Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/11/2022, 07:34
Static task
static1
Behavioral task
behavioral1
Sample
fef1ec3367c1cdd00a658cc1879d48f1b2408fcd4f25c02b667a8272f24f2a2a.dll
Resource
win7-20220812-en
General
-
Target
fef1ec3367c1cdd00a658cc1879d48f1b2408fcd4f25c02b667a8272f24f2a2a.dll
-
Size
176KB
-
MD5
b52596cc2f51e4cca31b4be61a1c8ac0
-
SHA1
89fdbc0d9781d1e2705b8712613e43b93aa436be
-
SHA256
fef1ec3367c1cdd00a658cc1879d48f1b2408fcd4f25c02b667a8272f24f2a2a
-
SHA512
f2fec90d388ffc46b9f1adfbde2c686b4f6e07fb778558ca99e22e21bc83997d4734bba425bb99fcb433452fe505fdfc301d4c125d817430d3e751ffa8ed0ad2
-
SSDEEP
3072:pgKKuiX63bw5dNjDh8pWVgTlFIYnUBBOmCCYhTQw/adrEV:iKZp3KNjVGv5KYhMN4
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 5084 rundll32mgr.exe 4160 WaterMark.exe -
resource yara_rule behavioral2/memory/5084-139-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/5084-140-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/5084-145-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4160-151-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4160-152-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4160-154-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4160-153-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4160-155-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4160-156-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4160-157-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4160-158-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px9FFE.tmp rundll32mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 840 4788 WerFault.exe 83 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "121401658" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "121401658" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999739" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{299CF141-70AE-11ED-B696-C264E7FE3618} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30999739" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376577860" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4160 WaterMark.exe 4160 WaterMark.exe 4160 WaterMark.exe 4160 WaterMark.exe 4160 WaterMark.exe 4160 WaterMark.exe 4160 WaterMark.exe 4160 WaterMark.exe 4160 WaterMark.exe 4160 WaterMark.exe 4160 WaterMark.exe 4160 WaterMark.exe 4160 WaterMark.exe 4160 WaterMark.exe 4160 WaterMark.exe 4160 WaterMark.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4340 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4160 WaterMark.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4340 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4340 iexplore.exe 4340 iexplore.exe 1892 IEXPLORE.EXE 1892 IEXPLORE.EXE 1892 IEXPLORE.EXE 1892 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 5084 rundll32mgr.exe 4160 WaterMark.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 3068 wrote to memory of 1044 3068 rundll32.exe 80 PID 3068 wrote to memory of 1044 3068 rundll32.exe 80 PID 3068 wrote to memory of 1044 3068 rundll32.exe 80 PID 1044 wrote to memory of 5084 1044 rundll32.exe 81 PID 1044 wrote to memory of 5084 1044 rundll32.exe 81 PID 1044 wrote to memory of 5084 1044 rundll32.exe 81 PID 5084 wrote to memory of 4160 5084 rundll32mgr.exe 82 PID 5084 wrote to memory of 4160 5084 rundll32mgr.exe 82 PID 5084 wrote to memory of 4160 5084 rundll32mgr.exe 82 PID 4160 wrote to memory of 4788 4160 WaterMark.exe 83 PID 4160 wrote to memory of 4788 4160 WaterMark.exe 83 PID 4160 wrote to memory of 4788 4160 WaterMark.exe 83 PID 4160 wrote to memory of 4788 4160 WaterMark.exe 83 PID 4160 wrote to memory of 4788 4160 WaterMark.exe 83 PID 4160 wrote to memory of 4788 4160 WaterMark.exe 83 PID 4160 wrote to memory of 4788 4160 WaterMark.exe 83 PID 4160 wrote to memory of 4788 4160 WaterMark.exe 83 PID 4160 wrote to memory of 4788 4160 WaterMark.exe 83 PID 4160 wrote to memory of 4340 4160 WaterMark.exe 87 PID 4160 wrote to memory of 4340 4160 WaterMark.exe 87 PID 4160 wrote to memory of 4448 4160 WaterMark.exe 88 PID 4160 wrote to memory of 4448 4160 WaterMark.exe 88 PID 4340 wrote to memory of 1892 4340 iexplore.exe 89 PID 4340 wrote to memory of 1892 4340 iexplore.exe 89 PID 4340 wrote to memory of 1892 4340 iexplore.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fef1ec3367c1cdd00a658cc1879d48f1b2408fcd4f25c02b667a8272f24f2a2a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fef1ec3367c1cdd00a658cc1879d48f1b2408fcd4f25c02b667a8272f24f2a2a.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵PID:4788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 2046⤵
- Program crash
PID:840
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4340 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1892
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
PID:4448
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4788 -ip 47881⤵PID:1644
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5f75ba7b0befee8ceca41887a1c08275a
SHA1c302a11726b67942df47bd592e0f16f4b55e27cd
SHA256e17884dabe4a9f88f81cb7871f007699cc3f4ee349b12fa11e27750c6097104a
SHA51223c379ad527f817382f9a38e2fda7cc6e77250289ca079a81a0e690fa8af98db290a55e953108788ecfbb6e1bf2746230c68fa1df513729d72758a782a768673
-
Filesize
60KB
MD5f75ba7b0befee8ceca41887a1c08275a
SHA1c302a11726b67942df47bd592e0f16f4b55e27cd
SHA256e17884dabe4a9f88f81cb7871f007699cc3f4ee349b12fa11e27750c6097104a
SHA51223c379ad527f817382f9a38e2fda7cc6e77250289ca079a81a0e690fa8af98db290a55e953108788ecfbb6e1bf2746230c68fa1df513729d72758a782a768673
-
Filesize
60KB
MD5f75ba7b0befee8ceca41887a1c08275a
SHA1c302a11726b67942df47bd592e0f16f4b55e27cd
SHA256e17884dabe4a9f88f81cb7871f007699cc3f4ee349b12fa11e27750c6097104a
SHA51223c379ad527f817382f9a38e2fda7cc6e77250289ca079a81a0e690fa8af98db290a55e953108788ecfbb6e1bf2746230c68fa1df513729d72758a782a768673
-
Filesize
60KB
MD5f75ba7b0befee8ceca41887a1c08275a
SHA1c302a11726b67942df47bd592e0f16f4b55e27cd
SHA256e17884dabe4a9f88f81cb7871f007699cc3f4ee349b12fa11e27750c6097104a
SHA51223c379ad527f817382f9a38e2fda7cc6e77250289ca079a81a0e690fa8af98db290a55e953108788ecfbb6e1bf2746230c68fa1df513729d72758a782a768673