Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 08:42
Static task
static1
Behavioral task
behavioral1
Sample
197d7acb5047dc2ec5444777f4098d41_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
197d7acb5047dc2ec5444777f4098d41_JaffaCakes118.dll
-
Size
193KB
-
MD5
197d7acb5047dc2ec5444777f4098d41
-
SHA1
9864742e3f5020411c2a161406e51400565b4181
-
SHA256
da9202fdc9e2719366f97439a963251c28d7c28da4d70bce4990b7ff0c3a65c8
-
SHA512
09c0d6ea15cfa1997d25e1173400899f46924e91566f63e50e9f1e6e41e5678b52a4f772b383c31b00e9918a4968791ed80fa8551afca80ab28a8255c8ab1714
-
SSDEEP
3072:S73MITL/9oSmkbx3ZtffjBTnIwanLMvt8qY1w6MQY0DzS:QdTpountf75Iwk7qyMQTG
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 1456 regsvr32mgr.exe 2144 WaterMark.exe -
Loads dropped DLL 4 IoCs
Processes:
regsvr32.exeregsvr32mgr.exepid process 2768 regsvr32.exe 2768 regsvr32.exe 1456 regsvr32mgr.exe 1456 regsvr32mgr.exe -
Processes:
resource yara_rule behavioral1/memory/1456-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1456-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1456-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1456-19-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1456-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2144-39-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2144-38-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2144-36-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1456-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1456-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2144-563-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
Processes:
regsvr32.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 64 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\msvcr100.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_dummy_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libidummy_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libexport_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-font.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadco.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Printing.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Abstractions.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\slideShow.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\eula.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libes_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libogg_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libvdummy_plugin.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_udp_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpuzzle_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DBGHELP.DLL svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libnetsync_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcolorthres_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\flyout.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIB.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\icucnv36.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\libxslt.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libsid_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Journal\jnwppr.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\RSSFeeds.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libprefetch_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Acrofx32.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\profilerinterface.dll svchost.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\Chkr.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libaom_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\logger\libconsole_logger_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ps_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACECORE.DLL svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll svchost.exe File opened for modification C:\Program Files\Windows Portable Devices\sqmapi.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\WindowsAccessBridge-64.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.RunTime.Serialization.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Management.Instrumentation.Resources.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\dicjp.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libdca_plugin.dll svchost.exe -
Modifies registry class 45 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMP.DeskBand regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WMP.DeskBand\ = "&Windows Media Player" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\VersionIndependentProgID\ = "WMP.DeskBand" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WMP.DeskBand.1\CLSID\ = "{0A4286EA-E355-44FB-8086-AF3DF7645BD9}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\MenuText = "@C:\\Users\\Admin\\AppData\\Local\\Temp\\197d7acb5047dc2ec5444777f4098d41_JaffaCakes118.dll,-101" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\ProgID\ = "WMP.DeskBand.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6DD1ED6-573F-40FD-99A1-F28D8BF23916}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6DD1ED6-573F-40FD-99A1-F28D8BF23916}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6DD1ED6-573F-40FD-99A1-F28D8BF23916}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\197d7acb5047dc2ec5444777f4098d41_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6DD1ED6-573F-40FD-99A1-F28D8BF23916}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6DD1ED6-573F-40FD-99A1-F28D8BF23916}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\ = "IWMPDeskBandDispatch" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMP.DeskBand\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WMP.DeskBand\CLSID\ = "{0A4286EA-E355-44FB-8086-AF3DF7645BD9}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\ = "IWMPDeskBandDispatch" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\LocalizedString = "@C:\\Users\\Admin\\AppData\\Local\\Temp\\197d7acb5047dc2ec5444777f4098d41_JaffaCakes118.dll,-101" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\197d7acb5047dc2ec5444777f4098d41_JaffaCakes118.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6DD1ED6-573F-40FD-99A1-F28D8BF23916}\1.0\ = "WMPDeskBand 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\TypeLib\ = "{B6DD1ED6-573F-40FD-99A1-F28D8BF23916}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\ = "&Windows Media Player" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\Implemented Categories\{00021492-0000-0000-C000-000000000046} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6DD1ED6-573F-40FD-99A1-F28D8BF23916}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6DD1ED6-573F-40FD-99A1-F28D8BF23916}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMP.DeskBand.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMP.DeskBand.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WMP.DeskBand.1\ = "&Windows Media Player" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0A4286EA-E355-44FB-8086-AF3DF7645BD9} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6DD1ED6-573F-40FD-99A1-F28D8BF23916} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B6DD1ED6-573F-40FD-99A1-F28D8BF23916}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A55922C-3B1F-469B-8D0D-B15060499A52}\TypeLib\ = "{B6DD1ED6-573F-40FD-99A1-F28D8BF23916}" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
WaterMark.exesvchost.exepid process 2144 WaterMark.exe 2144 WaterMark.exe 2144 WaterMark.exe 2144 WaterMark.exe 2144 WaterMark.exe 2144 WaterMark.exe 2144 WaterMark.exe 2144 WaterMark.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe 2480 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WaterMark.exesvchost.exedescription pid process Token: SeDebugPrivilege 2144 WaterMark.exe Token: SeDebugPrivilege 2480 svchost.exe Token: SeDebugPrivilege 2144 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 1456 regsvr32mgr.exe 2144 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32mgr.exeWaterMark.exesvchost.exedescription pid process target process PID 2512 wrote to memory of 2768 2512 regsvr32.exe regsvr32.exe PID 2512 wrote to memory of 2768 2512 regsvr32.exe regsvr32.exe PID 2512 wrote to memory of 2768 2512 regsvr32.exe regsvr32.exe PID 2512 wrote to memory of 2768 2512 regsvr32.exe regsvr32.exe PID 2512 wrote to memory of 2768 2512 regsvr32.exe regsvr32.exe PID 2512 wrote to memory of 2768 2512 regsvr32.exe regsvr32.exe PID 2512 wrote to memory of 2768 2512 regsvr32.exe regsvr32.exe PID 2768 wrote to memory of 1456 2768 regsvr32.exe regsvr32mgr.exe PID 2768 wrote to memory of 1456 2768 regsvr32.exe regsvr32mgr.exe PID 2768 wrote to memory of 1456 2768 regsvr32.exe regsvr32mgr.exe PID 2768 wrote to memory of 1456 2768 regsvr32.exe regsvr32mgr.exe PID 1456 wrote to memory of 2144 1456 regsvr32mgr.exe WaterMark.exe PID 1456 wrote to memory of 2144 1456 regsvr32mgr.exe WaterMark.exe PID 1456 wrote to memory of 2144 1456 regsvr32mgr.exe WaterMark.exe PID 1456 wrote to memory of 2144 1456 regsvr32mgr.exe WaterMark.exe PID 2144 wrote to memory of 2288 2144 WaterMark.exe svchost.exe PID 2144 wrote to memory of 2288 2144 WaterMark.exe svchost.exe PID 2144 wrote to memory of 2288 2144 WaterMark.exe svchost.exe PID 2144 wrote to memory of 2288 2144 WaterMark.exe svchost.exe PID 2144 wrote to memory of 2288 2144 WaterMark.exe svchost.exe PID 2144 wrote to memory of 2288 2144 WaterMark.exe svchost.exe PID 2144 wrote to memory of 2288 2144 WaterMark.exe svchost.exe PID 2144 wrote to memory of 2288 2144 WaterMark.exe svchost.exe PID 2144 wrote to memory of 2288 2144 WaterMark.exe svchost.exe PID 2144 wrote to memory of 2288 2144 WaterMark.exe svchost.exe PID 2144 wrote to memory of 2480 2144 WaterMark.exe svchost.exe PID 2144 wrote to memory of 2480 2144 WaterMark.exe svchost.exe PID 2144 wrote to memory of 2480 2144 WaterMark.exe svchost.exe PID 2144 wrote to memory of 2480 2144 WaterMark.exe svchost.exe PID 2144 wrote to memory of 2480 2144 WaterMark.exe svchost.exe PID 2144 wrote to memory of 2480 2144 WaterMark.exe svchost.exe PID 2144 wrote to memory of 2480 2144 WaterMark.exe svchost.exe PID 2144 wrote to memory of 2480 2144 WaterMark.exe svchost.exe PID 2144 wrote to memory of 2480 2144 WaterMark.exe svchost.exe PID 2144 wrote to memory of 2480 2144 WaterMark.exe svchost.exe PID 2480 wrote to memory of 260 2480 svchost.exe smss.exe PID 2480 wrote to memory of 260 2480 svchost.exe smss.exe PID 2480 wrote to memory of 260 2480 svchost.exe smss.exe PID 2480 wrote to memory of 260 2480 svchost.exe smss.exe PID 2480 wrote to memory of 260 2480 svchost.exe smss.exe PID 2480 wrote to memory of 336 2480 svchost.exe csrss.exe PID 2480 wrote to memory of 336 2480 svchost.exe csrss.exe PID 2480 wrote to memory of 336 2480 svchost.exe csrss.exe PID 2480 wrote to memory of 336 2480 svchost.exe csrss.exe PID 2480 wrote to memory of 336 2480 svchost.exe csrss.exe PID 2480 wrote to memory of 388 2480 svchost.exe wininit.exe PID 2480 wrote to memory of 388 2480 svchost.exe wininit.exe PID 2480 wrote to memory of 388 2480 svchost.exe wininit.exe PID 2480 wrote to memory of 388 2480 svchost.exe wininit.exe PID 2480 wrote to memory of 388 2480 svchost.exe wininit.exe PID 2480 wrote to memory of 396 2480 svchost.exe csrss.exe PID 2480 wrote to memory of 396 2480 svchost.exe csrss.exe PID 2480 wrote to memory of 396 2480 svchost.exe csrss.exe PID 2480 wrote to memory of 396 2480 svchost.exe csrss.exe PID 2480 wrote to memory of 396 2480 svchost.exe csrss.exe PID 2480 wrote to memory of 436 2480 svchost.exe winlogon.exe PID 2480 wrote to memory of 436 2480 svchost.exe winlogon.exe PID 2480 wrote to memory of 436 2480 svchost.exe winlogon.exe PID 2480 wrote to memory of 436 2480 svchost.exe winlogon.exe PID 2480 wrote to memory of 436 2480 svchost.exe winlogon.exe PID 2480 wrote to memory of 480 2480 svchost.exe services.exe PID 2480 wrote to memory of 480 2480 svchost.exe services.exe PID 2480 wrote to memory of 480 2480 svchost.exe services.exe PID 2480 wrote to memory of 480 2480 svchost.exe services.exe
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\197d7acb5047dc2ec5444777f4098d41_JaffaCakes118.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\197d7acb5047dc2ec5444777f4098d41_JaffaCakes118.dll3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.htmlFilesize
206KB
MD540e5afc523bed999e3bdd3d40cca0b4f
SHA18d69d5599725e9d1ceaac36b052fe211df4b7d9c
SHA256398a2ebb9c12c8195447bd0239192803ebfa6ae642cfa77bc7cbd4ee7dc75922
SHA512691fe9fffbabdbaf453109a1852a180897e19474c8f9cf51ca56e68c589788c0329face7725a9f5e10aa7b241705bbf498b300a8445f85e1e4874c37024a7b8b
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.htmlFilesize
202KB
MD5d4171ae027c733049c8e591239c36781
SHA1e37844aacbee1df46340644f6fc89cf425970027
SHA256e98b023bf3f3aea16de5f1809251790fc0b7c984efac6fdad1a321adfbc61233
SHA5122cbd24069cbc6879f11c2666052c519811abf02fe6fb23d8547b1e977af5adb77611dea28ceb020f97884eaa3404220aaedd7327d9b184586a2dbe78dc6c6ee5
-
\Windows\SysWOW64\regsvr32mgr.exeFilesize
96KB
MD58c51fd9d6daa7b6137634de19a49452c
SHA1db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA256528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
SHA512b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837
-
memory/1456-19-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1456-11-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1456-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1456-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1456-20-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/1456-10-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1456-15-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1456-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1456-12-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2144-37-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/2144-68-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2144-563-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2144-39-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2144-36-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2144-40-0x0000000077BAF000-0x0000000077BB0000-memory.dmpFilesize
4KB
-
memory/2144-38-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2288-42-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2288-51-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2288-56-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2288-58-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/2288-59-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2288-64-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2288-60-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/2288-44-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2480-83-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2480-80-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2480-88-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2480-87-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/2480-86-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2480-85-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2480-84-0x00000000000F0000-0x00000000000F1000-memory.dmpFilesize
4KB
-
memory/2480-70-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2768-2-0x0000000074DE0000-0x0000000074E13000-memory.dmpFilesize
204KB
-
memory/2768-3-0x0000000000290000-0x00000000002C5000-memory.dmpFilesize
212KB