Analysis
- max time kernel
26s - max time network
121s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
10/11/2024, 03:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b272e2dd318b37767eb9201f92b35b79043651c704d8cae125b9ca8ad5427152N.dll
Resource
win7-20240903-en
windows7-x64
23 signatures
120 seconds
General
- Target b272e2dd318b37767eb9201f92b35b79043651c704d8cae125b9ca8ad5427152N.dll
- Size 757KB
- Sample241110-ej8xeszbjd
- SHA256 b272e2dd318b37767eb9201f92b35b79043651c704d8cae125b9ca8ad5427152
- MD5 cb0cb6b45cfce5439a54101bc780ec20
- SHA1 3d60fdedd3f507576173021d846008cd543c0852
- SHA512 c1b430ec9cb8ba3eae0d549db75327fafcd10ac4f8c4b098d616ce111fad31adade2e8615c3d23ac64a1dd79d54aaf3eab7209150f79910ac35d315933a4c9f3
- SSDEEP 12288:cNIyZN4+Wv4PLq6Okrh9ZN/hs9DsdaLUJ3eLxN:c9TPmirh9Zdh6ouT
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" IEXPLORE.EXE Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" IEXPLORE.EXE Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" IEXPLORE.EXE - Ramnit family
- Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" IEXPLORE.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" IEXPLORE.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" IEXPLORE.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" IEXPLORE.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" IEXPLORE.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" IEXPLORE.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WaterMark.exe - Executes dropped EXE 2 IoCs
pid Process 3464 rundll32mgr.exe 1152 WaterMark.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WaterMark.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc rundll32mgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32mgr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WaterMark.exe - Enumerates connected drives 3 TTPs 7 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: WaterMark.exe File opened (read-only) \??\I: WaterMark.exe File opened (read-only) \??\J: WaterMark.exe File opened (read-only) \??\K: WaterMark.exe File opened (read-only) \??\E: IEXPLORE.EXE File opened (read-only) \??\E: WaterMark.exe File opened (read-only) \??\G: WaterMark.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
resource yara_rule behavioral2/memory/3464-6-0x0000000003170000-0x00000000041FE000-memory.dmp upx behavioral2/memory/3464-18-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3464-8-0x0000000003170000-0x00000000041FE000-memory.dmp upx behavioral2/memory/3464-9-0x0000000003170000-0x00000000041FE000-memory.dmp upx behavioral2/memory/3464-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3464-17-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3464-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3464-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3464-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3464-20-0x0000000003170000-0x00000000041FE000-memory.dmp upx behavioral2/memory/3464-24-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1152-30-0x00000000031D0000-0x000000000425E000-memory.dmp upx behavioral2/memory/1152-43-0x00000000031D0000-0x000000000425E000-memory.dmp upx behavioral2/memory/1152-42-0x00000000031D0000-0x000000000425E000-memory.dmp upx behavioral2/memory/1152-44-0x00000000031D0000-0x000000000425E000-memory.dmp upx behavioral2/memory/1152-49-0x00000000031D0000-0x000000000425E000-memory.dmp upx behavioral2/memory/1152-50-0x00000000031D0000-0x000000000425E000-memory.dmp upx behavioral2/memory/1152-46-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1152-45-0x00000000031D0000-0x000000000425E000-memory.dmp upx behavioral2/memory/1152-37-0x00000000031D0000-0x000000000425E000-memory.dmp upx behavioral2/memory/1152-51-0x00000000031D0000-0x000000000425E000-memory.dmp upx behavioral2/memory/1152-68-0x00000000031D0000-0x000000000425E000-memory.dmp upx behavioral2/memory/1152-67-0x00000000031D0000-0x000000000425E000-memory.dmp upx behavioral2/memory/1152-70-0x00000000031D0000-0x000000000425E000-memory.dmp upx behavioral2/memory/1152-74-0x00000000031D0000-0x000000000425E000-memory.dmp upx behavioral2/memory/1152-73-0x00000000031D0000-0x000000000425E000-memory.dmp upx behavioral2/memory/1152-76-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1152-78-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1152-77-0x00000000031D0000-0x000000000425E000-memory.dmp upx behavioral2/memory/1152-80-0x00000000031D0000-0x000000000425E000-memory.dmp upx behavioral2/memory/1152-81-0x00000000031D0000-0x000000000425E000-memory.dmp upx behavioral2/memory/1152-82-0x00000000031D0000-0x000000000425E000-memory.dmp upx behavioral2/memory/1152-86-0x00000000031D0000-0x000000000425E000-memory.dmp upx behavioral2/memory/1152-87-0x00000000031D0000-0x000000000425E000-memory.dmp upx behavioral2/memory/1152-95-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1152-113-0x00000000031D0000-0x000000000425E000-memory.dmp upx - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\pxB054.tmp rundll32mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI rundll32mgr.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1028 4452 WerFault.exe 85 - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{30F4C404-9F18-11EF-ADF2-CAFD856C81B1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{30F4EB14-9F18-11EF-ADF2-CAFD856C81B1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 3464 rundll32mgr.exe 3464 rundll32mgr.exe 1152 WaterMark.exe 1152 WaterMark.exe 1152 WaterMark.exe 1152 WaterMark.exe 1152 WaterMark.exe 1152 WaterMark.exe 1152 WaterMark.exe 1152 WaterMark.exe 1152 WaterMark.exe 1152 WaterMark.exe 1152 WaterMark.exe 1152 WaterMark.exe 1152 WaterMark.exe 1152 WaterMark.exe 1152 WaterMark.exe 1152 WaterMark.exe 1152 WaterMark.exe 1152 WaterMark.exe 1152 WaterMark.exe 1152 WaterMark.exe 3808 IEXPLORE.EXE 3808 IEXPLORE.EXE - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 3464 rundll32mgr.exe Token: SeDebugPrivilege 1152 WaterMark.exe Token: SeDebugPrivilege 1152 WaterMark.exe Token: SeDebugPrivilege 1152 WaterMark.exe Token: SeDebugPrivilege 1152 WaterMark.exe Token: SeDebugPrivilege 1152 WaterMark.exe Token: SeDebugPrivilege 1152 WaterMark.exe Token: SeDebugPrivilege 1152 WaterMark.exe Token: SeDebugPrivilege 1152 WaterMark.exe Token: SeDebugPrivilege 1152 WaterMark.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4036 iexplore.exe 4900 iexplore.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4900 iexplore.exe 4900 iexplore.exe 4036 iexplore.exe 4036 iexplore.exe 3808 IEXPLORE.EXE 3808 IEXPLORE.EXE 504 IEXPLORE.EXE 504 IEXPLORE.EXE 3808 IEXPLORE.EXE 3808 IEXPLORE.EXE - Suspicious use of UnmapMainImage 2 IoCs
pid Process 3464 rundll32mgr.exe 1152 WaterMark.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5056 wrote to memory of 4452 5056 rundll32.exe 85 PID 5056 wrote to memory of 4452 5056 rundll32.exe 85 PID 5056 wrote to memory of 4452 5056 rundll32.exe 85 PID 4452 wrote to memory of 3464 4452 rundll32.exe 86 PID 4452 wrote to memory of 3464 4452 rundll32.exe 86 PID 4452 wrote to memory of 3464 4452 rundll32.exe 86 PID 3464 wrote to memory of 800 3464 rundll32mgr.exe 8 PID 3464 wrote to memory of 808 3464 rundll32mgr.exe 9 PID 3464 wrote to memory of 388 3464 rundll32mgr.exe 13 PID 3464 wrote to memory of 2676 3464 rundll32mgr.exe 45 PID 3464 wrote to memory of 2760 3464 rundll32mgr.exe 48 PID 3464 wrote to memory of 2352 3464 rundll32mgr.exe 52 PID 3464 wrote to memory of 3436 3464 rundll32mgr.exe 56 PID 3464 wrote to memory of 3556 3464 rundll32mgr.exe 57 PID 3464 wrote to memory of 3748 3464 rundll32mgr.exe 58 PID 3464 wrote to memory of 3840 3464 rundll32mgr.exe 59 PID 3464 wrote to memory of 3900 3464 rundll32mgr.exe 60 PID 3464 wrote to memory of 3996 3464 rundll32mgr.exe 61 PID 3464 wrote to memory of 3684 3464 rundll32mgr.exe 62 PID 3464 wrote to memory of 1152 3464 rundll32mgr.exe 89 PID 3464 wrote to memory of 1152 3464 rundll32mgr.exe 89 PID 3464 wrote to memory of 1152 3464 rundll32mgr.exe 89 PID 1152 wrote to memory of 2636 1152 WaterMark.exe 91 PID 1152 wrote to memory of 2636 1152 WaterMark.exe 91 PID 1152 wrote to memory of 2636 1152 WaterMark.exe 91 PID 1152 wrote to memory of 2636 1152 WaterMark.exe 91 PID 1152 wrote to memory of 2636 1152 WaterMark.exe 91 PID 1152 wrote to memory of 2636 1152 WaterMark.exe 91 PID 1152 wrote to memory of 2636 1152 WaterMark.exe 91 PID 1152 wrote to memory of 2636 1152 WaterMark.exe 91 PID 1152 wrote to memory of 2636 1152 WaterMark.exe 91 PID 1152 wrote to memory of 800 1152 WaterMark.exe 8 PID 1152 wrote to memory of 808 1152 WaterMark.exe 9 PID 1152 wrote to memory of 388 1152 WaterMark.exe 13 PID 1152 wrote to memory of 2676 1152 WaterMark.exe 45 PID 1152 wrote to memory of 2760 1152 WaterMark.exe 48 PID 1152 wrote to memory of 2352 1152 WaterMark.exe 52 PID 1152 wrote to memory of 3436 1152 WaterMark.exe 56 PID 1152 wrote to memory of 3556 1152 WaterMark.exe 57 PID 1152 wrote to memory of 3748 1152 WaterMark.exe 58 PID 1152 wrote to memory of 3840 1152 WaterMark.exe 59 PID 1152 wrote to memory of 3900 1152 WaterMark.exe 60 PID 1152 wrote to memory of 3996 1152 WaterMark.exe 61 PID 1152 wrote to memory of 3684 1152 WaterMark.exe 62 PID 1152 wrote to memory of 4576 1152 WaterMark.exe 74 PID 1152 wrote to memory of 4660 1152 WaterMark.exe 76 PID 1152 wrote to memory of 1928 1152 WaterMark.exe 83 PID 1152 wrote to memory of 5056 1152 WaterMark.exe 84 PID 1152 wrote to memory of 4452 1152 WaterMark.exe 85 PID 1152 wrote to memory of 4452 1152 WaterMark.exe 85 PID 1152 wrote to memory of 3888 1152 WaterMark.exe PID 1152 wrote to memory of 1028 1152 WaterMark.exe 90 PID 1152 wrote to memory of 1028 1152 WaterMark.exe 90 PID 1152 wrote to memory of 4036 1152 WaterMark.exe 92 PID 1152 wrote to memory of 4036 1152 WaterMark.exe 92 PID 1152 wrote to memory of 4900 1152 WaterMark.exe 93 PID 1152 wrote to memory of 4900 1152 WaterMark.exe 93 PID 4900 wrote to memory of 504 4900 iexplore.exe 95 PID 4900 wrote to memory of 504 4900 iexplore.exe 95 PID 4900 wrote to memory of 504 4900 iexplore.exe 95 PID 4036 wrote to memory of 3808 4036 iexplore.exe 96 PID 4036 wrote to memory of 3808 4036 iexplore.exe 96 PID 4036 wrote to memory of 3808 4036 iexplore.exe 96 PID 1152 wrote to memory of 800 1152 WaterMark.exe 8 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WaterMark.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:808
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:388
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2676
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2760
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2352
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b272e2dd318b37767eb9201f92b35b79043651c704d8cae125b9ca8ad5427152N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b272e2dd318b37767eb9201f92b35b79043651c704d8cae125b9ca8ad5427152N.dll,#13⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3464 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1152 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵PID:2636
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4036 CREDAT:17410 /prefetch:27⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3808
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4900 CREDAT:17410 /prefetch:27⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:504
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 6084⤵
- Program crash
PID:1028
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3556
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3748
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3840
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3900
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3996
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3684
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4576
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4660
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4452 -ip 44521⤵PID:4332
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵PID:4936
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2796
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4104
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 471B
- SHA256 a231a95c194f54c33eef59babf53d979f0342fbc68bc52dbb524887fd378418d
- MD5 042619486a0f512d0313c7b4fa6c9756
- SHA1 9a3f09247b4b03933f23331b4f0207672c93e02a
- SHA512 4b2b32d754d116b0609ca43b9ff54ad72c9e22ddbd617b5c94586a219c297c13823c0c2812937db6b2181382176bba46b2f3d37b4b29ae6f171e01ada216c257
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 404B
- SHA256 d15b660e31b5460cabf9f257367d074e72cf19e739c1df30d138645bbb620dc0
- MD5 91ac975ee5c426c19849154139dd8570
- SHA1 3c78c2cb8e466e885a7ae59dd629f7f6eb318b65
- SHA512 eb4209ff67e3dcf46e14c7135f6fa1a967039ccfe99c67a007a7d2a8419c546c9c9b6e96c2523b7fe95309c56da90cf03da0267042084f7a085b53fe54606900
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 404B
- SHA256 ba6a4c2004648859eadbe2f9a327a747c648005d16b2a84db181f2acbd8f89a6
- MD5 407002fe834feaf117af40fe8eed6f14
- SHA1 c597a9098c0096463607151b1161186703c95ed4
- SHA512 b1e45288dd4f02f8188e2459372028fad2d04eab35bae58aa3c0a810572156b09695143a86091d064fec4ab112499d28e405f0e1ef7363398098e3e1b987fed6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{30F4C404-9F18-11EF-ADF2-CAFD856C81B1}.dat
- Size 5KB
- SHA256 f5094611d71fda5c0dcb471b50af30369ad15da7e04a5754e54d7bee1b14881f
- MD5 43d57b27eb6b8fbca5bf55957a9e00fc
- SHA1 4690a3d3443e4e74e18d1c14fde435de554ddf32
- SHA512 752dccaa357bf89a905d8edd7a82a9f85a3224168463fa2d981cb59dc84413b486b1de0bd16319c8fb4cb78e158798a74c6c4c6b117630dc9368e3ff5c5f9f1f
- SSDEEP 24:rbjGo/QQiZkUGo/siZLNiZ879lWr2yg9lWr2y:rbjGo4QhUGok+NLCrTNrT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{30F4EB14-9F18-11EF-ADF2-CAFD856C81B1}.dat
- Size 5KB
- SHA256 474b8a95db28ccd0fb86b48d3e78ec0c60feb95ab62728bb74c7c858fef4ee6a
- MD5 cf610494727697527dba13c7998465b6
- SHA1 6f7b4cf9f012fefba1d86095c65f630c4292df5d
- SHA512 48083ef297490a7e4b8b0fd1e708ab84487bc1707497baa4741e6ca297538d521e8478dbc8e07df38f32f80d5bdcb0bcb63241428b40a0445f81d1532450cc02
- SSDEEP 24:rRGo/QgiZBGo/8iZ5iZ879lW/3VuZ9lW/3Vu:rRGo4gQGo0aLCvA8vA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver4745.tmp
- Size 15KB
- SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
- MD5 1a545d0052b581fbb2ab4c52133846bc
- SHA1 62f3266a9b9925cd6d98658b92adec673cbe3dd3
- SHA512 bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
- SSDEEP 384:79Jv9DF9/C9qc9/J9V791T9TK9Xf9Nm9xQ95a9BR9fV:79Jv9DF9/C9qc9/J9V791T9TK9Xf9NmT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PGH3GSHW\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 ad0867e51af0190aa4dbe51ce3a31bb2e123dfbcde2e55b72353f1d5e99690ed
- MD5 f75949c8fdc58da36eddf886dadcf74d
- SHA1 68f07e8c557ee3f47981b40d1c7b81a8adf9e613
- SHA512 18cc46a89b102ae46749c6741361e0eae37e27d23649a53e7cfcf34bbce061b146b6d69451589e994b09ebcf6b38c1104d681b25c9b5a0d972a96474facacaed
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\rundll32mgr.exe
- Size 172KB
- SHA256 356e9823881771173c49a873e9b6bd2711bea70faf850d2a11c9763ef32b12cb
- MD5 0c5ca16521263cc228dfb8bd87cadc47
- SHA1 71fb20ed6ef52572cadb2acbba4a0ad0c7bea5d2
- SHA512 725533dbfe54d0dd0e7172d780b8eb911e0705456dc2d5e1bf66ee696d3042c6b136b8f228042a59acad155e1f2429c86c9454b98b41c07729f85dadcba36b41
- SSDEEP 3072:UR2xn3k0CdM1vabyzJYWq5flonp83bixx3H+jBJhF:UR2J0LS6Vni3e5F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\wpyubd.pif
- Size 100KB
- SHA256 318ada01abac1eb4cccfd05bb0c903e4ad543dc00ead6943656a608a21efcd3f
- MD5 1778818ba75ab00ea5e66f234a7a3fa0
- SHA1 0bf8cc0eabf37573af1a25dbd7f85830dd5dd2fe
- SHA512 8d94acc4fd57f047449be514cc00feac48c1a4fd1307ee91a7bc5c2586c8da0170f907b5941bcb9e7d2fdde13349631506dd75d0089197a10ef5390cf67bf699
- SSDEEP 1536:fS5s7HO2P7D/EWAQCKtTAcQIjOz5zDQbLfZNhrWGMVsoR:fieHO20WAQ9XQ2Odw3f3hPmR
- MD5 SHA1 SHA512 SSDEEP