Analysis
-
max time kernel
149s -
max time network
112s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
30-01-2023 03:42
Static task
static1
Behavioral task
behavioral1
Sample
ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe
Resource
win10v2004-20220901-en
General
-
Target
ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe
-
Size
156KB
-
MD5
013e5aebd84d8924ebd89b63832f0d09
-
SHA1
46736a2418aece03a4ac68e32706d1934cebea49
-
SHA256
ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc
-
SHA512
65421fcd5e00393eaa13f7d21033d1864851789929822fde9999d47243ca5e5218c6aa89d5f3ee5ed09597dbfef96e60111a4e2e60f86cec5db62c3dceb33664
-
SSDEEP
3072:gT2xNfzEmPUac0yCRS9EK0TLmyFQYW43y0P08+InsgpK497XHxrle94ZW+iihquh:okPpe0mAjka08+IsgbHxfZVRhqu5ml8
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe -
Processes:
ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe -
Processes:
ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe -
Executes dropped EXE 1 IoCs
Processes:
WaterMark.exepid process 364 WaterMark.exe -
Processes:
resource yara_rule behavioral1/memory/1652-55-0x0000000002100000-0x000000000318E000-memory.dmp upx behavioral1/memory/1652-58-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1652-59-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1652-63-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1652-68-0x0000000002100000-0x000000000318E000-memory.dmp upx behavioral1/memory/1652-67-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/364-84-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/364-148-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exepid process 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe -
Processes:
ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe -
Processes:
ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 10 IoCs
Processes:
svchost.exeea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7-zip.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zG.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\pxA2F.tmp ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7z.dll svchost.exe -
Drops file in Windows directory 1 IoCs
Processes:
ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exeWaterMark.exesvchost.exepid process 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe 364 WaterMark.exe 364 WaterMark.exe 364 WaterMark.exe 364 WaterMark.exe 364 WaterMark.exe 364 WaterMark.exe 364 WaterMark.exe 364 WaterMark.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exeWaterMark.exesvchost.exedescription pid process Token: SeDebugPrivilege 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Token: SeDebugPrivilege 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Token: SeDebugPrivilege 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Token: SeDebugPrivilege 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Token: SeDebugPrivilege 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Token: SeDebugPrivilege 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Token: SeDebugPrivilege 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Token: SeDebugPrivilege 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Token: SeDebugPrivilege 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Token: SeDebugPrivilege 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Token: SeDebugPrivilege 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Token: SeDebugPrivilege 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Token: SeDebugPrivilege 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Token: SeDebugPrivilege 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Token: SeDebugPrivilege 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Token: SeDebugPrivilege 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Token: SeDebugPrivilege 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Token: SeDebugPrivilege 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Token: SeDebugPrivilege 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Token: SeDebugPrivilege 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Token: SeDebugPrivilege 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Token: SeDebugPrivilege 364 WaterMark.exe Token: SeDebugPrivilege 1052 svchost.exe Token: SeDebugPrivilege 364 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exeWaterMark.exepid process 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe 364 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exeWaterMark.exesvchost.exedescription pid process target process PID 1652 wrote to memory of 1112 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe taskhost.exe PID 1652 wrote to memory of 1200 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Dwm.exe PID 1652 wrote to memory of 1248 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe Explorer.EXE PID 1652 wrote to memory of 364 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe WaterMark.exe PID 1652 wrote to memory of 364 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe WaterMark.exe PID 1652 wrote to memory of 364 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe WaterMark.exe PID 1652 wrote to memory of 364 1652 ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe WaterMark.exe PID 364 wrote to memory of 1912 364 WaterMark.exe svchost.exe PID 364 wrote to memory of 1912 364 WaterMark.exe svchost.exe PID 364 wrote to memory of 1912 364 WaterMark.exe svchost.exe PID 364 wrote to memory of 1912 364 WaterMark.exe svchost.exe PID 364 wrote to memory of 1912 364 WaterMark.exe svchost.exe PID 364 wrote to memory of 1912 364 WaterMark.exe svchost.exe PID 364 wrote to memory of 1912 364 WaterMark.exe svchost.exe PID 364 wrote to memory of 1912 364 WaterMark.exe svchost.exe PID 364 wrote to memory of 1912 364 WaterMark.exe svchost.exe PID 364 wrote to memory of 1912 364 WaterMark.exe svchost.exe PID 364 wrote to memory of 1052 364 WaterMark.exe svchost.exe PID 364 wrote to memory of 1052 364 WaterMark.exe svchost.exe PID 364 wrote to memory of 1052 364 WaterMark.exe svchost.exe PID 364 wrote to memory of 1052 364 WaterMark.exe svchost.exe PID 364 wrote to memory of 1052 364 WaterMark.exe svchost.exe PID 364 wrote to memory of 1052 364 WaterMark.exe svchost.exe PID 364 wrote to memory of 1052 364 WaterMark.exe svchost.exe PID 364 wrote to memory of 1052 364 WaterMark.exe svchost.exe PID 364 wrote to memory of 1052 364 WaterMark.exe svchost.exe PID 364 wrote to memory of 1052 364 WaterMark.exe svchost.exe PID 1052 wrote to memory of 260 1052 svchost.exe smss.exe PID 1052 wrote to memory of 260 1052 svchost.exe smss.exe PID 1052 wrote to memory of 260 1052 svchost.exe smss.exe PID 1052 wrote to memory of 260 1052 svchost.exe smss.exe PID 1052 wrote to memory of 260 1052 svchost.exe smss.exe PID 1052 wrote to memory of 332 1052 svchost.exe csrss.exe PID 1052 wrote to memory of 332 1052 svchost.exe csrss.exe PID 1052 wrote to memory of 332 1052 svchost.exe csrss.exe PID 1052 wrote to memory of 332 1052 svchost.exe csrss.exe PID 1052 wrote to memory of 332 1052 svchost.exe csrss.exe PID 1052 wrote to memory of 368 1052 svchost.exe wininit.exe PID 1052 wrote to memory of 368 1052 svchost.exe wininit.exe PID 1052 wrote to memory of 368 1052 svchost.exe wininit.exe PID 1052 wrote to memory of 368 1052 svchost.exe wininit.exe PID 1052 wrote to memory of 368 1052 svchost.exe wininit.exe PID 1052 wrote to memory of 384 1052 svchost.exe csrss.exe PID 1052 wrote to memory of 384 1052 svchost.exe csrss.exe PID 1052 wrote to memory of 384 1052 svchost.exe csrss.exe PID 1052 wrote to memory of 384 1052 svchost.exe csrss.exe PID 1052 wrote to memory of 384 1052 svchost.exe csrss.exe PID 1052 wrote to memory of 420 1052 svchost.exe winlogon.exe PID 1052 wrote to memory of 420 1052 svchost.exe winlogon.exe PID 1052 wrote to memory of 420 1052 svchost.exe winlogon.exe PID 1052 wrote to memory of 420 1052 svchost.exe winlogon.exe PID 1052 wrote to memory of 420 1052 svchost.exe winlogon.exe PID 1052 wrote to memory of 472 1052 svchost.exe services.exe PID 1052 wrote to memory of 472 1052 svchost.exe services.exe PID 1052 wrote to memory of 472 1052 svchost.exe services.exe PID 1052 wrote to memory of 472 1052 svchost.exe services.exe PID 1052 wrote to memory of 472 1052 svchost.exe services.exe PID 1052 wrote to memory of 480 1052 svchost.exe lsass.exe PID 1052 wrote to memory of 480 1052 svchost.exe lsass.exe PID 1052 wrote to memory of 480 1052 svchost.exe lsass.exe PID 1052 wrote to memory of 480 1052 svchost.exe lsass.exe PID 1052 wrote to memory of 480 1052 svchost.exe lsass.exe PID 1052 wrote to memory of 488 1052 svchost.exe lsm.exe PID 1052 wrote to memory of 488 1052 svchost.exe lsm.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe1⤵
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe"C:\Users\Admin\AppData\Local\Temp\ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
156KB
MD5013e5aebd84d8924ebd89b63832f0d09
SHA146736a2418aece03a4ac68e32706d1934cebea49
SHA256ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc
SHA51265421fcd5e00393eaa13f7d21033d1864851789929822fde9999d47243ca5e5218c6aa89d5f3ee5ed09597dbfef96e60111a4e2e60f86cec5db62c3dceb33664
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
156KB
MD5013e5aebd84d8924ebd89b63832f0d09
SHA146736a2418aece03a4ac68e32706d1934cebea49
SHA256ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc
SHA51265421fcd5e00393eaa13f7d21033d1864851789929822fde9999d47243ca5e5218c6aa89d5f3ee5ed09597dbfef96e60111a4e2e60f86cec5db62c3dceb33664
-
\Program Files (x86)\Microsoft\WaterMark.exeFilesize
156KB
MD5013e5aebd84d8924ebd89b63832f0d09
SHA146736a2418aece03a4ac68e32706d1934cebea49
SHA256ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc
SHA51265421fcd5e00393eaa13f7d21033d1864851789929822fde9999d47243ca5e5218c6aa89d5f3ee5ed09597dbfef96e60111a4e2e60f86cec5db62c3dceb33664
-
\Program Files (x86)\Microsoft\WaterMark.exeFilesize
156KB
MD5013e5aebd84d8924ebd89b63832f0d09
SHA146736a2418aece03a4ac68e32706d1934cebea49
SHA256ea10cc73c779bdd8f4e9eef13f9f8cf0bcab411c5d4456649ee52b80dcc7c3fc
SHA51265421fcd5e00393eaa13f7d21033d1864851789929822fde9999d47243ca5e5218c6aa89d5f3ee5ed09597dbfef96e60111a4e2e60f86cec5db62c3dceb33664
-
memory/364-84-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/364-148-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/364-65-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/364-62-0x0000000000000000-mapping.dmp
-
memory/1052-87-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1052-90-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1052-89-0x0000000000000000-mapping.dmp
-
memory/1652-66-0x00000000002E0000-0x00000000002E2000-memory.dmpFilesize
8KB
-
memory/1652-63-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1652-69-0x0000000004860000-0x0000000004892000-memory.dmpFilesize
200KB
-
memory/1652-55-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1652-59-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1652-58-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1652-67-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1652-54-0x0000000074FD1000-0x0000000074FD3000-memory.dmpFilesize
8KB
-
memory/1652-68-0x0000000002100000-0x000000000318E000-memory.dmpFilesize
16.6MB
-
memory/1912-85-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/1912-80-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/1912-78-0x0000000000000000-mapping.dmp
-
memory/1912-76-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/1912-197-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB