f5c854644f65cc9fb79b1184da2deaccb6038eb43052bbe0fdcf1524ae51baa0

Analysis

max time kernel
168s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5c854644f65cc9fb79b1184da2deaccb6038eb43052bbe0fdcf1524ae51baa0.exe
Size

392KB
MD5

261d6733d933cfe890ed9000a057345c
SHA1

16931246cdab7a57c53bd986516ead52027fbcb9
SHA256

f5c854644f65cc9fb79b1184da2deaccb6038eb43052bbe0fdcf1524ae51baa0
SHA512

cdbba25c8a09d07f616e4d94a7d85b63bd9700f143834c9967876f2d1ecbfb1e49fafca9872a9a4e317d11de05d2d346dd0c093305f5a9135bf4514775a0c6a4
SSDEEP

12288:4e3WOYgQAKFprr+POsb/5SkQr+9KG6DsSCoWRhxzndNw75LZP1Kmb+9h1vL6kdHY:fllogFHTyVupc1

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

water.exe

pid process

4788 water.exe

pid	process
4788	water.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

water.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	water.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\water.exe"	water.exe

Drops file in System32 directory 2 IoCs

Processes:

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\whr458da.db
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\whr458da.db

Drops file in Windows directory 2 IoCs

Processes:

f5c854644f65cc9fb79b1184da2deaccb6038eb43052bbe0fdcf1524ae51baa0.exewater.exe

description	ioc	process
File opened for modification	C:\Windows\f5c854644f65cc9fb79b1184da2deaccb6038eb43052bbe0fdcf1524ae51baa0.INI	f5c854644f65cc9fb79b1184da2deaccb6038eb43052bbe0fdcf1524ae51baa0.exe
File opened for modification	C:\Windows\water.INI	water.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

water.exe

pid process

4788 water.exe
4788 water.exe
4788 water.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

water.exe

pid process

4788 water.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

water.exe

description pid process

Token: SeDebugPrivilege 4788 water.exe
Token: SeDebugPrivilege 780

pid	process
4788	water.exe
4788	water.exe
4788	water.exe

pid	process
4788	water.exe

description	pid	process
Token: SeDebugPrivilege	4788	water.exe
Token: SeDebugPrivilege	780

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

f5c854644f65cc9fb79b1184da2deaccb6038eb43052bbe0fdcf1524ae51baa0.exewater.exe

pid	process
2604	f5c854644f65cc9fb79b1184da2deaccb6038eb43052bbe0fdcf1524ae51baa0.exe
2604	f5c854644f65cc9fb79b1184da2deaccb6038eb43052bbe0fdcf1524ae51baa0.exe
4788	water.exe
4788	water.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

f5c854644f65cc9fb79b1184da2deaccb6038eb43052bbe0fdcf1524ae51baa0.exe

description	pid	process	target process
PID 2604 wrote to memory of 4788	2604	f5c854644f65cc9fb79b1184da2deaccb6038eb43052bbe0fdcf1524ae51baa0.exe	water.exe
PID 2604 wrote to memory of 4788	2604	f5c854644f65cc9fb79b1184da2deaccb6038eb43052bbe0fdcf1524ae51baa0.exe	water.exe
PID 2604 wrote to memory of 4788	2604	f5c854644f65cc9fb79b1184da2deaccb6038eb43052bbe0fdcf1524ae51baa0.exe	water.exe
PID 780 wrote to memory of 3924	780		wmiprvse.exe
PID 780 wrote to memory of 3924	780		wmiprvse.exe

C:\Users\Admin\AppData\Local\Temp\f5c854644f65cc9fb79b1184da2deaccb6038eb43052bbe0fdcf1524ae51baa0.exe
"C:\Users\Admin\AppData\Local\Temp\f5c854644f65cc9fb79b1184da2deaccb6038eb43052bbe0fdcf1524ae51baa0.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604

C:\Users\Admin\AppData\Local\water.exe
C:\Users\Admin\AppData\Local\Temp\f5c854644f65cc9fb79b1184da2deaccb6038eb43052bbe0fdcf1524ae51baa0.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4788

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\water.exe

Filesize
392KB

MD5
261d6733d933cfe890ed9000a057345c

SHA1
16931246cdab7a57c53bd986516ead52027fbcb9

SHA256
f5c854644f65cc9fb79b1184da2deaccb6038eb43052bbe0fdcf1524ae51baa0

SHA512
cdbba25c8a09d07f616e4d94a7d85b63bd9700f143834c9967876f2d1ecbfb1e49fafca9872a9a4e317d11de05d2d346dd0c093305f5a9135bf4514775a0c6a4

Download Submit
C:\Users\Admin\AppData\Local\water.exe

Filesize
392KB

MD5
261d6733d933cfe890ed9000a057345c

SHA1
16931246cdab7a57c53bd986516ead52027fbcb9

SHA256
f5c854644f65cc9fb79b1184da2deaccb6038eb43052bbe0fdcf1524ae51baa0

SHA512
cdbba25c8a09d07f616e4d94a7d85b63bd9700f143834c9967876f2d1ecbfb1e49fafca9872a9a4e317d11de05d2d346dd0c093305f5a9135bf4514775a0c6a4

Download Submit
memory/780-139-0x0000027B5F9D0000-0x0000027B5F9FE000-memory.dmp

Filesize
184KB

Download
memory/780-140-0x0000027B60790000-0x0000027B607C3000-memory.dmp

Filesize
204KB

Download
memory/2604-132-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3924-141-0x0000000000000000-mapping.dmp

Download
memory/4788-134-0x0000000000000000-mapping.dmp

Download