ramnit | 6bbd3937f7b0c3c57ddc663176a4245745a920f71a5f699924d7e26315759c5d

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19c3974a646ad7ea6852c711dc23f6b9_JaffaCakes118.dll
Size

161KB
MD5

19c3974a646ad7ea6852c711dc23f6b9
SHA1

4b7b510bc717b05204d6fef0cd480f2e3ca77f8b
SHA256

6bbd3937f7b0c3c57ddc663176a4245745a920f71a5f699924d7e26315759c5d
SHA512

5e4dc4e11d05b88148f6699f926f16d324901989748c5ae58593f9d914ed11702da5accfc87e4be1d780d6dcb2d9da26a23a368189d232704a0e483a7f4c0828
SSDEEP

3072:UTU56gVxj27Neum+uemO5WjmmmmmmmmmmmmmmmmmmmrCQmmmmmmmmmmmmmmmmmmK:n4Hm+uemO5Wjmmmmmmmmmmmmmmmmmmmc

Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 2 IoCs

Processes:

regsvr32mgr.exeWaterMark.exe

pid process

1764 regsvr32mgr.exe
1204 WaterMark.exe
Loads dropped DLL 4 IoCs

Processes:

regsvr32.exeregsvr32mgr.exe

pid process

1732 regsvr32.exe
1732 regsvr32.exe
1764 regsvr32mgr.exe
1764 regsvr32mgr.exe

pid	process
1764	regsvr32mgr.exe
1204	WaterMark.exe

pid	process
1732	regsvr32.exe
1732	regsvr32.exe
1764	regsvr32mgr.exe
1764	regsvr32mgr.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1764-12-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1764-13-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1764-21-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1764-16-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1764-15-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1764-14-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1764-11-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1204-34-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/1204-39-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1204-567-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

Processes:

regsvr32.exesvchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\regsvr32mgr.exe	regsvr32.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

Drops file in Program Files directory 64 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Conversion.v3.5.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\settings.html	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2native.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\deploy.dll	svchost.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\ReachFramework.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Design.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\decora-sse.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_wav_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\settings.html	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationTypes.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Conversion.v3.5.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\pack200.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Windows.Presentation.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Design.resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProvider.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsBase.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libchain_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msaddsr.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libwingdi_plugin.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\calendar.html	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\penjpn.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i422_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\ReachFramework.resources.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Linq.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\liblogo_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	svchost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\osclientcerts.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationFramework.resources.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\hxdsui.dll	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\hxdsui.dll	svchost.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\Chess.exe	svchost.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace2.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\settings.html	svchost.exe
File opened for modification	C:\Program Files\Internet Explorer\perf_nt.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\prism-d3d.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libaom_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Java\jre7\bin\WindowsAccessBridge-64.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Management.Instrumentation.Resources.dll	svchost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	svchost.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\settings.html	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEWDAT.DLL	svchost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

Processes:

WaterMark.exesvchost.exe

pid	process
1204	WaterMark.exe
1204	WaterMark.exe
1204	WaterMark.exe
1204	WaterMark.exe
1204	WaterMark.exe
1204	WaterMark.exe
1204	WaterMark.exe
1204	WaterMark.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe
2536	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WaterMark.exesvchost.exe

description pid process

Token: SeDebugPrivilege 1204 WaterMark.exe
Token: SeDebugPrivilege 2536 svchost.exe
Token: SeDebugPrivilege 1204 WaterMark.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

regsvr32mgr.exeWaterMark.exe

pid process

1764 regsvr32mgr.exe
1204 WaterMark.exe

description	pid	process
Token: SeDebugPrivilege	1204	WaterMark.exe
Token: SeDebugPrivilege	2536	svchost.exe
Token: SeDebugPrivilege	1204	WaterMark.exe

pid	process
1764	regsvr32mgr.exe
1204	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

regsvr32.exeregsvr32.exeregsvr32mgr.exeWaterMark.exesvchost.exe

description	pid	process	target process
PID 2740 wrote to memory of 1732	2740	regsvr32.exe	regsvr32.exe
PID 2740 wrote to memory of 1732	2740	regsvr32.exe	regsvr32.exe
PID 2740 wrote to memory of 1732	2740	regsvr32.exe	regsvr32.exe
PID 2740 wrote to memory of 1732	2740	regsvr32.exe	regsvr32.exe
PID 2740 wrote to memory of 1732	2740	regsvr32.exe	regsvr32.exe
PID 2740 wrote to memory of 1732	2740	regsvr32.exe	regsvr32.exe
PID 2740 wrote to memory of 1732	2740	regsvr32.exe	regsvr32.exe
PID 1732 wrote to memory of 1764	1732	regsvr32.exe	regsvr32mgr.exe
PID 1732 wrote to memory of 1764	1732	regsvr32.exe	regsvr32mgr.exe
PID 1732 wrote to memory of 1764	1732	regsvr32.exe	regsvr32mgr.exe
PID 1732 wrote to memory of 1764	1732	regsvr32.exe	regsvr32mgr.exe
PID 1764 wrote to memory of 1204	1764	regsvr32mgr.exe	WaterMark.exe
PID 1764 wrote to memory of 1204	1764	regsvr32mgr.exe	WaterMark.exe
PID 1764 wrote to memory of 1204	1764	regsvr32mgr.exe	WaterMark.exe
PID 1764 wrote to memory of 1204	1764	regsvr32mgr.exe	WaterMark.exe
PID 1204 wrote to memory of 2816	1204	WaterMark.exe	svchost.exe
PID 1204 wrote to memory of 2816	1204	WaterMark.exe	svchost.exe
PID 1204 wrote to memory of 2816	1204	WaterMark.exe	svchost.exe
PID 1204 wrote to memory of 2816	1204	WaterMark.exe	svchost.exe
PID 1204 wrote to memory of 2816	1204	WaterMark.exe	svchost.exe
PID 1204 wrote to memory of 2816	1204	WaterMark.exe	svchost.exe
PID 1204 wrote to memory of 2816	1204	WaterMark.exe	svchost.exe
PID 1204 wrote to memory of 2816	1204	WaterMark.exe	svchost.exe
PID 1204 wrote to memory of 2816	1204	WaterMark.exe	svchost.exe
PID 1204 wrote to memory of 2816	1204	WaterMark.exe	svchost.exe
PID 1204 wrote to memory of 2536	1204	WaterMark.exe	svchost.exe
PID 1204 wrote to memory of 2536	1204	WaterMark.exe	svchost.exe
PID 1204 wrote to memory of 2536	1204	WaterMark.exe	svchost.exe
PID 1204 wrote to memory of 2536	1204	WaterMark.exe	svchost.exe
PID 1204 wrote to memory of 2536	1204	WaterMark.exe	svchost.exe
PID 1204 wrote to memory of 2536	1204	WaterMark.exe	svchost.exe
PID 1204 wrote to memory of 2536	1204	WaterMark.exe	svchost.exe
PID 1204 wrote to memory of 2536	1204	WaterMark.exe	svchost.exe
PID 1204 wrote to memory of 2536	1204	WaterMark.exe	svchost.exe
PID 1204 wrote to memory of 2536	1204	WaterMark.exe	svchost.exe
PID 2536 wrote to memory of 256	2536	svchost.exe	smss.exe
PID 2536 wrote to memory of 256	2536	svchost.exe	smss.exe
PID 2536 wrote to memory of 256	2536	svchost.exe	smss.exe
PID 2536 wrote to memory of 256	2536	svchost.exe	smss.exe
PID 2536 wrote to memory of 256	2536	svchost.exe	smss.exe
PID 2536 wrote to memory of 332	2536	svchost.exe	csrss.exe
PID 2536 wrote to memory of 332	2536	svchost.exe	csrss.exe
PID 2536 wrote to memory of 332	2536	svchost.exe	csrss.exe
PID 2536 wrote to memory of 332	2536	svchost.exe	csrss.exe
PID 2536 wrote to memory of 332	2536	svchost.exe	csrss.exe
PID 2536 wrote to memory of 372	2536	svchost.exe	wininit.exe
PID 2536 wrote to memory of 372	2536	svchost.exe	wininit.exe
PID 2536 wrote to memory of 372	2536	svchost.exe	wininit.exe
PID 2536 wrote to memory of 372	2536	svchost.exe	wininit.exe
PID 2536 wrote to memory of 372	2536	svchost.exe	wininit.exe
PID 2536 wrote to memory of 396	2536	svchost.exe	csrss.exe
PID 2536 wrote to memory of 396	2536	svchost.exe	csrss.exe
PID 2536 wrote to memory of 396	2536	svchost.exe	csrss.exe
PID 2536 wrote to memory of 396	2536	svchost.exe	csrss.exe
PID 2536 wrote to memory of 396	2536	svchost.exe	csrss.exe
PID 2536 wrote to memory of 432	2536	svchost.exe	winlogon.exe
PID 2536 wrote to memory of 432	2536	svchost.exe	winlogon.exe
PID 2536 wrote to memory of 432	2536	svchost.exe	winlogon.exe
PID 2536 wrote to memory of 432	2536	svchost.exe	winlogon.exe
PID 2536 wrote to memory of 432	2536	svchost.exe	winlogon.exe
PID 2536 wrote to memory of 480	2536	svchost.exe	services.exe
PID 2536 wrote to memory of 480	2536	svchost.exe	services.exe
PID 2536 wrote to memory of 480	2536	svchost.exe	services.exe
PID 2536 wrote to memory of 480	2536	svchost.exe	services.exe

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:256

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
2⤵
PID:480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
3⤵
PID:600

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
4⤵
PID:1604

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
4⤵
PID:2236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
3⤵
PID:680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
3⤵
PID:752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
3⤵
PID:816

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
4⤵
PID:1048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
3⤵
PID:856

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
4⤵
PID:2776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
3⤵
PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
3⤵
PID:280

C:\Windows\system32\taskhost.exe
"taskhost.exe"
3⤵
PID:1072

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
3⤵
PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
3⤵
PID:1164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
3⤵
PID:2408

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
3⤵
PID:3048

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
2⤵
PID:488

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:496

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:396

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1128

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\19c3974a646ad7ea6852c711dc23f6b9_JaffaCakes118.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\19c3974a646ad7ea6852c711dc23f6b9_JaffaCakes118.dll
3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\regsvr32mgr.exe
C:\Windows\SysWOW64\regsvr32mgr.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1764

C:\Program Files (x86)\Microsoft\WaterMark.exe
"C:\Program Files (x86)\Microsoft\WaterMark.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
PID:2816

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2536

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize
197KB

MD5
2ef50be556348bc0a2f4ab8458441e48

SHA1
af3af574e164e4c5c1e66a7bf20a8c189e54b942

SHA256
1a57e99b8c5c5e9ac000f238f37f40462eeb90dabb4741e576d855abb15d3169

SHA512
6ff3bd7af2bd7b81c17f63e81fd22cd90d51980c18633afef15074312e5711ff53340076fd2b2ceb9e909d81be62badb6164cbba0b0a312e59af16771e0b4d19

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize
193KB

MD5
9548b3ce20dfd1b1663c74ab473b2225

SHA1
a7c5ea812cba26b013dc2654c08c080e56bd4387

SHA256
2519d44419af7801062fae09c5aaa3588d04de5b63511277d46442eed5118e91

SHA512
b9cfa5f860568014485de8927c829c72ea0358da82097e5d7674d572cf39601b0c551c3a8e9a844d2acc2ccd33efc18fde78089df5b5eb17c26ccb95955e14ca

Download Submit
\Windows\SysWOW64\regsvr32mgr.exe
Filesize
92KB

MD5
9efa35f79704a13f682a13efc6770276

SHA1
e75cb9eac6f47407baaeac4b6f342e9b34385d02

SHA256
98b86f0605c851a7ba65f27c98831ef55195370e20b181d8faa1131e4aee6387

SHA512
83a48096a9898482f7069f8ec0372b1dec3145c4c13edd91aa7ea76328544b6bb0c7bb56aebd091f26faaf078e8dc8d560047073911e0a11db62acfc74058874

Download Submit
memory/1204-34-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1204-81-0x000000007743F000-0x0000000077440000-memory.dmp

Filesize
4KB

Download
memory/1204-70-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/1204-567-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1204-51-0x000000007743F000-0x0000000077440000-memory.dmp

Filesize
4KB

Download
memory/1204-40-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/1204-39-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1732-2-0x0000000074670000-0x000000007469B000-memory.dmp

Filesize
172KB

Download
memory/1732-3-0x0000000000190000-0x00000000001B8000-memory.dmp

Filesize
160KB

Download
memory/1764-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1764-11-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1764-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1764-15-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1764-16-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1764-19-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1764-21-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1764-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1764-10-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2536-87-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2536-90-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2536-222-0x0000000077440000-0x0000000077441000-memory.dmp

Filesize
4KB

Download
memory/2536-91-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2536-88-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2536-72-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2536-86-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2536-82-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2536-89-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/2816-59-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2816-61-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2816-58-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2816-56-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2816-66-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2816-57-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2816-52-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2816-1008-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2816-42-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2816-44-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download