Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 14:38
Static task
static1
Behavioral task
behavioral1
Sample
3235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450.exe
Resource
win10v2004-20221111-en
General
-
Target
3235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450.exe
-
Size
392KB
-
MD5
e05eb29d1eecf974d032c886689e03b3
-
SHA1
ae914d60f8671374025a764328c3f2069c068257
-
SHA256
3235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450
-
SHA512
7f5b603e3041629b6a4a4c9c2b3728715c8344c9312003ec2650cab3e94ad9f0c7a0956aad044776e30102f0a48303df85d459aa2b66695ee3b0b1412fe43d45
-
SSDEEP
6144:AnGX7Qbd1P6YpQ3LbrSZ/1vL99Vay06N9JUo923TNclWk05S24+:AkcGkQ3EVayl9aobT23
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
water.exepid process 1400 water.exe -
Deletes itself 1 IoCs
Processes:
water.exepid process 1400 water.exe -
Loads dropped DLL 1 IoCs
Processes:
3235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450.exepid process 2000 3235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
water.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run water.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\water.exe" water.exe -
Drops file in System32 directory 3 IoCs
Processes:
description ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\whr458da.db File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\whr458da.db File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat -
Drops file in Windows directory 2 IoCs
Processes:
3235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450.exewater.exedescription ioc process File opened for modification C:\Windows\3235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450.INI 3235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450.exe File opened for modification C:\Windows\water.INI water.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
description ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-8f-0e-83-41-a4\WpadDecision = "0" Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0011000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FAF0CD48-6074-4932-8B8A-7B76327B867C}\WpadDecisionTime = 20f046dc51ffd801 Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FAF0CD48-6074-4932-8B8A-7B76327B867C}\WpadNetworkName = "Network 2" Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FAF0CD48-6074-4932-8B8A-7B76327B867C}\ce-8f-0e-83-41-a4 Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FAF0CD48-6074-4932-8B8A-7B76327B867C}\WpadDecisionReason = "1" Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FAF0CD48-6074-4932-8B8A-7B76327B867C} Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FAF0CD48-6074-4932-8B8A-7B76327B867C}\WpadDecision = "0" Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-8f-0e-83-41-a4\WpadDecisionReason = "1" Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-8f-0e-83-41-a4\WpadDecisionTime = 20f046dc51ffd801 Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-8f-0e-83-41-a4 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
water.exepid process 1400 water.exe 1400 water.exe 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
water.exepid process 1400 water.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
water.exedescription pid process Token: SeDebugPrivilege 1400 water.exe Token: SeDebugPrivilege 600 -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
3235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450.exewater.exepid process 2000 3235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450.exe 2000 3235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450.exe 1400 water.exe 1400 water.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
3235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450.exewater.exepid process 2000 3235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450.exe 1400 water.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
3235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450.exedescription pid process target process PID 2000 wrote to memory of 1400 2000 3235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450.exe water.exe PID 2000 wrote to memory of 1400 2000 3235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450.exe water.exe PID 2000 wrote to memory of 1400 2000 3235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450.exe water.exe PID 2000 wrote to memory of 1400 2000 3235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450.exe water.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450.exe"C:\Users\Admin\AppData\Local\Temp\3235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\water.exeC:\Users\Admin\AppData\Local\Temp\3235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450.exe2⤵
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\water.exeFilesize
392KB
MD5e05eb29d1eecf974d032c886689e03b3
SHA1ae914d60f8671374025a764328c3f2069c068257
SHA2563235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450
SHA5127f5b603e3041629b6a4a4c9c2b3728715c8344c9312003ec2650cab3e94ad9f0c7a0956aad044776e30102f0a48303df85d459aa2b66695ee3b0b1412fe43d45
-
\Users\Admin\AppData\Local\water.exeFilesize
392KB
MD5e05eb29d1eecf974d032c886689e03b3
SHA1ae914d60f8671374025a764328c3f2069c068257
SHA2563235b022e48ef635c8ee7d6c753f9adca385a9afaa56bde5957c96e15e422450
SHA5127f5b603e3041629b6a4a4c9c2b3728715c8344c9312003ec2650cab3e94ad9f0c7a0956aad044776e30102f0a48303df85d459aa2b66695ee3b0b1412fe43d45
-
memory/600-65-0x0000000000520000-0x000000000054E000-memory.dmpFilesize
184KB
-
memory/600-66-0x00000000005D0000-0x0000000000603000-memory.dmpFilesize
204KB
-
memory/600-68-0x000007FEFB8A1000-0x000007FEFB8A3000-memory.dmpFilesize
8KB
-
memory/1400-58-0x0000000000000000-mapping.dmp
-
memory/1400-64-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/1400-67-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2000-55-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2000-54-0x0000000074F01000-0x0000000074F03000-memory.dmpFilesize
8KB
-
memory/2000-60-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB