f460f7a6fb1b91fcb4cbcb9fd2a27833b9676f09bd134ede258c1939d46aa0a6

Analysis

max time kernel
150s
max time network
132s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f460f7a6fb1b91fcb4cbcb9fd2a27833b9676f09bd134ede258c1939d46aa0a6.dll
Size

400KB
MD5

481f5ea01682ac972e793612837764b4
SHA1

7906d315e6a4d2504cf8e05a7a80e344bde1365d
SHA256

f460f7a6fb1b91fcb4cbcb9fd2a27833b9676f09bd134ede258c1939d46aa0a6
SHA512

635a34ca89fcbedbb9e9f4a3a7d614838adf25974f06ad0d2ce809c017000e7df738845cf73febbea3d0c57282cd9991f62af7d81e68e7764eb6b9db20aed554
SSDEEP

6144:W0IEu0/l7rUdoqWMvjcw3sWSAoITM+NPUHFWnPbDicWQZKlI3:P79qXvjRc5AoIY+NPUlWnTDiYuA

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe"	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
2040	rundll32mgr.exe
1708	WaterMark.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2040-65-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1708-77-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1708-186-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Loads dropped DLL 4 IoCs

pid	Process
1176	rundll32.exe
1176	rundll32.exe
2040	rundll32mgr.exe
2040	rundll32mgr.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\dmlconf.dat	svchost.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px7AF.tmp	rundll32mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	svchost.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1708	WaterMark.exe
1708	WaterMark.exe
1708	WaterMark.exe
1708	WaterMark.exe
1708	WaterMark.exe
1708	WaterMark.exe
1708	WaterMark.exe
1708	WaterMark.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe
1188	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	WaterMark.exe
Token: SeDebugPrivilege	1188	svchost.exe
Token: SeDebugPrivilege	1708	WaterMark.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1336 wrote to memory of 1176	1336	rundll32.exe	27
PID 1176 wrote to memory of 2040	1176	rundll32.exe	28
PID 1176 wrote to memory of 2040	1176	rundll32.exe	28
PID 1176 wrote to memory of 2040	1176	rundll32.exe	28
PID 1176 wrote to memory of 2040	1176	rundll32.exe	28
PID 2040 wrote to memory of 1708	2040	rundll32mgr.exe	29
PID 2040 wrote to memory of 1708	2040	rundll32mgr.exe	29
PID 2040 wrote to memory of 1708	2040	rundll32mgr.exe	29
PID 2040 wrote to memory of 1708	2040	rundll32mgr.exe	29
PID 1708 wrote to memory of 1744	1708	WaterMark.exe	30
PID 1708 wrote to memory of 1744	1708	WaterMark.exe	30
PID 1708 wrote to memory of 1744	1708	WaterMark.exe	30
PID 1708 wrote to memory of 1744	1708	WaterMark.exe	30
PID 1708 wrote to memory of 1744	1708	WaterMark.exe	30
PID 1708 wrote to memory of 1744	1708	WaterMark.exe	30
PID 1708 wrote to memory of 1744	1708	WaterMark.exe	30
PID 1708 wrote to memory of 1744	1708	WaterMark.exe	30
PID 1708 wrote to memory of 1744	1708	WaterMark.exe	30
PID 1708 wrote to memory of 1744	1708	WaterMark.exe	30
PID 1708 wrote to memory of 1188	1708	WaterMark.exe	31
PID 1708 wrote to memory of 1188	1708	WaterMark.exe	31
PID 1708 wrote to memory of 1188	1708	WaterMark.exe	31
PID 1708 wrote to memory of 1188	1708	WaterMark.exe	31
PID 1708 wrote to memory of 1188	1708	WaterMark.exe	31
PID 1708 wrote to memory of 1188	1708	WaterMark.exe	31
PID 1708 wrote to memory of 1188	1708	WaterMark.exe	31
PID 1708 wrote to memory of 1188	1708	WaterMark.exe	31
PID 1708 wrote to memory of 1188	1708	WaterMark.exe	31
PID 1708 wrote to memory of 1188	1708	WaterMark.exe	31
PID 1188 wrote to memory of 260	1188	svchost.exe	7
PID 1188 wrote to memory of 260	1188	svchost.exe	7
PID 1188 wrote to memory of 260	1188	svchost.exe	7
PID 1188 wrote to memory of 260	1188	svchost.exe	7
PID 1188 wrote to memory of 260	1188	svchost.exe	7
PID 1188 wrote to memory of 336	1188	svchost.exe	6
PID 1188 wrote to memory of 336	1188	svchost.exe	6
PID 1188 wrote to memory of 336	1188	svchost.exe	6
PID 1188 wrote to memory of 336	1188	svchost.exe	6
PID 1188 wrote to memory of 336	1188	svchost.exe	6
PID 1188 wrote to memory of 372	1188	svchost.exe	5
PID 1188 wrote to memory of 372	1188	svchost.exe	5
PID 1188 wrote to memory of 372	1188	svchost.exe	5
PID 1188 wrote to memory of 372	1188	svchost.exe	5
PID 1188 wrote to memory of 372	1188	svchost.exe	5
PID 1188 wrote to memory of 384	1188	svchost.exe	4
PID 1188 wrote to memory of 384	1188	svchost.exe	4
PID 1188 wrote to memory of 384	1188	svchost.exe	4
PID 1188 wrote to memory of 384	1188	svchost.exe	4
PID 1188 wrote to memory of 384	1188	svchost.exe	4
PID 1188 wrote to memory of 420	1188	svchost.exe	3
PID 1188 wrote to memory of 420	1188	svchost.exe	3
PID 1188 wrote to memory of 420	1188	svchost.exe	3
PID 1188 wrote to memory of 420	1188	svchost.exe	3
PID 1188 wrote to memory of 420	1188	svchost.exe	3
PID 1188 wrote to memory of 464	1188	svchost.exe	2
PID 1188 wrote to memory of 464	1188	svchost.exe	2
PID 1188 wrote to memory of 464	1188	svchost.exe	2
PID 1188 wrote to memory of 464	1188	svchost.exe	2

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:668
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:276
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1272
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1268
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1116
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1068
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:368
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:872
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:828
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:792
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:748
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:592

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:336

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:260

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1256
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f460f7a6fb1b91fcb4cbcb9fd2a27833b9676f09bd134ede258c1939d46aa0a6.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\f460f7a6fb1b91fcb4cbcb9fd2a27833b9676f09bd134ede258c1939d46aa0a6.dll,#1
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Windows\SysWOW64\rundll32mgr.exe
      C:\Windows\SysWOW64\rundll32mgr.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:2040
    - - C:\Program Files (x86)\Microsoft\WaterMark.exe
        
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1708
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Modifies WinLogon for persistence
        Drops file in System32 directory
        Drops file in Program Files directory
        
        PID:1744
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1188

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:112

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
65KB

MD5
7124ae1fb9a89a721e39bdb970ccd26b

SHA1
2bfb100d0eefcfb449cf272390077f88462c6d28

SHA256
bb175585968d8c0af884de4bf645d6312f33d0026d9890ecb9749469b6646b86

SHA512
990f5b8c3e2628d1af5dcb6b8a881eed8a2f176ba09cf28553abe2dda18f7f3fda92bd87a54f1d435015c061aa880039408179e8157fccbe4cc955b4a8e5e4b8

Download Submit
C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
65KB

MD5
7124ae1fb9a89a721e39bdb970ccd26b

SHA1
2bfb100d0eefcfb449cf272390077f88462c6d28

SHA256
bb175585968d8c0af884de4bf645d6312f33d0026d9890ecb9749469b6646b86

SHA512
990f5b8c3e2628d1af5dcb6b8a881eed8a2f176ba09cf28553abe2dda18f7f3fda92bd87a54f1d435015c061aa880039408179e8157fccbe4cc955b4a8e5e4b8

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
65KB

MD5
7124ae1fb9a89a721e39bdb970ccd26b

SHA1
2bfb100d0eefcfb449cf272390077f88462c6d28

SHA256
bb175585968d8c0af884de4bf645d6312f33d0026d9890ecb9749469b6646b86

SHA512
990f5b8c3e2628d1af5dcb6b8a881eed8a2f176ba09cf28553abe2dda18f7f3fda92bd87a54f1d435015c061aa880039408179e8157fccbe4cc955b4a8e5e4b8

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
65KB

MD5
7124ae1fb9a89a721e39bdb970ccd26b

SHA1
2bfb100d0eefcfb449cf272390077f88462c6d28

SHA256
bb175585968d8c0af884de4bf645d6312f33d0026d9890ecb9749469b6646b86

SHA512
990f5b8c3e2628d1af5dcb6b8a881eed8a2f176ba09cf28553abe2dda18f7f3fda92bd87a54f1d435015c061aa880039408179e8157fccbe4cc955b4a8e5e4b8

Download Submit
\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
65KB

MD5
7124ae1fb9a89a721e39bdb970ccd26b

SHA1
2bfb100d0eefcfb449cf272390077f88462c6d28

SHA256
bb175585968d8c0af884de4bf645d6312f33d0026d9890ecb9749469b6646b86

SHA512
990f5b8c3e2628d1af5dcb6b8a881eed8a2f176ba09cf28553abe2dda18f7f3fda92bd87a54f1d435015c061aa880039408179e8157fccbe4cc955b4a8e5e4b8

Download Submit
\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
65KB

MD5
7124ae1fb9a89a721e39bdb970ccd26b

SHA1
2bfb100d0eefcfb449cf272390077f88462c6d28

SHA256
bb175585968d8c0af884de4bf645d6312f33d0026d9890ecb9749469b6646b86

SHA512
990f5b8c3e2628d1af5dcb6b8a881eed8a2f176ba09cf28553abe2dda18f7f3fda92bd87a54f1d435015c061aa880039408179e8157fccbe4cc955b4a8e5e4b8

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
65KB

MD5
7124ae1fb9a89a721e39bdb970ccd26b

SHA1
2bfb100d0eefcfb449cf272390077f88462c6d28

SHA256
bb175585968d8c0af884de4bf645d6312f33d0026d9890ecb9749469b6646b86

SHA512
990f5b8c3e2628d1af5dcb6b8a881eed8a2f176ba09cf28553abe2dda18f7f3fda92bd87a54f1d435015c061aa880039408179e8157fccbe4cc955b4a8e5e4b8

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
65KB

MD5
7124ae1fb9a89a721e39bdb970ccd26b

SHA1
2bfb100d0eefcfb449cf272390077f88462c6d28

SHA256
bb175585968d8c0af884de4bf645d6312f33d0026d9890ecb9749469b6646b86

SHA512
990f5b8c3e2628d1af5dcb6b8a881eed8a2f176ba09cf28553abe2dda18f7f3fda92bd87a54f1d435015c061aa880039408179e8157fccbe4cc955b4a8e5e4b8

Download Submit
memory/1176-55-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/1188-84-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1188-81-0x0000000020010000-0x000000002001B000-memory.dmp

Filesize
44KB

Download
memory/1708-77-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1708-136-0x0000000020021000-0x0000000020028000-memory.dmp

Filesize
28KB

Download
memory/1708-186-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1708-137-0x0000000020020000-0x000000002002B000-memory.dmp

Filesize
44KB

Download
memory/1708-78-0x0000000000220000-0x0000000000241000-memory.dmp

Filesize
132KB

Download
memory/1744-79-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/1744-69-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/1744-73-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/1744-187-0x0000000020010000-0x0000000020022000-memory.dmp

Filesize
72KB

Download
memory/2040-65-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2040-66-0x00000000003C0000-0x00000000003E1000-memory.dmp

Filesize
132KB

Download