b2d2bffff2d8ce43b80f99ee834_JaffaCakes118.dll,-101" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6DD1ED6-573F-40FD-99A1-F28D8BF23916}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\TypeLib\ = "{B6DD1ED6-573F-40FD-99A1-F28D8BF23916}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WMP.DeskBand\ = "&Windows Media Player" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6DD1ED6-573F-40FD-99A1-F28D8BF23916}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6DD1ED6-573F-40FD-99A1-F28D8BF23916}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WMP.DeskBand.1\CLSID\ = "{0A4286EA-E355-44FB-8086-AF3DF7645BD9}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\MenuText = "@C:\\Users\\Admin\\AppData\\Local\\Temp\\18b96b2d2bffff2d8ce43b80f99ee834_JaffaCakes118.dll,-101" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\ProgID\ = "WMP.DeskBand.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\Implemented Categories\{00021492-0000-0000-C000-000000000046} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6DD1ED6-573F-40FD-99A1-F28D8BF23916}\1.0\ = "WMPDeskBand 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\ = "IWMPDeskBandDispatch" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMP.DeskBand\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\ = "&Windows Media Player" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WMP.DeskBand.1\ = "&Windows Media Player" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMP.DeskBand.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\TypeLib\ = "{B6DD1ED6-573F-40FD-99A1-F28D8BF23916}" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
WaterMark.exesvchost.exepid process 2396 WaterMark.exe 2396 WaterMark.exe 2396 WaterMark.exe 2396 WaterMark.exe 2396 WaterMark.exe 2396 WaterMark.exe 2396 WaterMark.exe 2396 WaterMark.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe 2380 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WaterMark.exesvchost.exedescription pid process Token: SeDebugPrivilege 2396 WaterMark.exe Token: SeDebugPrivilege 2380 svchost.exe Token: SeDebugPrivilege 2396 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 2184 regsvr32mgr.exe 2396 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32mgr.exeWaterMark.exesvchost.exedescription pid process target process PID 2020 wrote to memory of 1732 2020 regsvr32.exe regsvr32.exe PID 2020 wrote to memory of 1732 2020 regsvr32.exe regsvr32.exe PID 2020 wrote to memory of 1732 2020 regsvr32.exe regsvr32.exe PID 2020 wrote to memory of 1732 2020 regsvr32.exe regsvr32.exe PID 2020 wrote to memory of 1732 2020 regsvr32.exe regsvr32.exe PID 2020 wrote to memory of 1732 2020 regsvr32.exe regsvr32.exe PID 2020 wrote to memory of 1732 2020 regsvr32.exe regsvr32.exe PID 1732 wrote to memory of 2184 1732 regsvr32.exe regsvr32mgr.exe PID 1732 wrote to memory of 2184 1732 regsvr32.exe regsvr32mgr.exe PID 1732 wrote to memory of 2184 1732 regsvr32.exe regsvr32mgr.exe PID 1732 wrote to memory of 2184 1732 regsvr32.exe regsvr32mgr.exe PID 2184 wrote to memory of 2396 2184 regsvr32mgr.exe WaterMark.exe PID 2184 wrote to memory of 2396 2184 regsvr32mgr.exe WaterMark.exe PID 2184 wrote to memory of 2396 2184 regsvr32mgr.exe WaterMark.exe PID 2184 wrote to memory of 2396 2184 regsvr32mgr.exe WaterMark.exe PID 2396 wrote to memory of 2672 2396 WaterMark.exe svchost.exe PID 2396 wrote to memory of 2672 2396 WaterMark.exe svchost.exe PID 2396 wrote to memory of 2672 2396 WaterMark.exe svchost.exe PID 2396 wrote to memory of 2672 2396 WaterMark.exe svchost.exe PID 2396 wrote to memory of 2672 2396 WaterMark.exe svchost.exe PID 2396 wrote to memory of 2672 2396 WaterMark.exe svchost.exe PID 2396 wrote to memory of 2672 2396 WaterMark.exe svchost.exe PID 2396 wrote to memory of 2672 2396 WaterMark.exe svchost.exe PID 2396 wrote to memory of 2672 2396 WaterMark.exe svchost.exe PID 2396 wrote to memory of 2672 2396 WaterMark.exe svchost.exe PID 2396 wrote to memory of 2380 2396 WaterMark.exe svchost.exe PID 2396 wrote to memory of 2380 2396 WaterMark.exe svchost.exe PID 2396 wrote to memory of 2380 2396 WaterMark.exe svchost.exe PID 2396 wrote to memory of 2380 2396 WaterMark.exe svchost.exe PID 2396 wrote to memory of 2380 2396 WaterMark.exe svchost.exe PID 2396 wrote to memory of 2380 2396 WaterMark.exe svchost.exe PID 2396 wrote to memory of 2380 2396 WaterMark.exe svchost.exe PID 2396 wrote to memory of 2380 2396 WaterMark.exe svchost.exe PID 2396 wrote to memory of 2380 2396 WaterMark.exe svchost.exe PID 2396 wrote to memory of 2380 2396 WaterMark.exe svchost.exe PID 2380 wrote to memory of 256 2380 svchost.exe smss.exe PID 2380 wrote to memory of 256 2380 svchost.exe smss.exe PID 2380 wrote to memory of 256 2380 svchost.exe smss.exe PID 2380 wrote to memory of 256 2380 svchost.exe smss.exe PID 2380 wrote to memory of 256 2380 svchost.exe smss.exe PID 2380 wrote to memory of 332 2380 svchost.exe csrss.exe PID 2380 wrote to memory of 332 2380 svchost.exe csrss.exe PID 2380 wrote to memory of 332 2380 svchost.exe csrss.exe PID 2380 wrote to memory of 332 2380 svchost.exe csrss.exe PID 2380 wrote to memory of 332 2380 svchost.exe csrss.exe PID 2380 wrote to memory of 384 2380 svchost.exe wininit.exe PID 2380 wrote to memory of 384 2380 svchost.exe wininit.exe PID 2380 wrote to memory of 384 2380 svchost.exe wininit.exe PID 2380 wrote to memory of 384 2380 svchost.exe wininit.exe PID 2380 wrote to memory of 384 2380 svchost.exe wininit.exe PID 2380 wrote to memory of 392 2380 svchost.exe csrss.exe PID 2380 wrote to memory of 392 2380 svchost.exe csrss.exe PID 2380 wrote to memory of 392 2380 svchost.exe csrss.exe PID 2380 wrote to memory of 392 2380 svchost.exe csrss.exe PID 2380 wrote to memory of 392 2380 svchost.exe csrss.exe PID 2380 wrote to memory of 432 2380 svchost.exe winlogon.exe PID 2380 wrote to memory of 432 2380 svchost.exe winlogon.exe PID 2380 wrote to memory of 432 2380 svchost.exe winlogon.exe PID 2380 wrote to memory of 432 2380 svchost.exe winlogon.exe PID 2380 wrote to memory of 432 2380 svchost.exe winlogon.exe PID 2380 wrote to memory of 476 2380 svchost.exe services.exe PID 2380 wrote to memory of 476 2380 svchost.exe services.exe PID 2380 wrote to memory of 476 2380 svchost.exe services.exe PID 2380 wrote to memory of 476 2380 svchost.exe services.exe
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\18b96b2d2bffff2d8ce43b80f99ee834_JaffaCakes118.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\18b96b2d2bffff2d8ce43b80f99ee834_JaffaCakes118.dll3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.htmlFilesize
206KB
MD5e6b87a72c00810810fa74e1218e054f9
SHA138cffd7a448a9cf937ead3c13c11c1389f064e43
SHA25621059a9e58b284d6a6576c65e9e0dbe873644944351baca41db08ca85aa25fc5
SHA5120d5ffddaa34056302d7fd84b4456909c8a8de0f77d97d3e836c5fd056afc68c77c8c3dab2e772fff1a9cac99a3b4419b90410400aba2ccd5f9599699e859add7
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.htmlFilesize
202KB
MD5076345e6ec2b692fec76e52f0334073f
SHA12e3919b60f747ea87878d36ae0f4ffac46b1248c
SHA25668a9de2a97eaf107fd7526b8f6517fa1c10396cd1567b71cc2823368f7b7e001
SHA512b4264933cf22c8de72fb66c9f6b4833f1fa8cb7af799bb99d2eedcd20897fd8b750d602aa3cb0ba346178e1090ab26fd360b06d5332301582f0b486795735ca3
-
\Windows\SysWOW64\regsvr32mgr.exeFilesize
96KB
MD58c51fd9d6daa7b6137634de19a49452c
SHA1db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA256528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
SHA512b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837
-
memory/1732-3-0x00000000006B0000-0x00000000006E5000-memory.dmpFilesize
212KB
-
memory/1732-2-0x0000000074720000-0x0000000074753000-memory.dmpFilesize
204KB
-
memory/2184-10-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2184-15-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2184-22-0x0000000000220000-0x0000000000255000-memory.dmpFilesize
212KB
-
memory/2184-12-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2184-18-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2184-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2184-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2184-11-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2184-19-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2380-72-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2380-89-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2380-90-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2380-88-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2380-87-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2380-86-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/2380-85-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2380-82-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2396-30-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2396-41-0x000000007750F000-0x0000000077510000-memory.dmpFilesize
4KB
-
memory/2396-70-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2396-39-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2396-40-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2396-565-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2672-66-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/2672-64-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2672-45-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/2672-43-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2672-58-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2672-67-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/2672-54-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2672-65-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB