Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 09:40
Behavioral task
behavioral1
Sample
b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396.exe
Resource
win10v2004-20220812-en
General
-
Target
b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396.exe
-
Size
94KB
-
MD5
0b11de951151ae8ee0888d559c9f9a00
-
SHA1
f2b1a65a40e358af6050e20e4b701741a8e4a059
-
SHA256
b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396
-
SHA512
1b72fd918b2bbc870ebde5f4feff297a045858941d78e398eae2b2cfc3d3a0e2f36e928acc696b27975003c10342d9a9433ed8e919f47ca65ee83b98fec77a37
-
SSDEEP
1536:3o38k0oFIMN5C/5Zm2/h/40MVskmm0B4uP3sJ+b54BEAtWgjp9At:39oqyWT/4Js0kv3q+b5bAtHjA
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
WaterMark.exepid process 968 WaterMark.exe -
Processes:
resource yara_rule \Program Files (x86)\Microsoft\WaterMark.exe upx \Program Files (x86)\Microsoft\WaterMark.exe upx behavioral1/memory/1216-57-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\Program Files (x86)\Microsoft\WaterMark.exe upx behavioral1/memory/968-59-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\Program Files (x86)\Microsoft\WaterMark.exe upx behavioral1/memory/968-70-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/968-188-0x0000000000400000-0x000000000044D000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396.exepid process 1216 b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396.exe 1216 b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396.exe -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 10 IoCs
Processes:
b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396.exesvchost.exedescription ioc process File created C:\Program Files (x86)\Microsoft\WaterMark.exe b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7z.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7zG.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px2CCC.tmp b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
WaterMark.exesvchost.exepid process 968 WaterMark.exe 968 WaterMark.exe 968 WaterMark.exe 968 WaterMark.exe 968 WaterMark.exe 968 WaterMark.exe 968 WaterMark.exe 968 WaterMark.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
WaterMark.exesvchost.exesvchost.exedescription pid process Token: SeDebugPrivilege 968 WaterMark.exe Token: SeDebugPrivilege 1532 svchost.exe Token: SeDebugPrivilege 968 WaterMark.exe Token: SeDebugPrivilege 860 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396.exeWaterMark.exesvchost.exedescription pid process target process PID 1216 wrote to memory of 968 1216 b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396.exe WaterMark.exe PID 1216 wrote to memory of 968 1216 b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396.exe WaterMark.exe PID 1216 wrote to memory of 968 1216 b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396.exe WaterMark.exe PID 1216 wrote to memory of 968 1216 b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396.exe WaterMark.exe PID 968 wrote to memory of 860 968 WaterMark.exe svchost.exe PID 968 wrote to memory of 860 968 WaterMark.exe svchost.exe PID 968 wrote to memory of 860 968 WaterMark.exe svchost.exe PID 968 wrote to memory of 860 968 WaterMark.exe svchost.exe PID 968 wrote to memory of 860 968 WaterMark.exe svchost.exe PID 968 wrote to memory of 860 968 WaterMark.exe svchost.exe PID 968 wrote to memory of 860 968 WaterMark.exe svchost.exe PID 968 wrote to memory of 860 968 WaterMark.exe svchost.exe PID 968 wrote to memory of 860 968 WaterMark.exe svchost.exe PID 968 wrote to memory of 860 968 WaterMark.exe svchost.exe PID 968 wrote to memory of 1532 968 WaterMark.exe svchost.exe PID 968 wrote to memory of 1532 968 WaterMark.exe svchost.exe PID 968 wrote to memory of 1532 968 WaterMark.exe svchost.exe PID 968 wrote to memory of 1532 968 WaterMark.exe svchost.exe PID 968 wrote to memory of 1532 968 WaterMark.exe svchost.exe PID 968 wrote to memory of 1532 968 WaterMark.exe svchost.exe PID 968 wrote to memory of 1532 968 WaterMark.exe svchost.exe PID 968 wrote to memory of 1532 968 WaterMark.exe svchost.exe PID 968 wrote to memory of 1532 968 WaterMark.exe svchost.exe PID 968 wrote to memory of 1532 968 WaterMark.exe svchost.exe PID 1532 wrote to memory of 260 1532 svchost.exe smss.exe PID 1532 wrote to memory of 260 1532 svchost.exe smss.exe PID 1532 wrote to memory of 260 1532 svchost.exe smss.exe PID 1532 wrote to memory of 260 1532 svchost.exe smss.exe PID 1532 wrote to memory of 260 1532 svchost.exe smss.exe PID 1532 wrote to memory of 332 1532 svchost.exe csrss.exe PID 1532 wrote to memory of 332 1532 svchost.exe csrss.exe PID 1532 wrote to memory of 332 1532 svchost.exe csrss.exe PID 1532 wrote to memory of 332 1532 svchost.exe csrss.exe PID 1532 wrote to memory of 332 1532 svchost.exe csrss.exe PID 1532 wrote to memory of 368 1532 svchost.exe wininit.exe PID 1532 wrote to memory of 368 1532 svchost.exe wininit.exe PID 1532 wrote to memory of 368 1532 svchost.exe wininit.exe PID 1532 wrote to memory of 368 1532 svchost.exe wininit.exe PID 1532 wrote to memory of 368 1532 svchost.exe wininit.exe PID 1532 wrote to memory of 384 1532 svchost.exe csrss.exe PID 1532 wrote to memory of 384 1532 svchost.exe csrss.exe PID 1532 wrote to memory of 384 1532 svchost.exe csrss.exe PID 1532 wrote to memory of 384 1532 svchost.exe csrss.exe PID 1532 wrote to memory of 384 1532 svchost.exe csrss.exe PID 1532 wrote to memory of 420 1532 svchost.exe winlogon.exe PID 1532 wrote to memory of 420 1532 svchost.exe winlogon.exe PID 1532 wrote to memory of 420 1532 svchost.exe winlogon.exe PID 1532 wrote to memory of 420 1532 svchost.exe winlogon.exe PID 1532 wrote to memory of 420 1532 svchost.exe winlogon.exe PID 1532 wrote to memory of 468 1532 svchost.exe services.exe PID 1532 wrote to memory of 468 1532 svchost.exe services.exe PID 1532 wrote to memory of 468 1532 svchost.exe services.exe PID 1532 wrote to memory of 468 1532 svchost.exe services.exe PID 1532 wrote to memory of 468 1532 svchost.exe services.exe PID 1532 wrote to memory of 476 1532 svchost.exe lsass.exe PID 1532 wrote to memory of 476 1532 svchost.exe lsass.exe PID 1532 wrote to memory of 476 1532 svchost.exe lsass.exe PID 1532 wrote to memory of 476 1532 svchost.exe lsass.exe PID 1532 wrote to memory of 476 1532 svchost.exe lsass.exe PID 1532 wrote to memory of 484 1532 svchost.exe lsm.exe PID 1532 wrote to memory of 484 1532 svchost.exe lsm.exe PID 1532 wrote to memory of 484 1532 svchost.exe lsm.exe PID 1532 wrote to memory of 484 1532 svchost.exe lsm.exe PID 1532 wrote to memory of 484 1532 svchost.exe lsm.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396.exe"C:\Users\Admin\AppData\Local\Temp\b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396.exe"2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe1⤵
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
94KB
MD50b11de951151ae8ee0888d559c9f9a00
SHA1f2b1a65a40e358af6050e20e4b701741a8e4a059
SHA256b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396
SHA5121b72fd918b2bbc870ebde5f4feff297a045858941d78e398eae2b2cfc3d3a0e2f36e928acc696b27975003c10342d9a9433ed8e919f47ca65ee83b98fec77a37
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
94KB
MD50b11de951151ae8ee0888d559c9f9a00
SHA1f2b1a65a40e358af6050e20e4b701741a8e4a059
SHA256b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396
SHA5121b72fd918b2bbc870ebde5f4feff297a045858941d78e398eae2b2cfc3d3a0e2f36e928acc696b27975003c10342d9a9433ed8e919f47ca65ee83b98fec77a37
-
\Program Files (x86)\Microsoft\WaterMark.exeFilesize
94KB
MD50b11de951151ae8ee0888d559c9f9a00
SHA1f2b1a65a40e358af6050e20e4b701741a8e4a059
SHA256b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396
SHA5121b72fd918b2bbc870ebde5f4feff297a045858941d78e398eae2b2cfc3d3a0e2f36e928acc696b27975003c10342d9a9433ed8e919f47ca65ee83b98fec77a37
-
\Program Files (x86)\Microsoft\WaterMark.exeFilesize
94KB
MD50b11de951151ae8ee0888d559c9f9a00
SHA1f2b1a65a40e358af6050e20e4b701741a8e4a059
SHA256b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396
SHA5121b72fd918b2bbc870ebde5f4feff297a045858941d78e398eae2b2cfc3d3a0e2f36e928acc696b27975003c10342d9a9433ed8e919f47ca65ee83b98fec77a37
-
memory/860-62-0x0000000020010000-0x0000000020021000-memory.dmpFilesize
68KB
-
memory/860-65-0x0000000074F01000-0x0000000074F03000-memory.dmpFilesize
8KB
-
memory/860-71-0x0000000020010000-0x0000000020021000-memory.dmpFilesize
68KB
-
memory/860-64-0x0000000000000000-mapping.dmp
-
memory/860-66-0x0000000020010000-0x0000000020021000-memory.dmpFilesize
68KB
-
memory/968-70-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/968-56-0x0000000000000000-mapping.dmp
-
memory/968-59-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/968-130-0x0000000020020000-0x000000002002B000-memory.dmpFilesize
44KB
-
memory/968-188-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/1216-57-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/1532-73-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1532-75-0x0000000000000000-mapping.dmp
-
memory/1532-76-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB