Analysis
-
max time kernel
1569s -
max time network
1580s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
05-06-2022 17:27
Static task
static1
Behavioral task
behavioral1
Sample
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exe
Resource
win7-20220414-en
General
-
Target
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exe
-
Size
332KB
-
MD5
cf547bf62ab1d3bf361ddf6dcd59c55f
-
SHA1
8737abef83971f23e1a2d2c304e997b39073e4fd
-
SHA256
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed
-
SHA512
239513eb00107785dd7165170832aed7ccdebedd0464d74db800af95a3aa52ef0bc84e4e201221f98dc8a142d25da283dca19fe84376499998e037f320d668d1
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe -
Processes:
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe -
Processes:
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe -
Executes dropped EXE 2 IoCs
Processes:
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exeWaterMark.exepid process 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe 4632 WaterMark.exe -
Processes:
resource yara_rule behavioral2/memory/1060-130-0x0000000000400000-0x0000000000583000-memory.dmp upx behavioral2/memory/3196-140-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3196-135-0x0000000003350000-0x000000000437A000-memory.dmp upx behavioral2/memory/3196-141-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3196-137-0x0000000004780000-0x000000000580E000-memory.dmp upx behavioral2/memory/3196-145-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3196-150-0x0000000004780000-0x000000000580E000-memory.dmp upx behavioral2/memory/3196-149-0x0000000003350000-0x000000000437A000-memory.dmp upx behavioral2/memory/4632-153-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4632-152-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4632-156-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4632-157-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1060-158-0x0000000000400000-0x0000000000583000-memory.dmp upx behavioral2/memory/4632-159-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Processes:
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe -
Processes:
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe -
Drops file in Program Files directory 3 IoCs
Processes:
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exedescription ioc process File created C:\Program Files (x86)\Microsoft\WaterMark.exe 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe File opened for modification C:\Program Files (x86)\Microsoft\pxA899.tmp 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe -
Drops file in Windows directory 1 IoCs
Processes:
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe -
Processes:
IEXPLORE.EXEiexplore.exeiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "361215056" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2925493340" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2925493340" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D972D16F-E4F4-11EC-AD90-7E7E0F8D8E49} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30963969" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30963969" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exeWaterMark.exepid process 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe 4632 WaterMark.exe 4632 WaterMark.exe 4632 WaterMark.exe 4632 WaterMark.exe 4632 WaterMark.exe 4632 WaterMark.exe 4632 WaterMark.exe 4632 WaterMark.exe 4632 WaterMark.exe 4632 WaterMark.exe 4632 WaterMark.exe 4632 WaterMark.exe 4632 WaterMark.exe 4632 WaterMark.exe 4632 WaterMark.exe 4632 WaterMark.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 2948 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
Processes:
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exeWaterMark.exedescription pid process Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe Token: SeDebugPrivilege 4632 WaterMark.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2948 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exeiexplore.exeIEXPLORE.EXEpid process 1060 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exe 2948 iexplore.exe 2948 iexplore.exe 4056 IEXPLORE.EXE 4056 IEXPLORE.EXE 4056 IEXPLORE.EXE 4056 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exeWaterMark.exepid process 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe 4632 WaterMark.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exe8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exeWaterMark.exeiexplore.exedescription pid process target process PID 1060 wrote to memory of 3196 1060 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exe 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe PID 1060 wrote to memory of 3196 1060 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exe 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe PID 1060 wrote to memory of 3196 1060 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exe 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe PID 3196 wrote to memory of 764 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe fontdrvhost.exe PID 3196 wrote to memory of 772 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe fontdrvhost.exe PID 3196 wrote to memory of 1016 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe dwm.exe PID 3196 wrote to memory of 4632 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe WaterMark.exe PID 3196 wrote to memory of 4632 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe WaterMark.exe PID 3196 wrote to memory of 4632 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe WaterMark.exe PID 3196 wrote to memory of 2440 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe sihost.exe PID 3196 wrote to memory of 2560 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe svchost.exe PID 3196 wrote to memory of 2800 3196 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe taskhostw.exe PID 4632 wrote to memory of 1976 4632 WaterMark.exe svchost.exe PID 4632 wrote to memory of 1976 4632 WaterMark.exe svchost.exe PID 4632 wrote to memory of 1976 4632 WaterMark.exe svchost.exe PID 4632 wrote to memory of 1976 4632 WaterMark.exe svchost.exe PID 4632 wrote to memory of 1976 4632 WaterMark.exe svchost.exe PID 4632 wrote to memory of 1976 4632 WaterMark.exe svchost.exe PID 4632 wrote to memory of 1976 4632 WaterMark.exe svchost.exe PID 4632 wrote to memory of 1976 4632 WaterMark.exe svchost.exe PID 4632 wrote to memory of 1976 4632 WaterMark.exe svchost.exe PID 4632 wrote to memory of 2948 4632 WaterMark.exe iexplore.exe PID 4632 wrote to memory of 2948 4632 WaterMark.exe iexplore.exe PID 4632 wrote to memory of 3284 4632 WaterMark.exe iexplore.exe PID 4632 wrote to memory of 3284 4632 WaterMark.exe iexplore.exe PID 2948 wrote to memory of 4056 2948 iexplore.exe IEXPLORE.EXE PID 2948 wrote to memory of 4056 2948 iexplore.exe IEXPLORE.EXE PID 2948 wrote to memory of 4056 2948 iexplore.exe IEXPLORE.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1016
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exe"C:\Users\Admin\AppData\Local\Temp\8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428ed.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exeC:\Users\Admin\AppData\Local\Temp\8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exe2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3196 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵PID:1976
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4056 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
PID:3284
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2560
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2440
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:764
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
284KB
MD54746b44bc72faa71a6f049b817e26349
SHA1c1a11bcda98fe03874e9befced4acc93bac61949
SHA256adbc97779be46480282600b03a9970b73132b9f32e0b1a9220ceae83224a53b6
SHA51269fe317d8ff1a337a868ff02560faf6ee1cd7ba4e49e0d6e3e0409b5dbd3e47de42cad94e419abc40b5c240658b839f804354d25d1dc9622818bcdfa6dec0ebf
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
284KB
MD54746b44bc72faa71a6f049b817e26349
SHA1c1a11bcda98fe03874e9befced4acc93bac61949
SHA256adbc97779be46480282600b03a9970b73132b9f32e0b1a9220ceae83224a53b6
SHA51269fe317d8ff1a337a868ff02560faf6ee1cd7ba4e49e0d6e3e0409b5dbd3e47de42cad94e419abc40b5c240658b839f804354d25d1dc9622818bcdfa6dec0ebf
-
C:\Users\Admin\AppData\Local\Temp\8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exeFilesize
284KB
MD54746b44bc72faa71a6f049b817e26349
SHA1c1a11bcda98fe03874e9befced4acc93bac61949
SHA256adbc97779be46480282600b03a9970b73132b9f32e0b1a9220ceae83224a53b6
SHA51269fe317d8ff1a337a868ff02560faf6ee1cd7ba4e49e0d6e3e0409b5dbd3e47de42cad94e419abc40b5c240658b839f804354d25d1dc9622818bcdfa6dec0ebf
-
C:\Users\Admin\AppData\Local\Temp\8969309b9e0a0a4dc6a958d51f34637283a80a058dd1ce977a8d1acc9c2428edmgr.exeFilesize
284KB
MD54746b44bc72faa71a6f049b817e26349
SHA1c1a11bcda98fe03874e9befced4acc93bac61949
SHA256adbc97779be46480282600b03a9970b73132b9f32e0b1a9220ceae83224a53b6
SHA51269fe317d8ff1a337a868ff02560faf6ee1cd7ba4e49e0d6e3e0409b5dbd3e47de42cad94e419abc40b5c240658b839f804354d25d1dc9622818bcdfa6dec0ebf
-
memory/1060-158-0x0000000000400000-0x0000000000583000-memory.dmpFilesize
1.5MB
-
memory/1060-130-0x0000000000400000-0x0000000000583000-memory.dmpFilesize
1.5MB
-
memory/1976-155-0x0000000000000000-mapping.dmp
-
memory/3196-145-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3196-140-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3196-131-0x0000000000000000-mapping.dmp
-
memory/3196-141-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3196-135-0x0000000003350000-0x000000000437A000-memory.dmpFilesize
16.2MB
-
memory/3196-150-0x0000000004780000-0x000000000580E000-memory.dmpFilesize
16.6MB
-
memory/3196-149-0x0000000003350000-0x000000000437A000-memory.dmpFilesize
16.2MB
-
memory/3196-137-0x0000000004780000-0x000000000580E000-memory.dmpFilesize
16.6MB
-
memory/4632-153-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4632-152-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4632-156-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4632-157-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4632-142-0x0000000000000000-mapping.dmp
-
memory/4632-159-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB