Analysis
- max time kernel
102s - max time network
116s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
21/10/2024, 12:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b64611d1dc24557468045da4200d7b23ac65a9a7b82cc00a0e00b548acb1147dN.dll
Resource
win7-20240903-en
windows7-x64
21 signatures
120 seconds
General
- Target b64611d1dc24557468045da4200d7b23ac65a9a7b82cc00a0e00b548acb1147dN.dll
- Size 564KB
- Sample241021-pxhmhatgla
- SHA256 b64611d1dc24557468045da4200d7b23ac65a9a7b82cc00a0e00b548acb1147d
- MD5 3ef7a13352026b6ffa18064423d108e0
- SHA1 e082238649301430ae38183cbd64e78d3e129ad4
- SHA512 f998440d336db7e2ca723573008d7150d729702dde16728ae13162ab7e4e92db94eefc02676c3d64ed2aa2c634a4ce4185f9cae2d0f1e9ca1947b8f8fe245e66
- SSDEEP 12288:tehnaNPpSVZmNxRCwnwm3W3OHIIf5m9RhWFVS:teh0PpS6NxNnwYeOHXAhWTS
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" rundll32mgr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32mgr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32mgr.exe - Executes dropped EXE 2 IoCs
pid Process 2796 rundll32mgr.exe 1288 WaterMark.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32mgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc rundll32mgr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32mgr.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
resource yara_rule behavioral2/memory/2796-9-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2796-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2796-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2796-18-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2796-17-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2796-26-0x00000000035F0000-0x000000000467E000-memory.dmp upx behavioral2/memory/2796-12-0x00000000035F0000-0x000000000467E000-memory.dmp upx behavioral2/memory/1288-41-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2796-27-0x00000000035F0000-0x000000000467E000-memory.dmp upx behavioral2/memory/2796-21-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2796-11-0x00000000035F0000-0x000000000467E000-memory.dmp upx behavioral2/memory/2796-15-0x00000000035F0000-0x000000000467E000-memory.dmp upx behavioral2/memory/2796-14-0x00000000035F0000-0x000000000467E000-memory.dmp upx behavioral2/memory/2796-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1288-47-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1288-46-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1288-51-0x0000000000400000-0x0000000000421000-memory.dmp upx - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px9923.tmp rundll32mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI rundll32mgr.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1008 4608 WerFault.exe 84 - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31138742" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "436279524" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{EEDB2D46-8FA9-11EF-A7EA-DA61A5E71E4E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31138742" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3275748445" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3275748445" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31138742" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{EEDD9042-8FA9-11EF-A7EA-DA61A5E71E4E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3275748445" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31138742" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3275748445" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3278873482" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31138742" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3278873482" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31138742" IEXPLORE.EXE - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2796 rundll32mgr.exe 2796 rundll32mgr.exe 1288 WaterMark.exe 1288 WaterMark.exe 1288 WaterMark.exe 1288 WaterMark.exe 1288 WaterMark.exe 1288 WaterMark.exe 1288 WaterMark.exe 1288 WaterMark.exe 1288 WaterMark.exe 1288 WaterMark.exe 1288 WaterMark.exe 1288 WaterMark.exe 1288 WaterMark.exe 1288 WaterMark.exe 1288 WaterMark.exe 1288 WaterMark.exe - Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 2796 rundll32mgr.exe Token: SeDebugPrivilege 1288 WaterMark.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4456 iexplore.exe 4208 iexplore.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4208 iexplore.exe 4208 iexplore.exe 4456 iexplore.exe 4456 iexplore.exe 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE 1968 IEXPLORE.EXE 1968 IEXPLORE.EXE 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE - Suspicious use of UnmapMainImage 2 IoCs
pid Process 2796 rundll32mgr.exe 1288 WaterMark.exe - Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 2736 wrote to memory of 4608 2736 rundll32.exe 84 PID 2736 wrote to memory of 4608 2736 rundll32.exe 84 PID 2736 wrote to memory of 4608 2736 rundll32.exe 84 PID 4608 wrote to memory of 2796 4608 rundll32.exe 86 PID 4608 wrote to memory of 2796 4608 rundll32.exe 86 PID 4608 wrote to memory of 2796 4608 rundll32.exe 86 PID 2796 wrote to memory of 784 2796 rundll32mgr.exe 8 PID 2796 wrote to memory of 792 2796 rundll32mgr.exe 9 PID 2796 wrote to memory of 380 2796 rundll32mgr.exe 13 PID 2796 wrote to memory of 1288 2796 rundll32mgr.exe 89 PID 2796 wrote to memory of 1288 2796 rundll32mgr.exe 89 PID 2796 wrote to memory of 1288 2796 rundll32mgr.exe 89 PID 1288 wrote to memory of 4452 1288 WaterMark.exe 108 PID 1288 wrote to memory of 4452 1288 WaterMark.exe 108 PID 1288 wrote to memory of 4452 1288 WaterMark.exe 108 PID 1288 wrote to memory of 4452 1288 WaterMark.exe 108 PID 1288 wrote to memory of 4452 1288 WaterMark.exe 108 PID 1288 wrote to memory of 4452 1288 WaterMark.exe 108 PID 1288 wrote to memory of 4452 1288 WaterMark.exe 108 PID 1288 wrote to memory of 4452 1288 WaterMark.exe 108 PID 1288 wrote to memory of 4452 1288 WaterMark.exe 108 PID 1288 wrote to memory of 4456 1288 WaterMark.exe 98 PID 1288 wrote to memory of 4456 1288 WaterMark.exe 98 PID 1288 wrote to memory of 4208 1288 WaterMark.exe 99 PID 1288 wrote to memory of 4208 1288 WaterMark.exe 99 PID 4208 wrote to memory of 1968 4208 iexplore.exe 101 PID 4208 wrote to memory of 1968 4208 iexplore.exe 101 PID 4208 wrote to memory of 1968 4208 iexplore.exe 101 PID 4456 wrote to memory of 2432 4456 iexplore.exe 102 PID 4456 wrote to memory of 2432 4456 iexplore.exe 102 PID 4456 wrote to memory of 2432 4456 iexplore.exe 102 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32mgr.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:380
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b64611d1dc24557468045da4200d7b23ac65a9a7b82cc00a0e00b548acb1147dN.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b64611d1dc24557468045da4200d7b23ac65a9a7b82cc00a0e00b548acb1147dN.dll,#12⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2796 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵PID:4452
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4456 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2432
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4208 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1968
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 6163⤵
- Program crash
PID:1008
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4608 -ip 46081⤵PID:1280
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4452
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 471B
- SHA256 827c003c6df276ce196f529c9eec8e8e9432a77d7fbf305bf4610b958ab0cc62
- MD5 b909bfd2e03c49d34587e9cdb145c04b
- SHA1 15db2aad70670817c64517672f68195503395aa4
- SHA512 a89285a7493a5e06117c06b68849e9652e9f1a92c13ff9268c6a718369236637d557ec4f97edf36bb655d155e3f15756834fde9bb4f08b43e135e90b25e9c72e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 404B
- SHA256 f2d1a55c8a7cd6bba290b8c71d60964ddf5ffbf2533327932e5149f0eb763142
- MD5 2fdf2c10bc8cb9c2b00471904820ca84
- SHA1 fe6d222507ab10b2dbac65d8aabfa18fc62aca7a
- SHA512 aa72fefe02b90a7786bcee44eefe75ed4850826f5a04ddbbf9de8f96e5530eaa804868b9e334ab7f7bd173b1afe1844e00017e0f1d327505e0145033f430af07
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 404B
- SHA256 5b459b64cac81dcae7aa6da2e670e15468bcaa83060eed84961b13d89307df93
- MD5 86443b03403ca7167d83a62c74c7054e
- SHA1 3901a0e1cdea6518f5f4f065c8f740c86c0138ef
- SHA512 2a6da3f4072f3c320ea62df6903bf71083e8e8f93bfd3bcde8834db7120921e8e9df3b98ac6bbd18fc1a0d9000459b1dc2cbbfeef2d44212b87261ffecfa3f3d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EEDB2D46-8FA9-11EF-A7EA-DA61A5E71E4E}.dat
- Size 5KB
- SHA256 2596349951ddddcf2965ffcfc8776f02ab97d0f58deafc89186c81f9ec85288a
- MD5 5786a64b42ea22a46ee61f38fee4e463
- SHA1 744b739702079766fd6e8ba5f8900b163174e36a
- SHA512 16c52f3db40c492bfda583dff8867b84ba291eae0f2e6e69a51691799182d8fa8a5105e8c038af01901d63e0df312b3565d0240de4925227c0adcbdfd2abee5d
- SSDEEP 24:r32oGo/QVgKGo/5bI879lW0rEqovt41Loq9lW0rEqovt41LokLo:r9Go4XGo1rCTqQt41LuTqQt41LxL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EEDD9042-8FA9-11EF-A7EA-DA61A5E71E4E}.dat
- Size 3KB
- SHA256 82b16360d9a619d7aff0906a4827b556429a6694496245b4b03dee2a5ddaa1e1
- MD5 b189327704c32ee1640003090cb6ca0a
- SHA1 e65602f3e77b5b44d06389f55c89805c6f592ae0
- SHA512 1d46e5da0ac62357703b51566d304f796d0e17722c33c80a719e64881c900b799e0fbf4a0ccba0b19e4d30a8262a0a8415c476a549edcde9b28d4470cc8b9936
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver1D0A.tmp
- Size 15KB
- SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
- MD5 1a545d0052b581fbb2ab4c52133846bc
- SHA1 62f3266a9b9925cd6d98658b92adec673cbe3dd3
- SHA512 bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
- SSDEEP 384:79Jv9DF9/C9qc9/J9V791T9TK9Xf9Nm9xQ95a9BR9fV:79Jv9DF9/C9qc9/J9V791T9TK9Xf9NmT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VKYZDMA5\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\rundll32mgr.exe
- Size 164KB
- SHA256 a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee
- MD5 a3b1f1c4cd75bea10095e054f990bf1d
- SHA1 15bf037b2166d2533e12bbec9f1d5f9a3ad8c81b
- SHA512 7457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94
- SSDEEP 3072:eR2xn3k0CdM1vabyzJYWqksZYdjpngDJ9N2m+:eR2J0LS6Vkrl9g4m+
- MD5 SHA1 SHA512 SSDEEP