Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2024, 02:07
Static task
static1
Behavioral task
behavioral1
Sample
c7687b50f05109f7685880845f9a6ad4.dll
Resource
win7-20240220-en
General
-
Target
c7687b50f05109f7685880845f9a6ad4.dll
-
Size
456KB
-
MD5
c7687b50f05109f7685880845f9a6ad4
-
SHA1
8696d7e824e0d4f5681126e5304f497abf464f74
-
SHA256
33f2e8bdb251784b40275d4f3755439d4c914937fc6f335185b501259133e504
-
SHA512
5588418bfe8bb73f7e0d340e79d72b8347460df072534789e1cca6b018a3faa7977556b95769ed59bc877f5f748e4080bfd47f6ac9a1bc8abf60fb3c8c7b90af
-
SSDEEP
12288:oV7LMzw56Wx1Dk/qon6xyYhgPFaUVlth9jKajO8FOMr:y1oC3yWgPFv1Ka90U
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4684 rundll32mgr.exe 2936 WaterMark.exe -
resource yara_rule behavioral2/memory/4684-6-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4684-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4684-9-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4684-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4684-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4684-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4684-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2936-26-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2936-25-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2936-36-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2936-37-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\px34EB.tmp rundll32mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2328 1332 WerFault.exe 90 -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9A2EE59A-E1A7-11EE-AE4D-4A65E849A069} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31094196" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9A33AA8B-E1A7-11EE-AE4D-4A65E849A069} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1854859061" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1854859061" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1854859061" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1857984389" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31094196" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417147021" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31094196" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1857984389" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31094196" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31094196" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1854859061" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31094196" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 2936 WaterMark.exe 2936 WaterMark.exe 2936 WaterMark.exe 2936 WaterMark.exe 2936 WaterMark.exe 2936 WaterMark.exe 2936 WaterMark.exe 2936 WaterMark.exe 2936 WaterMark.exe 2936 WaterMark.exe 2936 WaterMark.exe 2936 WaterMark.exe 2936 WaterMark.exe 2936 WaterMark.exe 2936 WaterMark.exe 2936 WaterMark.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2936 WaterMark.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4816 iexplore.exe 4492 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4816 iexplore.exe 4816 iexplore.exe 4492 iexplore.exe 4492 iexplore.exe 4736 IEXPLORE.EXE 4736 IEXPLORE.EXE 4976 IEXPLORE.EXE 4976 IEXPLORE.EXE 4736 IEXPLORE.EXE 4736 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 4684 rundll32mgr.exe 2936 WaterMark.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2076 wrote to memory of 5044 2076 rundll32.exe 87 PID 2076 wrote to memory of 5044 2076 rundll32.exe 87 PID 2076 wrote to memory of 5044 2076 rundll32.exe 87 PID 5044 wrote to memory of 4684 5044 rundll32.exe 88 PID 5044 wrote to memory of 4684 5044 rundll32.exe 88 PID 5044 wrote to memory of 4684 5044 rundll32.exe 88 PID 4684 wrote to memory of 2936 4684 rundll32mgr.exe 89 PID 4684 wrote to memory of 2936 4684 rundll32mgr.exe 89 PID 4684 wrote to memory of 2936 4684 rundll32mgr.exe 89 PID 2936 wrote to memory of 1332 2936 WaterMark.exe 90 PID 2936 wrote to memory of 1332 2936 WaterMark.exe 90 PID 2936 wrote to memory of 1332 2936 WaterMark.exe 90 PID 2936 wrote to memory of 1332 2936 WaterMark.exe 90 PID 2936 wrote to memory of 1332 2936 WaterMark.exe 90 PID 2936 wrote to memory of 1332 2936 WaterMark.exe 90 PID 2936 wrote to memory of 1332 2936 WaterMark.exe 90 PID 2936 wrote to memory of 1332 2936 WaterMark.exe 90 PID 2936 wrote to memory of 1332 2936 WaterMark.exe 90 PID 2936 wrote to memory of 4816 2936 WaterMark.exe 99 PID 2936 wrote to memory of 4816 2936 WaterMark.exe 99 PID 2936 wrote to memory of 4492 2936 WaterMark.exe 100 PID 2936 wrote to memory of 4492 2936 WaterMark.exe 100 PID 4816 wrote to memory of 4736 4816 iexplore.exe 101 PID 4816 wrote to memory of 4736 4816 iexplore.exe 101 PID 4816 wrote to memory of 4736 4816 iexplore.exe 101 PID 4492 wrote to memory of 4976 4492 iexplore.exe 102 PID 4492 wrote to memory of 4976 4492 iexplore.exe 102 PID 4492 wrote to memory of 4976 4492 iexplore.exe 102
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c7687b50f05109f7685880845f9a6ad4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c7687b50f05109f7685880845f9a6ad4.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵PID:1332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 2046⤵
- Program crash
PID:2328
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4816 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4736
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4492 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4976
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1332 -ip 13321⤵PID:4392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9A2EE59A-E1A7-11EE-AE4D-4A65E849A069}.dat
Filesize5KB
MD5dab58e31ea2dc983e9e33ff14f64da21
SHA1c24edda1fa009476c4a50bd8212820d16f5bc5e0
SHA256301d62da8d5c812d8bff14bf9d2812ac53870c2b360b88ba03e2b80d2056d89a
SHA51290a941b3846fd825071b073a1fbce9fa2beddfd71d389f91542307124028681726c0d508509778361ecadab669463b9099887d8f1e3ede4df4cf73809c04b544
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9A33AA8B-E1A7-11EE-AE4D-4A65E849A069}.dat
Filesize5KB
MD52571991fa211bf32970da947e5d681f5
SHA18be948fa9b4ef386be88047e1d8b0ea9a749776e
SHA256c554a85a932b37b1dedbf6147b4fa2d3069603371c385216b2de016ddcf77bf6
SHA51285c2c785a8437a1829aa1f9643ffd0bdce902d33f8ffc28f0d8bc69fd783d3479a9cfe5a92cbd19fa8b6871a7211603c3d6fa1ffe7597967d9137142566ecf04
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
60KB
MD5b229d97259dc81a0da33a726a9bd5f92
SHA15720e02ecfdb2e26730873f1f9f2ff4c9554f463
SHA25636ea4da216ea92b12723415be977e91acb74d06059e0c5925787efaeb450434c
SHA51285e956b5448691b0fa7116f85be83cdd0c847468867d6e57a0801a1ea4a74c3c830867a7f424162986055f576e485a1f9fd52c0108833364113683ba794c8184