Analysis
-
max time kernel
134s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 02:58
Static task
static1
Behavioral task
behavioral1
Sample
c9fbaa3919cc10d2a95cc5495e4abb78cfa7f89e8350442916bba1f21bf3a3a1.dll
Resource
win7-20240221-en
General
-
Target
c9fbaa3919cc10d2a95cc5495e4abb78cfa7f89e8350442916bba1f21bf3a3a1.dll
-
Size
157KB
-
MD5
457aa792186d3c64f612cd92be10914a
-
SHA1
ff60592e8963b603f7e71bf306d24831d629edd8
-
SHA256
c9fbaa3919cc10d2a95cc5495e4abb78cfa7f89e8350442916bba1f21bf3a3a1
-
SHA512
62a22c67ff88b7f841c38ef2e1924092017295410e23753476a4aa9329d00c803b6decdf3474d84c6480f0db18aae5bcccdf15bdbd3bf2fbe8d1e351940dbc4f
-
SSDEEP
3072:IMr6N9WfdNAbxBk69VyZhDsHYZ3rDINcQR0n6ecZdGU1QLaLNmYqhPzxm1f:IMqWfdNANG6yEYZ7DVQgsQLPzo1f
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 11 IoCs
Processes:
resource yara_rule behavioral2/memory/4064-19-0x0000000000400000-0x0000000000421000-memory.dmp UPX behavioral2/memory/4092-56-0x0000000000400000-0x0000000000421000-memory.dmp UPX behavioral2/memory/4080-73-0x0000000000400000-0x0000000000421000-memory.dmp UPX behavioral2/memory/832-90-0x0000000000400000-0x0000000000423000-memory.dmp UPX behavioral2/memory/3768-35-0x0000000000400000-0x0000000000421000-memory.dmp UPX behavioral2/memory/4064-34-0x0000000000400000-0x0000000000421000-memory.dmp UPX behavioral2/memory/4064-21-0x0000000000400000-0x0000000000421000-memory.dmp UPX behavioral2/memory/4064-20-0x0000000000400000-0x0000000000421000-memory.dmp UPX behavioral2/memory/4064-18-0x0000000000400000-0x0000000000421000-memory.dmp UPX behavioral2/memory/4064-17-0x0000000000400000-0x0000000000421000-memory.dmp UPX behavioral2/memory/4092-109-0x0000000000400000-0x0000000000421000-memory.dmp UPX -
Executes dropped EXE 8 IoCs
Processes:
rundll32mgr.exerundll32mgrmgr.exeWaterMark.exeWaterMark.exeWaterMarkmgr.exeWaterMark.exeWaterMarkmgr.exeWaterMark.exepid process 4064 rundll32mgr.exe 3768 rundll32mgrmgr.exe 1852 WaterMark.exe 4092 WaterMark.exe 4080 WaterMarkmgr.exe 4592 WaterMark.exe 832 WaterMarkmgr.exe 4088 WaterMark.exe -
Processes:
resource yara_rule behavioral2/memory/4064-19-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4092-56-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4080-73-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4080-67-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4092-55-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/832-90-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4088-99-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/3768-35-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4064-34-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4064-21-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4064-20-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4064-18-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4064-17-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4064-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4092-109-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
rundll32.exerundll32mgr.exedescription ioc process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe File created C:\Windows\SysWOW64\rundll32mgrmgr.exe rundll32mgr.exe -
Drops file in Program Files directory 13 IoCs
Processes:
WaterMarkmgr.exeWaterMark.exeWaterMarkmgr.exerundll32mgr.exerundll32mgrmgr.exeWaterMark.exeWaterMark.exeWaterMark.exedescription ioc process File created C:\Program Files (x86)\Microsoft\WaterMark.exe WaterMarkmgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe WaterMark.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe WaterMarkmgr.exe File opened for modification C:\Program Files (x86)\Microsoft\px4CB8.tmp rundll32mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\px4CC8.tmp rundll32mgrmgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgrmgr.exe File opened for modification C:\Program Files (x86)\Microsoft\px4DF1.tmp WaterMarkmgr.exe File created C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe WaterMark.exe File opened for modification C:\Program Files (x86)\Microsoft\px4D84.tmp WaterMarkmgr.exe File created C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe WaterMark.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe WaterMark.exe -
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2496 1132 WerFault.exe svchost.exe 4508 4996 WerFault.exe svchost.exe 3020 4916 WerFault.exe svchost.exe 2476 4780 WerFault.exe svchost.exe -
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeiexplore.exeiexplore.exeiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2814956424" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31108888" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31108888" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31108888" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2818081532" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2815112727" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423457282" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2818394155" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31108888" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31108888" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2814956424" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2815112727" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31108888" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D3666F75-1B0B-11EF-BCA5-66D3FDB32ECD} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D36B34AB-1B0B-11EF-BCA5-66D3FDB32ECD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WaterMark.exeWaterMark.exeWaterMark.exeWaterMark.exepid process 4092 WaterMark.exe 4092 WaterMark.exe 4092 WaterMark.exe 4092 WaterMark.exe 1852 WaterMark.exe 1852 WaterMark.exe 1852 WaterMark.exe 1852 WaterMark.exe 4592 WaterMark.exe 4592 WaterMark.exe 4592 WaterMark.exe 4592 WaterMark.exe 4088 WaterMark.exe 4088 WaterMark.exe 4088 WaterMark.exe 4088 WaterMark.exe 4092 WaterMark.exe 4092 WaterMark.exe 4092 WaterMark.exe 4092 WaterMark.exe 4092 WaterMark.exe 4092 WaterMark.exe 4092 WaterMark.exe 4092 WaterMark.exe 4092 WaterMark.exe 4092 WaterMark.exe 4092 WaterMark.exe 4092 WaterMark.exe 1852 WaterMark.exe 1852 WaterMark.exe 1852 WaterMark.exe 1852 WaterMark.exe 1852 WaterMark.exe 1852 WaterMark.exe 1852 WaterMark.exe 1852 WaterMark.exe 1852 WaterMark.exe 1852 WaterMark.exe 1852 WaterMark.exe 1852 WaterMark.exe 4592 WaterMark.exe 4592 WaterMark.exe 4592 WaterMark.exe 4592 WaterMark.exe 4592 WaterMark.exe 4592 WaterMark.exe 4592 WaterMark.exe 4592 WaterMark.exe 4592 WaterMark.exe 4592 WaterMark.exe 4592 WaterMark.exe 4592 WaterMark.exe 4088 WaterMark.exe 4088 WaterMark.exe 4088 WaterMark.exe 4088 WaterMark.exe 4088 WaterMark.exe 4088 WaterMark.exe 4088 WaterMark.exe 4088 WaterMark.exe 4088 WaterMark.exe 4088 WaterMark.exe 4088 WaterMark.exe 4088 WaterMark.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
rundll32.exeWaterMark.exeWaterMark.exeWaterMark.exeWaterMark.exedescription pid process Token: SeDebugPrivilege 4800 rundll32.exe Token: SeDebugPrivilege 4092 WaterMark.exe Token: SeDebugPrivilege 1852 WaterMark.exe Token: SeDebugPrivilege 4592 WaterMark.exe Token: SeDebugPrivilege 4088 WaterMark.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exeiexplore.exepid process 3112 iexplore.exe 4400 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 4400 iexplore.exe 4400 iexplore.exe 3112 iexplore.exe 3112 iexplore.exe 756 IEXPLORE.EXE 756 IEXPLORE.EXE 1408 IEXPLORE.EXE 1408 IEXPLORE.EXE 756 IEXPLORE.EXE 756 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 8 IoCs
Processes:
rundll32mgr.exerundll32mgrmgr.exeWaterMark.exeWaterMark.exeWaterMarkmgr.exeWaterMark.exeWaterMarkmgr.exeWaterMark.exepid process 4064 rundll32mgr.exe 3768 rundll32mgrmgr.exe 4092 WaterMark.exe 1852 WaterMark.exe 4080 WaterMarkmgr.exe 4592 WaterMark.exe 832 WaterMarkmgr.exe 4088 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exerundll32mgr.exerundll32mgrmgr.exeWaterMark.exeWaterMarkmgr.exeWaterMark.exeWaterMark.exeWaterMarkmgr.exeWaterMark.exedescription pid process target process PID 3092 wrote to memory of 4800 3092 rundll32.exe rundll32.exe PID 3092 wrote to memory of 4800 3092 rundll32.exe rundll32.exe PID 3092 wrote to memory of 4800 3092 rundll32.exe rundll32.exe PID 4800 wrote to memory of 4064 4800 rundll32.exe rundll32mgr.exe PID 4800 wrote to memory of 4064 4800 rundll32.exe rundll32mgr.exe PID 4800 wrote to memory of 4064 4800 rundll32.exe rundll32mgr.exe PID 4064 wrote to memory of 3768 4064 rundll32mgr.exe rundll32mgrmgr.exe PID 4064 wrote to memory of 3768 4064 rundll32mgr.exe rundll32mgrmgr.exe PID 4064 wrote to memory of 3768 4064 rundll32mgr.exe rundll32mgrmgr.exe PID 4064 wrote to memory of 1852 4064 rundll32mgr.exe WaterMark.exe PID 4064 wrote to memory of 1852 4064 rundll32mgr.exe WaterMark.exe PID 4064 wrote to memory of 1852 4064 rundll32mgr.exe WaterMark.exe PID 3768 wrote to memory of 4092 3768 rundll32mgrmgr.exe WaterMark.exe PID 3768 wrote to memory of 4092 3768 rundll32mgrmgr.exe WaterMark.exe PID 3768 wrote to memory of 4092 3768 rundll32mgrmgr.exe WaterMark.exe PID 1852 wrote to memory of 4080 1852 WaterMark.exe WaterMarkmgr.exe PID 1852 wrote to memory of 4080 1852 WaterMark.exe WaterMarkmgr.exe PID 1852 wrote to memory of 4080 1852 WaterMark.exe WaterMarkmgr.exe PID 4080 wrote to memory of 4592 4080 WaterMarkmgr.exe WaterMark.exe PID 4080 wrote to memory of 4592 4080 WaterMarkmgr.exe WaterMark.exe PID 4080 wrote to memory of 4592 4080 WaterMarkmgr.exe WaterMark.exe PID 4092 wrote to memory of 4780 4092 WaterMark.exe svchost.exe PID 4092 wrote to memory of 4780 4092 WaterMark.exe svchost.exe PID 4092 wrote to memory of 4780 4092 WaterMark.exe svchost.exe PID 4092 wrote to memory of 4780 4092 WaterMark.exe svchost.exe PID 4092 wrote to memory of 4780 4092 WaterMark.exe svchost.exe PID 4092 wrote to memory of 4780 4092 WaterMark.exe svchost.exe PID 4092 wrote to memory of 4780 4092 WaterMark.exe svchost.exe PID 4092 wrote to memory of 4780 4092 WaterMark.exe svchost.exe PID 4092 wrote to memory of 4780 4092 WaterMark.exe svchost.exe PID 1852 wrote to memory of 1132 1852 WaterMark.exe svchost.exe PID 1852 wrote to memory of 1132 1852 WaterMark.exe svchost.exe PID 1852 wrote to memory of 1132 1852 WaterMark.exe svchost.exe PID 1852 wrote to memory of 1132 1852 WaterMark.exe svchost.exe PID 1852 wrote to memory of 1132 1852 WaterMark.exe svchost.exe PID 1852 wrote to memory of 1132 1852 WaterMark.exe svchost.exe PID 1852 wrote to memory of 1132 1852 WaterMark.exe svchost.exe PID 1852 wrote to memory of 1132 1852 WaterMark.exe svchost.exe PID 1852 wrote to memory of 1132 1852 WaterMark.exe svchost.exe PID 4592 wrote to memory of 832 4592 WaterMark.exe WaterMarkmgr.exe PID 4592 wrote to memory of 832 4592 WaterMark.exe WaterMarkmgr.exe PID 4592 wrote to memory of 832 4592 WaterMark.exe WaterMarkmgr.exe PID 832 wrote to memory of 4088 832 WaterMarkmgr.exe WaterMark.exe PID 832 wrote to memory of 4088 832 WaterMarkmgr.exe WaterMark.exe PID 832 wrote to memory of 4088 832 WaterMarkmgr.exe WaterMark.exe PID 4592 wrote to memory of 4916 4592 WaterMark.exe svchost.exe PID 4592 wrote to memory of 4916 4592 WaterMark.exe svchost.exe PID 4592 wrote to memory of 4916 4592 WaterMark.exe svchost.exe PID 4592 wrote to memory of 4916 4592 WaterMark.exe svchost.exe PID 4592 wrote to memory of 4916 4592 WaterMark.exe svchost.exe PID 4592 wrote to memory of 4916 4592 WaterMark.exe svchost.exe PID 4592 wrote to memory of 4916 4592 WaterMark.exe svchost.exe PID 4592 wrote to memory of 4916 4592 WaterMark.exe svchost.exe PID 4592 wrote to memory of 4916 4592 WaterMark.exe svchost.exe PID 4088 wrote to memory of 4996 4088 WaterMark.exe svchost.exe PID 4088 wrote to memory of 4996 4088 WaterMark.exe svchost.exe PID 4088 wrote to memory of 4996 4088 WaterMark.exe svchost.exe PID 4088 wrote to memory of 4996 4088 WaterMark.exe svchost.exe PID 4088 wrote to memory of 4996 4088 WaterMark.exe svchost.exe PID 4088 wrote to memory of 4996 4088 WaterMark.exe svchost.exe PID 4088 wrote to memory of 4996 4088 WaterMark.exe svchost.exe PID 4088 wrote to memory of 4996 4088 WaterMark.exe svchost.exe PID 4088 wrote to memory of 4996 4088 WaterMark.exe svchost.exe PID 4092 wrote to memory of 4400 4092 WaterMark.exe iexplore.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c9fbaa3919cc10d2a95cc5495e4abb78cfa7f89e8350442916bba1f21bf3a3a1.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c9fbaa3919cc10d2a95cc5495e4abb78cfa7f89e8350442916bba1f21bf3a3a1.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32mgrmgr.exeC:\Windows\SysWOW64\rundll32mgrmgr.exe4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 2047⤵
- Program crash
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4400 CREDAT:17410 /prefetch:27⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3112 CREDAT:17410 /prefetch:27⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"C:\Program Files (x86)\Microsoft\WaterMarkmgr.exe"7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 20410⤵
- Program crash
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵
- Modifies Internet Explorer settings
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 2048⤵
- Program crash
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵
- Modifies Internet Explorer settings
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 2086⤵
- Program crash
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4916 -ip 49161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4780 -ip 47801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1132 -ip 11321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4996 -ip 49961⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5c41ab5352ba79baac9ac093dd7eb2500
SHA11ffb0e70f86845daba211aeda43cad539d34ffd3
SHA256558e13bb7aa293569457e9703d2db37e8365e2ab670b2c3484ada9336ed24895
SHA512ccebe3f11039e14d39d4102652669fd372d179778bf73fae0659dd01da569bbf850b273cd3a4e13dc77b3fd4fb4d84d01525ac3a0dcb23b297c733da10bc2ff0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD5180865ba79b57125d801c932b5156cab
SHA177df58348a8d3c91dbf3cf40e5cebdc685dee56d
SHA256b68a0cb3157d955082a88e91ccd8103bbb2ee663eb62238b74b9545c9a1c4df4
SHA512dbe107f273767277e981dcd7b0dbc9bfb85fcfffe9da59ffa8f3b2f09cadefe475a1437def7bd050e97e8e3cd85fa5002cee2b8a8223adc28746b721622037d5
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{D3666F75-1B0B-11EF-BCA5-66D3FDB32ECD}.datFilesize
5KB
MD550c8f2fb614a86187e79d4773d33aee2
SHA1b86a31520bfdf50e8b6aebe8d3d89634848de30d
SHA2566762f6b47f4600988b743cf7bf17f79816684fe018b37cf81c1e4c48b26d8245
SHA5121b26ee7b395c18b2f0c2abc33a3429dd96bf59afca09b4a37be4aa0555eda6cd42260a5f4bd013125bd9f621d031a9f752352ce504728d97b08b45ca5e35afef
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{D36B34AB-1B0B-11EF-BCA5-66D3FDB32ECD}.datFilesize
3KB
MD596183af8d0eb702fa7935285527325ad
SHA1ce2fb4d4de1d69856e5ff5453fea2fa5d42aad60
SHA25632d10a95bcc542ff26e5fae573fbab8f5111c120185025adcc7eb3f02758a241
SHA512f26a63b60719cb988cd1b6956cd7686068681b2f1100a691f38a8a887870a37b8e824405eb5fc57995695d2d55f02756366a8fa1004ddc48b5272eda78ecb1cf
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verCFC3.tmpFilesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GOWSKSPC\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Windows\SysWOW64\rundll32mgr.exeFilesize
122KB
MD5c5255edf109342e3e1d1eb0990b2d094
SHA1ba029b47b9b3a5ccccae3038d90382ec68a1dd44
SHA256ea49164b416d1b900f80a14f30295ea7d546483a0d7ba8b3a9e48dbcb48a3dc5
SHA5126b6911ea424763af3ed4964e67aa75d1ffe74551e1e4e12e6220afcda720dbfdda00d744e23486c07701662bac3702220f760d1c86a188772e9bf8af7b64a3a3
-
C:\Windows\SysWOW64\rundll32mgrmgr.exeFilesize
59KB
MD5f2c8b7e238a07cce22920efb1c8645a6
SHA1cd2af4b30add747e222f938206b78d7730fdf346
SHA2566b20b420e84a30df810d52a9b205a3af0f46cafe82bf378867542f15eb64461e
SHA512c4b9c8c3dccaa39b5ac1faea7e92b0e1d391f0943989178634992be07c40be15b8543f9c6746ab6a5a7136ea00e3c0818fc43bc2eee4e5d282c3cbf7ea279699
-
memory/832-90-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/1852-40-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3768-12-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/3768-23-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/3768-35-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4064-17-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4064-19-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4064-7-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4064-13-0x0000000000401000-0x0000000000405000-memory.dmpFilesize
16KB
-
memory/4064-14-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4064-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4064-22-0x00000000008C0000-0x00000000008C1000-memory.dmpFilesize
4KB
-
memory/4064-18-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4064-20-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4064-34-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4064-41-0x0000000000401000-0x0000000000405000-memory.dmpFilesize
16KB
-
memory/4064-21-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4080-73-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4080-67-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4088-99-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4088-101-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/4092-103-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/4092-54-0x0000000000430000-0x0000000000431000-memory.dmpFilesize
4KB
-
memory/4092-57-0x0000000077D02000-0x0000000077D03000-memory.dmpFilesize
4KB
-
memory/4092-56-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4092-55-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4092-109-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4800-8-0x0000000077D02000-0x0000000077D03000-memory.dmpFilesize
4KB
-
memory/4800-2-0x0000000010000000-0x000000001002B000-memory.dmpFilesize
172KB
-
memory/4800-4-0x00000000007C0000-0x00000000007C1000-memory.dmpFilesize
4KB
-
memory/4800-5-0x00000000007D0000-0x00000000007D1000-memory.dmpFilesize
4KB