Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
13/03/2024, 22:51
Static task
static1
Behavioral task
behavioral1
Sample
c70ccce5772a16cd6c67d8cc38ecac13.dll
Resource
win7-20240215-en
General
-
Target
c70ccce5772a16cd6c67d8cc38ecac13.dll
-
Size
166KB
-
MD5
c70ccce5772a16cd6c67d8cc38ecac13
-
SHA1
a2eff9f7d5b93be0b3a3e99ad7a4dd8ef44eb90d
-
SHA256
c89bb54bffce663a6a4c523da0d5d2eb8a470f969a5b9bb68f737bdf75713a2c
-
SHA512
49217e51f03a461222413267065c3388398ed7535e1d8df9fe6fcaa43eb6d3a13d1decafb2147c689bec07b342df295d2b384f6592ee9dc5aec532ae6d623293
-
SSDEEP
1536:d5lTUKCYmCgV5bT/2d1QYemMK6TNXkZXdrBVPjlVRuwz24+5:tTU56gVxj27NemMK6BXEtrB9jlP5Y5
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 2 IoCs
pid Process 2752 regsvr32mgr.exe 2652 WaterMark.exe -
Loads dropped DLL 4 IoCs
pid Process 2328 regsvr32.exe 2328 regsvr32.exe 2752 regsvr32mgr.exe 2752 regsvr32mgr.exe -
resource yara_rule behavioral1/memory/2752-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2752-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2752-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2752-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2752-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2752-17-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2752-19-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2652-30-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2652-38-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2652-41-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2652-438-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2652-442-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\ReachFramework.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Printing.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Linq.Resources.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\settings.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACEWSTR.DLL svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\net.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Windows.Presentation.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\librss_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libwall_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows NT\Accessories\wordpad.exe svchost.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgRes.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libd3d11va_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libnoseek_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ts_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmirror_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadcfr.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Speech.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_mmx_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\Microsoft.Ink.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-synch-l1-2-0.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mlp_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libafile_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libwin_msg_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libasf_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\msitss55.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\msdbg2.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libwindrive_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblendbench_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\librotate_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationProvider.resources.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\ado\msadomd.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\awt.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsimple_channel_mixer_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegaudio_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_flac_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\libremoteosd_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradfun_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpsychedelic_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\calendar.html svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\main.html svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px1381.tmp regsvr32mgr.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\view.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_http_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pipres.dll svchost.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 2652 WaterMark.exe 2652 WaterMark.exe 2652 WaterMark.exe 2652 WaterMark.exe 2652 WaterMark.exe 2652 WaterMark.exe 2652 WaterMark.exe 2652 WaterMark.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe 2296 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2652 WaterMark.exe Token: SeDebugPrivilege 2296 svchost.exe Token: SeDebugPrivilege 2652 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2752 regsvr32mgr.exe 2652 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2328 2312 regsvr32.exe 28 PID 2312 wrote to memory of 2328 2312 regsvr32.exe 28 PID 2312 wrote to memory of 2328 2312 regsvr32.exe 28 PID 2312 wrote to memory of 2328 2312 regsvr32.exe 28 PID 2312 wrote to memory of 2328 2312 regsvr32.exe 28 PID 2312 wrote to memory of 2328 2312 regsvr32.exe 28 PID 2312 wrote to memory of 2328 2312 regsvr32.exe 28 PID 2328 wrote to memory of 2752 2328 regsvr32.exe 29 PID 2328 wrote to memory of 2752 2328 regsvr32.exe 29 PID 2328 wrote to memory of 2752 2328 regsvr32.exe 29 PID 2328 wrote to memory of 2752 2328 regsvr32.exe 29 PID 2752 wrote to memory of 2652 2752 regsvr32mgr.exe 30 PID 2752 wrote to memory of 2652 2752 regsvr32mgr.exe 30 PID 2752 wrote to memory of 2652 2752 regsvr32mgr.exe 30 PID 2752 wrote to memory of 2652 2752 regsvr32mgr.exe 30 PID 2652 wrote to memory of 2700 2652 WaterMark.exe 31 PID 2652 wrote to memory of 2700 2652 WaterMark.exe 31 PID 2652 wrote to memory of 2700 2652 WaterMark.exe 31 PID 2652 wrote to memory of 2700 2652 WaterMark.exe 31 PID 2652 wrote to memory of 2700 2652 WaterMark.exe 31 PID 2652 wrote to memory of 2700 2652 WaterMark.exe 31 PID 2652 wrote to memory of 2700 2652 WaterMark.exe 31 PID 2652 wrote to memory of 2700 2652 WaterMark.exe 31 PID 2652 wrote to memory of 2700 2652 WaterMark.exe 31 PID 2652 wrote to memory of 2700 2652 WaterMark.exe 31 PID 2652 wrote to memory of 2296 2652 WaterMark.exe 32 PID 2652 wrote to memory of 2296 2652 WaterMark.exe 32 PID 2652 wrote to memory of 2296 2652 WaterMark.exe 32 PID 2652 wrote to memory of 2296 2652 WaterMark.exe 32 PID 2652 wrote to memory of 2296 2652 WaterMark.exe 32 PID 2652 wrote to memory of 2296 2652 WaterMark.exe 32 PID 2652 wrote to memory of 2296 2652 WaterMark.exe 32 PID 2652 wrote to memory of 2296 2652 WaterMark.exe 32 PID 2652 wrote to memory of 2296 2652 WaterMark.exe 32 PID 2652 wrote to memory of 2296 2652 WaterMark.exe 32 PID 2296 wrote to memory of 260 2296 svchost.exe 1 PID 2296 wrote to memory of 260 2296 svchost.exe 1 PID 2296 wrote to memory of 260 2296 svchost.exe 1 PID 2296 wrote to memory of 260 2296 svchost.exe 1 PID 2296 wrote to memory of 260 2296 svchost.exe 1 PID 2296 wrote to memory of 340 2296 svchost.exe 2 PID 2296 wrote to memory of 340 2296 svchost.exe 2 PID 2296 wrote to memory of 340 2296 svchost.exe 2 PID 2296 wrote to memory of 340 2296 svchost.exe 2 PID 2296 wrote to memory of 340 2296 svchost.exe 2 PID 2296 wrote to memory of 388 2296 svchost.exe 3 PID 2296 wrote to memory of 388 2296 svchost.exe 3 PID 2296 wrote to memory of 388 2296 svchost.exe 3 PID 2296 wrote to memory of 388 2296 svchost.exe 3 PID 2296 wrote to memory of 388 2296 svchost.exe 3 PID 2296 wrote to memory of 396 2296 svchost.exe 4 PID 2296 wrote to memory of 396 2296 svchost.exe 4 PID 2296 wrote to memory of 396 2296 svchost.exe 4 PID 2296 wrote to memory of 396 2296 svchost.exe 4 PID 2296 wrote to memory of 396 2296 svchost.exe 4 PID 2296 wrote to memory of 436 2296 svchost.exe 5 PID 2296 wrote to memory of 436 2296 svchost.exe 5 PID 2296 wrote to memory of 436 2296 svchost.exe 5 PID 2296 wrote to memory of 436 2296 svchost.exe 5 PID 2296 wrote to memory of 436 2296 svchost.exe 5 PID 2296 wrote to memory of 480 2296 svchost.exe 6 PID 2296 wrote to memory of 480 2296 svchost.exe 6 PID 2296 wrote to memory of 480 2296 svchost.exe 6 PID 2296 wrote to memory of 480 2296 svchost.exe 6
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:260
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:340
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:388
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:596
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1860
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵PID:1644
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:680
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:756
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:824
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1172
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:872
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵PID:320
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:976
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:276
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:1056
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1084
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1144
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2128
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2764
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:496
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:504
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:396
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:436
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\c70ccce5772a16cd6c67d8cc38ecac13.dll2⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\c70ccce5772a16cd6c67d8cc38ecac13.dll3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
PID:2700
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2296
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize206KB
MD5e87419051979541738fee01a9b8ee1c4
SHA1c4e70daf6e3e54fcb30d4fd64b10ef7271039135
SHA256d695088a6c0c5905da23003d7c90569ca38d51592bacf86b34bd6027dac8d535
SHA5122c15393036f1aca29551ffc0ef1150d275df705eb621b81ca5b9c9db086c0f923e65453e144aa5c2563eeabb559a40d6d678725775ae62afb574ac2c5b566b94
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize202KB
MD53edd2e4f5cedff02f8d5c12cce5bdfe6
SHA13206889fa0da567aaa28781997b673a1893ff6c0
SHA25687ebcad7d05b83e3e6ccc506113a9d3384627c4eb860292d03e93dcf486cf2ab
SHA512dcb775915d390e74836df2149d49cc85bad5f8f6336dac785ab674dbae6b7ed4a87bffdf2377effaebbc86f09e9d0dbaae1319291db60c2600e7d4bc8e17b53d
-
Filesize
96KB
MD58c51fd9d6daa7b6137634de19a49452c
SHA1db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA256528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
SHA512b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837