a7ecd5816f5da87f214918e9c389ca55e4259fad0b6c978c5ef0b70c95f0f0e3

General

Target

a7ecd5816f5da87f214918e9c389ca55e4259fad0b6c978c5ef0b70c95f0f0e3.dll
Size

212KB
MD5

40f196f57b767669ccd72bb230bf7c30
SHA1

15551a0fc08f834a8bcbe090ecf2aa5f25e0e1b5
SHA256

a7ecd5816f5da87f214918e9c389ca55e4259fad0b6c978c5ef0b70c95f0f0e3
SHA512

eb39cc463d71f1735ff2482141d69e2553d1ed4f3498a34cf5e870fa0ed12095c05a71bfc03cc10c865ed02d8193155d3c8aa9915213a267ae7d206be1f25db1
SSDEEP

3072:En4cV8gf2u41Z5tKlwfSrohytZZ4fGEbCP:24y8gOl2iSrowtZZmK

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2720	rundll32mgr.exe
5044	WaterMark.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2720-138-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral2/memory/5044-143-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral2/memory/5044-145-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral2/memory/5044-146-0x0000000000400000-0x0000000000427000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\px6527.tmp	rundll32mgr.exe
File created	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WaterMark.exe	rundll32mgr.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4132	4252	WerFault.exe	84

Modifies Internet Explorer settings 1 TTPs 19 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BAA0E26B-4909-11ED-B696-520B3B914C01} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372219140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5044	WaterMark.exe
5044	WaterMark.exe
5044	WaterMark.exe
5044	WaterMark.exe
5044	WaterMark.exe
5044	WaterMark.exe
5044	WaterMark.exe
5044	WaterMark.exe
5044	WaterMark.exe
5044	WaterMark.exe
5044	WaterMark.exe
5044	WaterMark.exe
5044	WaterMark.exe
5044	WaterMark.exe
5044	WaterMark.exe
5044	WaterMark.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3064	iexplore.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5044	WaterMark.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3064	iexplore.exe
3064	iexplore.exe
4800	IEXPLORE.EXE
4800	IEXPLORE.EXE
4800	IEXPLORE.EXE
4800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2124	2432	rundll32.exe	80
PID 2432 wrote to memory of 2124	2432	rundll32.exe	80
PID 2432 wrote to memory of 2124	2432	rundll32.exe	80
PID 2124 wrote to memory of 2720	2124	rundll32.exe	82
PID 2124 wrote to memory of 2720	2124	rundll32.exe	82
PID 2124 wrote to memory of 2720	2124	rundll32.exe	82
PID 2720 wrote to memory of 5044	2720	rundll32mgr.exe	83
PID 2720 wrote to memory of 5044	2720	rundll32mgr.exe	83
PID 2720 wrote to memory of 5044	2720	rundll32mgr.exe	83
PID 5044 wrote to memory of 4252	5044	WaterMark.exe	84
PID 5044 wrote to memory of 4252	5044	WaterMark.exe	84
PID 5044 wrote to memory of 4252	5044	WaterMark.exe	84
PID 5044 wrote to memory of 4252	5044	WaterMark.exe	84
PID 5044 wrote to memory of 4252	5044	WaterMark.exe	84
PID 5044 wrote to memory of 4252	5044	WaterMark.exe	84
PID 5044 wrote to memory of 4252	5044	WaterMark.exe	84
PID 5044 wrote to memory of 4252	5044	WaterMark.exe	84
PID 5044 wrote to memory of 4252	5044	WaterMark.exe	84
PID 5044 wrote to memory of 4144	5044	WaterMark.exe	88
PID 5044 wrote to memory of 4144	5044	WaterMark.exe	88
PID 5044 wrote to memory of 3064	5044	WaterMark.exe	89
PID 5044 wrote to memory of 3064	5044	WaterMark.exe	89
PID 3064 wrote to memory of 4800	3064	iexplore.exe	90
PID 3064 wrote to memory of 4800	3064	iexplore.exe	90
PID 3064 wrote to memory of 4800	3064	iexplore.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a7ecd5816f5da87f214918e9c389ca55e4259fad0b6c978c5ef0b70c95f0f0e3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a7ecd5816f5da87f214918e9c389ca55e4259fad0b6c978c5ef0b70c95f0f0e3.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Program Files (x86)\Microsoft\WaterMark.exe
      "C:\Program Files (x86)\Microsoft\WaterMark.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5044
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\system32\svchost.exe
        5⤵
        
        PID:4252
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 208
        6⤵
        Program crash
        
        PID:4132
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        
        PID:4144
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3064
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3064 CREDAT:17410 /prefetch:2
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4252 -ip 4252
1⤵
PID:4952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
121KB

MD5
4b1a46af16065ad354950f16a337133e

SHA1
68678358e7414fdffd57d4ed072d2bb79e7687ec

SHA256
d61b810f35e920beaf7b74180a0be0f92e0741746f7b99c247c37a577b8d6f7e

SHA512
2edd70fd2eb835f9fafb88e0b7ca84a03dfb6b54c017fac26817b769535e5e55073e26f9964f7847f091f0bc24959836f1dbe586896ac34b3c543870fb0bc88e

Download Submit
C:\Program Files (x86)\Microsoft\WaterMark.exe

Filesize
121KB

MD5
4b1a46af16065ad354950f16a337133e

SHA1
68678358e7414fdffd57d4ed072d2bb79e7687ec

SHA256
d61b810f35e920beaf7b74180a0be0f92e0741746f7b99c247c37a577b8d6f7e

SHA512
2edd70fd2eb835f9fafb88e0b7ca84a03dfb6b54c017fac26817b769535e5e55073e26f9964f7847f091f0bc24959836f1dbe586896ac34b3c543870fb0bc88e

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
121KB

MD5
4b1a46af16065ad354950f16a337133e

SHA1
68678358e7414fdffd57d4ed072d2bb79e7687ec

SHA256
d61b810f35e920beaf7b74180a0be0f92e0741746f7b99c247c37a577b8d6f7e

SHA512
2edd70fd2eb835f9fafb88e0b7ca84a03dfb6b54c017fac26817b769535e5e55073e26f9964f7847f091f0bc24959836f1dbe586896ac34b3c543870fb0bc88e

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
121KB

MD5
4b1a46af16065ad354950f16a337133e

SHA1
68678358e7414fdffd57d4ed072d2bb79e7687ec

SHA256
d61b810f35e920beaf7b74180a0be0f92e0741746f7b99c247c37a577b8d6f7e

SHA512
2edd70fd2eb835f9fafb88e0b7ca84a03dfb6b54c017fac26817b769535e5e55073e26f9964f7847f091f0bc24959836f1dbe586896ac34b3c543870fb0bc88e

Download Submit
memory/2720-138-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2720-140-0x0000000000530000-0x0000000000557000-memory.dmp

Filesize
156KB

Download
memory/5044-143-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/5044-144-0x0000000000640000-0x0000000000667000-memory.dmp

Filesize
156KB

Download
memory/5044-145-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/5044-146-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing