Analysis
- max time kernel
134s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system - submitted
17/04/2024, 18:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0d7d6363c1cfe2e8bf74e2fa96347d58d483eab3106e136cb3d4780d850905d9.dll
Resource
win7-20240319-en
windows7-x64
12 signatures
150 seconds
General
- Target 0d7d6363c1cfe2e8bf74e2fa96347d58d483eab3106e136cb3d4780d850905d9.dll
- Size 458KB
- Sample240417-w8fevabf2t
- SHA256 0d7d6363c1cfe2e8bf74e2fa96347d58d483eab3106e136cb3d4780d850905d9
- MD5 a6682ebc18718c27deb76d42da8f0098
- SHA1 34516f16a2b82475f50d9096b8915484ec835af2
- SHA512 fdef95be0b51fe5c7bf2a2d477ee1d913c3f67fd344e7d3f2fba336f4870b3ab7eb9b4d26350611a8a68d13829ae71b36a9c07b0dae79826cd216565cd24e298
- SSDEEP 6144:i0IEu0/l7rUdoqWMvjcw3sWSAoITM+NPUHFWnk/B3fEs5g3GWfO:D79qXvjRc5AoIY+NPUlWnKZsb2
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- UPX dump on OEP (original entry point) 12 IoCs
resource yara_rule behavioral2/memory/2140-11-0x0000000000400000-0x0000000000421000-memory.dmp UPX behavioral2/memory/2140-12-0x0000000000400000-0x0000000000421000-memory.dmp UPX behavioral2/memory/2140-15-0x0000000000400000-0x0000000000421000-memory.dmp UPX behavioral2/memory/2140-10-0x0000000000400000-0x0000000000421000-memory.dmp UPX behavioral2/memory/2140-17-0x0000000000400000-0x0000000000421000-memory.dmp UPX behavioral2/memory/2140-8-0x0000000000400000-0x0000000000421000-memory.dmp UPX behavioral2/memory/3288-23-0x0000000000400000-0x000000000042B000-memory.dmp UPX behavioral2/memory/3288-30-0x0000000000400000-0x0000000000421000-memory.dmp UPX behavioral2/memory/3288-32-0x0000000000400000-0x0000000000421000-memory.dmp UPX behavioral2/memory/3288-33-0x0000000000400000-0x0000000000421000-memory.dmp UPX behavioral2/memory/3288-39-0x0000000000400000-0x0000000000421000-memory.dmp UPX behavioral2/memory/3288-40-0x0000000000400000-0x0000000000421000-memory.dmp UPX - Executes dropped EXE 2 IoCs
pid Process 2140 rundll32mgr.exe 3288 WaterMark.exe -
resource yara_rule behavioral2/memory/2140-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2140-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2140-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2140-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2140-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2140-17-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2140-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3288-23-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3288-30-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3288-32-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3288-33-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3288-39-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3288-40-0x0000000000400000-0x0000000000421000-memory.dmp upx - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px6B5C.tmp rundll32mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3736 1840 WerFault.exe 89 -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "348270727" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31101174" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{40327F4D-FCE9-11EE-BBD6-FAEF73C7C1C1} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31101174" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31101174" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420143897" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "346708241" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31101174" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "348270727" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "346708241" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 3288 WaterMark.exe 3288 WaterMark.exe 3288 WaterMark.exe 3288 WaterMark.exe 3288 WaterMark.exe 3288 WaterMark.exe 3288 WaterMark.exe 3288 WaterMark.exe 3288 WaterMark.exe 3288 WaterMark.exe 3288 WaterMark.exe 3288 WaterMark.exe 3288 WaterMark.exe 3288 WaterMark.exe 3288 WaterMark.exe 3288 WaterMark.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3288 WaterMark.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2272 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2272 iexplore.exe 2272 iexplore.exe 3484 IEXPLORE.EXE 3484 IEXPLORE.EXE 3484 IEXPLORE.EXE 3484 IEXPLORE.EXE - Suspicious use of UnmapMainImage 2 IoCs
pid Process 2140 rundll32mgr.exe 3288 WaterMark.exe - Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 4868 wrote to memory of 2660 4868 rundll32.exe 86 PID 4868 wrote to memory of 2660 4868 rundll32.exe 86 PID 4868 wrote to memory of 2660 4868 rundll32.exe 86 PID 2660 wrote to memory of 2140 2660 rundll32.exe 87 PID 2660 wrote to memory of 2140 2660 rundll32.exe 87 PID 2660 wrote to memory of 2140 2660 rundll32.exe 87 PID 2140 wrote to memory of 3288 2140 rundll32mgr.exe 88 PID 2140 wrote to memory of 3288 2140 rundll32mgr.exe 88 PID 2140 wrote to memory of 3288 2140 rundll32mgr.exe 88 PID 3288 wrote to memory of 1840 3288 WaterMark.exe 89 PID 3288 wrote to memory of 1840 3288 WaterMark.exe 89 PID 3288 wrote to memory of 1840 3288 WaterMark.exe 89 PID 3288 wrote to memory of 1840 3288 WaterMark.exe 89 PID 3288 wrote to memory of 1840 3288 WaterMark.exe 89 PID 3288 wrote to memory of 1840 3288 WaterMark.exe 89 PID 3288 wrote to memory of 1840 3288 WaterMark.exe 89 PID 3288 wrote to memory of 1840 3288 WaterMark.exe 89 PID 3288 wrote to memory of 1840 3288 WaterMark.exe 89 PID 3288 wrote to memory of 2272 3288 WaterMark.exe 99 PID 3288 wrote to memory of 2272 3288 WaterMark.exe 99 PID 3288 wrote to memory of 4424 3288 WaterMark.exe 100 PID 3288 wrote to memory of 4424 3288 WaterMark.exe 100 PID 2272 wrote to memory of 3484 2272 iexplore.exe 101 PID 2272 wrote to memory of 3484 2272 iexplore.exe 101 PID 2272 wrote to memory of 3484 2272 iexplore.exe 101
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0d7d6363c1cfe2e8bf74e2fa96347d58d483eab3106e136cb3d4780d850905d9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0d7d6363c1cfe2e8bf74e2fa96347d58d483eab3106e136cb3d4780d850905d9.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵PID:1840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 2046⤵
- Program crash
PID:3736
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3484
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
PID:4424
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1840 -ip 18401⤵PID:3480
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verEF32.tmp
- Size 15KB
- SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
- MD5 1a545d0052b581fbb2ab4c52133846bc
- SHA1 62f3266a9b9925cd6d98658b92adec673cbe3dd3
- SHA512 bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
- SSDEEP 384:79Jv9DF9/C9qc9/J9V791T9TK9Xf9Nm9xQ95a9BR9fV:79Jv9DF9/C9qc9/J9V791T9TK9Xf9NmT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\134FJJJO\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\rundll32mgr.exe
- Size 123KB
- SHA256 ad5e8fa296d304323acfffbbb52a63ec92ee36a06a8b3be5234869ad1ff564e7
- MD5 593759bef0f3a9c72736434914e8ee62
- SHA1 d1eb7ff75d336a6fefc88267fa06565b7efe984a
- SHA512 47424e2adc7e094ffd9b2088bcd20cb78ad51c81fa456bdce67b45cfb488268a6b31af3b71119d5f24f88475ae190b1dd73ca50671ce3d656f2ab6eff793e4d4
- SSDEEP 3072:iR2xn3k0CdM1vabyzJYWqynxfamjDm3g:iR2J0LS6V0PjDm3g
- MD5 SHA1 SHA512 SSDEEP