Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
06-12-2023 21:08
Static task
static1
Behavioral task
behavioral1
Sample
d7999a3e9af0b9c230f38adebb5fc300.dll
Resource
win7-20231023-en
General
-
Target
d7999a3e9af0b9c230f38adebb5fc300.dll
-
Size
564KB
-
MD5
d7999a3e9af0b9c230f38adebb5fc300
-
SHA1
6072f81e32d11f65a32b13540dbee2dd4e60a987
-
SHA256
d73379fab1de9711c9ddfeaeb92b2b9aeca4aefda67d950483bb6ec5ff00e446
-
SHA512
9e842a564d12df7915d62638f27a8619a549131a0a7990ec453de04762b559daec9e86427319d554168ae0075ef5a77795f41308dec727f7a136fdfef634e648
-
SSDEEP
12288:tehnaNPpSVZmNxRCwnwm3W3OHIIf5m9RhWFVJ:teh0PpS6NxNnwYeOHXAhWTJ
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
rundll32mgr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" rundll32mgr.exe -
Processes:
rundll32mgr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32mgr.exe -
Processes:
rundll32mgr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32mgr.exe -
Executes dropped EXE 2 IoCs
Processes:
rundll32mgr.exeWaterMark.exepid process 2692 rundll32mgr.exe 2788 WaterMark.exe -
Loads dropped DLL 4 IoCs
Processes:
rundll32.exerundll32mgr.exepid process 2908 rundll32.exe 2908 rundll32.exe 2692 rundll32mgr.exe 2692 rundll32mgr.exe -
Processes:
resource yara_rule behavioral1/memory/2692-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2692-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2692-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2692-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2692-17-0x0000000002940000-0x00000000039CE000-memory.dmp upx behavioral1/memory/2692-21-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2692-23-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2692-25-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2692-20-0x0000000002940000-0x00000000039CE000-memory.dmp upx behavioral1/memory/2692-26-0x0000000002940000-0x00000000039CE000-memory.dmp upx behavioral1/memory/2788-42-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2692-37-0x0000000000670000-0x00000000006A4000-memory.dmp upx behavioral1/memory/2788-50-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2788-191-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Processes:
rundll32mgr.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32mgr.exe -
Processes:
rundll32mgr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32mgr.exe -
Drops file in System32 directory 3 IoCs
Processes:
svchost.exerundll32.exedescription ioc process File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Drops file in Program Files directory 64 IoCs
Processes:
svchost.exerundll32mgr.exedescription ioc process File opened for modification C:\Program Files\Common Files\System\wab32.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1655.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jaas_nt.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdfmap.dll svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\WindowsAccessBridge-64.dll svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\msxactps.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html svchost.exe File opened for modification C:\Program Files\DVD Maker\OmdProject.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\JavaAccessBridge-64.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsound.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java_crw_demo.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jawt.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\JdbcOdbc.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm svchost.exe File opened for modification C:\Program Files\Internet Explorer\pdmproxy100.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\gstreamer-lite.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html svchost.exe File opened for modification C:\Program Files\Internet Explorer\msdbg2.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jli.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jfxwebkit.dll svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1665.dll svchost.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe File opened for modification C:\Program Files\BackupWatch.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\net.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\eula.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunmscapi.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\splashscreen.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadce.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\jsdebuggeride.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px9C3F.tmp rundll32mgr.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\networkinspection.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_shmem.dll svchost.exe -
Drops file in Windows directory 1 IoCs
Processes:
rundll32mgr.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI rundll32mgr.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
rundll32mgr.exeWaterMark.exesvchost.exepid process 2692 rundll32mgr.exe 2788 WaterMark.exe 2788 WaterMark.exe 2788 WaterMark.exe 2788 WaterMark.exe 2788 WaterMark.exe 2788 WaterMark.exe 2788 WaterMark.exe 2788 WaterMark.exe 560 svchost.exe 560 svchost.exe 560 svchost.exe 560 svchost.exe 560 svchost.exe 560 svchost.exe 560 svchost.exe 560 svchost.exe 560 svchost.exe 560 svchost.exe 560 svchost.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
rundll32mgr.exeWaterMark.exesvchost.exedescription pid process Token: SeDebugPrivilege 2692 rundll32mgr.exe Token: SeDebugPrivilege 2692 rundll32mgr.exe Token: SeDebugPrivilege 2692 rundll32mgr.exe Token: SeDebugPrivilege 2692 rundll32mgr.exe Token: SeDebugPrivilege 2692 rundll32mgr.exe Token: SeDebugPrivilege 2692 rundll32mgr.exe Token: SeDebugPrivilege 2692 rundll32mgr.exe Token: SeDebugPrivilege 2692 rundll32mgr.exe Token: SeDebugPrivilege 2692 rundll32mgr.exe Token: SeDebugPrivilege 2692 rundll32mgr.exe Token: SeDebugPrivilege 2692 rundll32mgr.exe Token: SeDebugPrivilege 2692 rundll32mgr.exe Token: SeDebugPrivilege 2692 rundll32mgr.exe Token: SeDebugPrivilege 2692 rundll32mgr.exe Token: SeDebugPrivilege 2692 rundll32mgr.exe Token: SeDebugPrivilege 2692 rundll32mgr.exe Token: SeDebugPrivilege 2692 rundll32mgr.exe Token: SeDebugPrivilege 2692 rundll32mgr.exe Token: SeDebugPrivilege 2788 WaterMark.exe Token: SeDebugPrivilege 560 svchost.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
rundll32mgr.exeWaterMark.exepid process 2692 rundll32mgr.exe 2788 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exerundll32mgr.exeWaterMark.exesvchost.exedescription pid process target process PID 2852 wrote to memory of 2908 2852 rundll32.exe rundll32.exe PID 2852 wrote to memory of 2908 2852 rundll32.exe rundll32.exe PID 2852 wrote to memory of 2908 2852 rundll32.exe rundll32.exe PID 2852 wrote to memory of 2908 2852 rundll32.exe rundll32.exe PID 2852 wrote to memory of 2908 2852 rundll32.exe rundll32.exe PID 2852 wrote to memory of 2908 2852 rundll32.exe rundll32.exe PID 2852 wrote to memory of 2908 2852 rundll32.exe rundll32.exe PID 2908 wrote to memory of 2692 2908 rundll32.exe rundll32mgr.exe PID 2908 wrote to memory of 2692 2908 rundll32.exe rundll32mgr.exe PID 2908 wrote to memory of 2692 2908 rundll32.exe rundll32mgr.exe PID 2908 wrote to memory of 2692 2908 rundll32.exe rundll32mgr.exe PID 2692 wrote to memory of 1120 2692 rundll32mgr.exe taskhost.exe PID 2692 wrote to memory of 2788 2692 rundll32mgr.exe WaterMark.exe PID 2692 wrote to memory of 2788 2692 rundll32mgr.exe WaterMark.exe PID 2692 wrote to memory of 2788 2692 rundll32mgr.exe WaterMark.exe PID 2692 wrote to memory of 2788 2692 rundll32mgr.exe WaterMark.exe PID 2788 wrote to memory of 2568 2788 WaterMark.exe svchost.exe PID 2788 wrote to memory of 2568 2788 WaterMark.exe svchost.exe PID 2788 wrote to memory of 2568 2788 WaterMark.exe svchost.exe PID 2788 wrote to memory of 2568 2788 WaterMark.exe svchost.exe PID 2788 wrote to memory of 2568 2788 WaterMark.exe svchost.exe PID 2788 wrote to memory of 2568 2788 WaterMark.exe svchost.exe PID 2788 wrote to memory of 2568 2788 WaterMark.exe svchost.exe PID 2788 wrote to memory of 2568 2788 WaterMark.exe svchost.exe PID 2788 wrote to memory of 2568 2788 WaterMark.exe svchost.exe PID 2788 wrote to memory of 2568 2788 WaterMark.exe svchost.exe PID 2788 wrote to memory of 560 2788 WaterMark.exe svchost.exe PID 2788 wrote to memory of 560 2788 WaterMark.exe svchost.exe PID 2788 wrote to memory of 560 2788 WaterMark.exe svchost.exe PID 2788 wrote to memory of 560 2788 WaterMark.exe svchost.exe PID 2788 wrote to memory of 560 2788 WaterMark.exe svchost.exe PID 2788 wrote to memory of 560 2788 WaterMark.exe svchost.exe PID 2788 wrote to memory of 560 2788 WaterMark.exe svchost.exe PID 2788 wrote to memory of 560 2788 WaterMark.exe svchost.exe PID 2788 wrote to memory of 560 2788 WaterMark.exe svchost.exe PID 2788 wrote to memory of 560 2788 WaterMark.exe svchost.exe PID 560 wrote to memory of 260 560 svchost.exe smss.exe PID 560 wrote to memory of 260 560 svchost.exe smss.exe PID 560 wrote to memory of 260 560 svchost.exe smss.exe PID 560 wrote to memory of 260 560 svchost.exe smss.exe PID 560 wrote to memory of 260 560 svchost.exe smss.exe PID 560 wrote to memory of 336 560 svchost.exe csrss.exe PID 560 wrote to memory of 336 560 svchost.exe csrss.exe PID 560 wrote to memory of 336 560 svchost.exe csrss.exe PID 560 wrote to memory of 336 560 svchost.exe csrss.exe PID 560 wrote to memory of 336 560 svchost.exe csrss.exe PID 560 wrote to memory of 372 560 svchost.exe wininit.exe PID 560 wrote to memory of 372 560 svchost.exe wininit.exe PID 560 wrote to memory of 372 560 svchost.exe wininit.exe PID 560 wrote to memory of 372 560 svchost.exe wininit.exe PID 560 wrote to memory of 372 560 svchost.exe wininit.exe PID 560 wrote to memory of 384 560 svchost.exe csrss.exe PID 560 wrote to memory of 384 560 svchost.exe csrss.exe PID 560 wrote to memory of 384 560 svchost.exe csrss.exe PID 560 wrote to memory of 384 560 svchost.exe csrss.exe PID 560 wrote to memory of 384 560 svchost.exe csrss.exe PID 560 wrote to memory of 420 560 svchost.exe winlogon.exe PID 560 wrote to memory of 420 560 svchost.exe winlogon.exe PID 560 wrote to memory of 420 560 svchost.exe winlogon.exe PID 560 wrote to memory of 420 560 svchost.exe winlogon.exe PID 560 wrote to memory of 420 560 svchost.exe winlogon.exe PID 560 wrote to memory of 464 560 svchost.exe services.exe PID 560 wrote to memory of 464 560 svchost.exe services.exe PID 560 wrote to memory of 464 560 svchost.exe services.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
rundll32mgr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32mgr.exe
Processes
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d7999a3e9af0b9c230f38adebb5fc300.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d7999a3e9af0b9c230f38adebb5fc300.dll,#13⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding2⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
164KB
MD5a3b1f1c4cd75bea10095e054f990bf1d
SHA115bf037b2166d2533e12bbec9f1d5f9a3ad8c81b
SHA256a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee
SHA5127457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
164KB
MD5a3b1f1c4cd75bea10095e054f990bf1d
SHA115bf037b2166d2533e12bbec9f1d5f9a3ad8c81b
SHA256a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee
SHA5127457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.htmlFilesize
342KB
MD5c45f70d81ce6bd59fe9d15335a0bda6a
SHA13b193cb68d7a986df9e5cf2cb33f288c44040252
SHA25612e3e61194a6f65a3c1f4d70e59439b8f0aa91685cb182aed53cbeb53aa3b5d1
SHA512dd4f842a771b41c6317ec409eb4f6d9ed4a7e200cb27529e36f468667e8cf640f698d3d8ffb6f9fb8582ecdb5999dcb93011b8947fef3e046e439ef18107bf1c
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.htmlFilesize
338KB
MD507a248bd3b838275d24349d12a545dda
SHA178c6b24ba63ed418128dbd6a41322889bccbc72f
SHA25636753397ae0ba6af91daa735aa88dee182ab7d903582ba8a39075efd8b97452f
SHA51265ddbd7cbe9895242cbd389c98f5d4bdbd9aecfba825c55b4f0f7ff7d36c7cef232ce706ef25bbcb473498ab4cd61b6e1cf0c9583de0efd88e0bc70ba54ec6bd
-
C:\Windows\SysWOW64\rundll32mgr.exeFilesize
164KB
MD5a3b1f1c4cd75bea10095e054f990bf1d
SHA115bf037b2166d2533e12bbec9f1d5f9a3ad8c81b
SHA256a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee
SHA5127457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94
-
C:\Windows\SysWOW64\rundll32mgr.exeFilesize
164KB
MD5a3b1f1c4cd75bea10095e054f990bf1d
SHA115bf037b2166d2533e12bbec9f1d5f9a3ad8c81b
SHA256a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee
SHA5127457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94
-
C:\Windows\SysWOW64\rundll32mgr.exeFilesize
164KB
MD5a3b1f1c4cd75bea10095e054f990bf1d
SHA115bf037b2166d2533e12bbec9f1d5f9a3ad8c81b
SHA256a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee
SHA5127457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94
-
\Program Files (x86)\Microsoft\WaterMark.exeFilesize
164KB
MD5a3b1f1c4cd75bea10095e054f990bf1d
SHA115bf037b2166d2533e12bbec9f1d5f9a3ad8c81b
SHA256a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee
SHA5127457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94
-
\Program Files (x86)\Microsoft\WaterMark.exeFilesize
164KB
MD5a3b1f1c4cd75bea10095e054f990bf1d
SHA115bf037b2166d2533e12bbec9f1d5f9a3ad8c81b
SHA256a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee
SHA5127457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94
-
\Windows\SysWOW64\rundll32mgr.exeFilesize
164KB
MD5a3b1f1c4cd75bea10095e054f990bf1d
SHA115bf037b2166d2533e12bbec9f1d5f9a3ad8c81b
SHA256a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee
SHA5127457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94
-
\Windows\SysWOW64\rundll32mgr.exeFilesize
164KB
MD5a3b1f1c4cd75bea10095e054f990bf1d
SHA115bf037b2166d2533e12bbec9f1d5f9a3ad8c81b
SHA256a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee
SHA5127457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94
-
memory/560-94-0x0000000000150000-0x0000000000151000-memory.dmpFilesize
4KB
-
memory/560-93-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/560-89-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/560-80-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/560-95-0x0000000077CF0000-0x0000000077CF1000-memory.dmpFilesize
4KB
-
memory/560-96-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/560-97-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/560-98-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/560-99-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/1120-28-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2568-76-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2568-54-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2568-484-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2568-63-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2568-71-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2568-68-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/2568-66-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2568-64-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/2568-56-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2692-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2692-18-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/2692-11-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2692-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2692-25-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2692-20-0x0000000002940000-0x00000000039CE000-memory.dmpFilesize
16.6MB
-
memory/2692-26-0x0000000002940000-0x00000000039CE000-memory.dmpFilesize
16.6MB
-
memory/2692-37-0x0000000000670000-0x00000000006A4000-memory.dmpFilesize
208KB
-
memory/2692-23-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2692-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2692-21-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2692-15-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2692-17-0x0000000002940000-0x00000000039CE000-memory.dmpFilesize
16.6MB
-
memory/2692-39-0x0000000000670000-0x00000000006A4000-memory.dmpFilesize
208KB
-
memory/2788-52-0x0000000077CEF000-0x0000000077CF0000-memory.dmpFilesize
4KB
-
memory/2788-78-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2788-50-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2788-51-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2788-191-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2788-42-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2908-10-0x0000000000180000-0x00000000001B4000-memory.dmpFilesize
208KB
-
memory/2908-8-0x0000000010000000-0x000000001008B000-memory.dmpFilesize
556KB
-
memory/2908-1-0x0000000010000000-0x000000001008B000-memory.dmpFilesize
556KB