Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
30-01-2023 03:42
Static task
static1
Behavioral task
behavioral1
Sample
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe
Resource
win7-20221111-en
General
-
Target
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe
-
Size
160KB
-
MD5
9a6a913cceb071140108ff9df1d1ff5b
-
SHA1
116ec5175b5da2f23eb95f3bc4e1cbaed551bbf3
-
SHA256
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b
-
SHA512
55c59d7a273af3e960b56987380f5f2c5659278d46f958e670f334f4827776868afef206f7d3bf0c9720862432279ca05e44be0827514d36af80c432f80b2e04
-
SSDEEP
3072:aT2xNfzEmPUac0yCRS9EK0TLmV/MsdpFJma538ZNvWPJFlD:OkPpe0mB3N8zWDN
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe -
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe -
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe -
Executes dropped EXE 1 IoCs
Processes:
WaterMark.exepid process 1124 WaterMark.exe -
Processes:
resource yara_rule behavioral1/memory/1148-55-0x00000000020D0000-0x000000000315E000-memory.dmp upx behavioral1/memory/1148-58-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1148-59-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1148-64-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1148-65-0x00000000020D0000-0x000000000315E000-memory.dmp upx behavioral1/memory/1124-77-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/1124-145-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exepid process 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe -
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe -
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 15 IoCs
Processes:
svchost.exedeb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL svchost.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll svchost.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px1F92.tmp deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7zG.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe File opened for modification C:\Program Files\7-Zip\7z.dll svchost.exe -
Drops file in Windows directory 1 IoCs
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exeWaterMark.exesvchost.exepid process 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe 1124 WaterMark.exe 1124 WaterMark.exe 1124 WaterMark.exe 1124 WaterMark.exe 1124 WaterMark.exe 1124 WaterMark.exe 1124 WaterMark.exe 1124 WaterMark.exe 876 svchost.exe 876 svchost.exe 876 svchost.exe 876 svchost.exe 876 svchost.exe 876 svchost.exe 876 svchost.exe 876 svchost.exe 876 svchost.exe 876 svchost.exe 876 svchost.exe 876 svchost.exe 876 svchost.exe 876 svchost.exe 876 svchost.exe 876 svchost.exe 876 svchost.exe 876 svchost.exe 876 svchost.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exeWaterMark.exesvchost.exedescription pid process Token: SeDebugPrivilege 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 1124 WaterMark.exe Token: SeDebugPrivilege 876 svchost.exe Token: SeDebugPrivilege 1124 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exeWaterMark.exepid process 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe 1124 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exeWaterMark.exesvchost.exedescription pid process target process PID 1148 wrote to memory of 1132 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe taskhost.exe PID 1148 wrote to memory of 1192 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Dwm.exe PID 1148 wrote to memory of 1268 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Explorer.EXE PID 1148 wrote to memory of 1124 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe WaterMark.exe PID 1148 wrote to memory of 1124 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe WaterMark.exe PID 1148 wrote to memory of 1124 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe WaterMark.exe PID 1148 wrote to memory of 1124 1148 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe WaterMark.exe PID 1124 wrote to memory of 1464 1124 WaterMark.exe svchost.exe PID 1124 wrote to memory of 1464 1124 WaterMark.exe svchost.exe PID 1124 wrote to memory of 1464 1124 WaterMark.exe svchost.exe PID 1124 wrote to memory of 1464 1124 WaterMark.exe svchost.exe PID 1124 wrote to memory of 1464 1124 WaterMark.exe svchost.exe PID 1124 wrote to memory of 1464 1124 WaterMark.exe svchost.exe PID 1124 wrote to memory of 1464 1124 WaterMark.exe svchost.exe PID 1124 wrote to memory of 1464 1124 WaterMark.exe svchost.exe PID 1124 wrote to memory of 1464 1124 WaterMark.exe svchost.exe PID 1124 wrote to memory of 1464 1124 WaterMark.exe svchost.exe PID 1124 wrote to memory of 876 1124 WaterMark.exe svchost.exe PID 1124 wrote to memory of 876 1124 WaterMark.exe svchost.exe PID 1124 wrote to memory of 876 1124 WaterMark.exe svchost.exe PID 1124 wrote to memory of 876 1124 WaterMark.exe svchost.exe PID 1124 wrote to memory of 876 1124 WaterMark.exe svchost.exe PID 1124 wrote to memory of 876 1124 WaterMark.exe svchost.exe PID 1124 wrote to memory of 876 1124 WaterMark.exe svchost.exe PID 1124 wrote to memory of 876 1124 WaterMark.exe svchost.exe PID 1124 wrote to memory of 876 1124 WaterMark.exe svchost.exe PID 1124 wrote to memory of 876 1124 WaterMark.exe svchost.exe PID 876 wrote to memory of 260 876 svchost.exe smss.exe PID 876 wrote to memory of 260 876 svchost.exe smss.exe PID 876 wrote to memory of 260 876 svchost.exe smss.exe PID 876 wrote to memory of 260 876 svchost.exe smss.exe PID 876 wrote to memory of 260 876 svchost.exe smss.exe PID 876 wrote to memory of 332 876 svchost.exe csrss.exe PID 876 wrote to memory of 332 876 svchost.exe csrss.exe PID 876 wrote to memory of 332 876 svchost.exe csrss.exe PID 876 wrote to memory of 332 876 svchost.exe csrss.exe PID 876 wrote to memory of 332 876 svchost.exe csrss.exe PID 876 wrote to memory of 360 876 svchost.exe wininit.exe PID 876 wrote to memory of 360 876 svchost.exe wininit.exe PID 876 wrote to memory of 360 876 svchost.exe wininit.exe PID 876 wrote to memory of 360 876 svchost.exe wininit.exe PID 876 wrote to memory of 360 876 svchost.exe wininit.exe PID 876 wrote to memory of 384 876 svchost.exe csrss.exe PID 876 wrote to memory of 384 876 svchost.exe csrss.exe PID 876 wrote to memory of 384 876 svchost.exe csrss.exe PID 876 wrote to memory of 384 876 svchost.exe csrss.exe PID 876 wrote to memory of 384 876 svchost.exe csrss.exe PID 876 wrote to memory of 420 876 svchost.exe winlogon.exe PID 876 wrote to memory of 420 876 svchost.exe winlogon.exe PID 876 wrote to memory of 420 876 svchost.exe winlogon.exe PID 876 wrote to memory of 420 876 svchost.exe winlogon.exe PID 876 wrote to memory of 420 876 svchost.exe winlogon.exe PID 876 wrote to memory of 464 876 svchost.exe services.exe PID 876 wrote to memory of 464 876 svchost.exe services.exe PID 876 wrote to memory of 464 876 svchost.exe services.exe PID 876 wrote to memory of 464 876 svchost.exe services.exe PID 876 wrote to memory of 464 876 svchost.exe services.exe PID 876 wrote to memory of 480 876 svchost.exe lsass.exe PID 876 wrote to memory of 480 876 svchost.exe lsass.exe PID 876 wrote to memory of 480 876 svchost.exe lsass.exe PID 876 wrote to memory of 480 876 svchost.exe lsass.exe PID 876 wrote to memory of 480 876 svchost.exe lsass.exe PID 876 wrote to memory of 488 876 svchost.exe lsm.exe PID 876 wrote to memory of 488 876 svchost.exe lsm.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe"C:\Users\Admin\AppData\Local\Temp\deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
160KB
MD59a6a913cceb071140108ff9df1d1ff5b
SHA1116ec5175b5da2f23eb95f3bc4e1cbaed551bbf3
SHA256deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b
SHA51255c59d7a273af3e960b56987380f5f2c5659278d46f958e670f334f4827776868afef206f7d3bf0c9720862432279ca05e44be0827514d36af80c432f80b2e04
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
160KB
MD59a6a913cceb071140108ff9df1d1ff5b
SHA1116ec5175b5da2f23eb95f3bc4e1cbaed551bbf3
SHA256deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b
SHA51255c59d7a273af3e960b56987380f5f2c5659278d46f958e670f334f4827776868afef206f7d3bf0c9720862432279ca05e44be0827514d36af80c432f80b2e04
-
\Program Files (x86)\Microsoft\WaterMark.exeFilesize
160KB
MD59a6a913cceb071140108ff9df1d1ff5b
SHA1116ec5175b5da2f23eb95f3bc4e1cbaed551bbf3
SHA256deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b
SHA51255c59d7a273af3e960b56987380f5f2c5659278d46f958e670f334f4827776868afef206f7d3bf0c9720862432279ca05e44be0827514d36af80c432f80b2e04
-
\Program Files (x86)\Microsoft\WaterMark.exeFilesize
160KB
MD59a6a913cceb071140108ff9df1d1ff5b
SHA1116ec5175b5da2f23eb95f3bc4e1cbaed551bbf3
SHA256deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b
SHA51255c59d7a273af3e960b56987380f5f2c5659278d46f958e670f334f4827776868afef206f7d3bf0c9720862432279ca05e44be0827514d36af80c432f80b2e04
-
memory/876-87-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/876-86-0x0000000000000000-mapping.dmp
-
memory/876-84-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1124-66-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1124-77-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1124-145-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1124-62-0x0000000000000000-mapping.dmp
-
memory/1148-54-0x00000000767F1000-0x00000000767F3000-memory.dmpFilesize
8KB
-
memory/1148-64-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1148-59-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1148-58-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1148-55-0x00000000020D0000-0x000000000315E000-memory.dmpFilesize
16.6MB
-
memory/1148-65-0x00000000020D0000-0x000000000315E000-memory.dmpFilesize
16.6MB
-
memory/1464-73-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/1464-75-0x0000000000000000-mapping.dmp
-
memory/1464-78-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/1464-82-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/1464-194-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB