Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/12/2024, 02:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b35dc58b3ec34a86831ec82f925d71075d863a0c83646782650f099f2ca91d79.dll
Resource
win7-20240903-en
windows7-x64
22 signatures
120 seconds
General
-
Target
b35dc58b3ec34a86831ec82f925d71075d863a0c83646782650f099f2ca91d79.dll
-
Size
377KB
-
MD5
81dd5b8555731f2645abb1f48926708b
-
SHA1
27506c56c1dc6a10bef749929618af998bd7f45b
-
SHA256
b35dc58b3ec34a86831ec82f925d71075d863a0c83646782650f099f2ca91d79
-
SHA512
24f6f483c226f0a5c86772d06b5b3f81ad71e2ffe3d2119a61c0da37f100677689235f4b39848c197c1a4c159b2d46088edf02b53862ebc5a945c15823375c64
-
SSDEEP
6144:uxGMku94XCzTurXzURlbDC9K69u2m+SqOWcsQQKiY4leDDGoggH/VREG6j4Gm01n:uxGCOXzURlbDC9K69u2m+SqOWcsQQKi/
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" rundll32mgr.exe -
Ramnit family
-
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32mgr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32mgr.exe -
Executes dropped EXE 2 IoCs
pid Process 1432 rundll32mgr.exe 2452 WaterMark.exe -
Loads dropped DLL 4 IoCs
pid Process 1172 rundll32.exe 1172 rundll32.exe 1432 rundll32mgr.exe 1432 rundll32mgr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32mgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc rundll32mgr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32mgr.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
resource yara_rule behavioral1/memory/1432-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1432-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1432-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1432-19-0x0000000002910000-0x000000000399E000-memory.dmp upx behavioral1/memory/1432-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1432-17-0x0000000002910000-0x000000000399E000-memory.dmp upx behavioral1/memory/1432-27-0x0000000002910000-0x000000000399E000-memory.dmp upx behavioral1/memory/1432-24-0x0000000002910000-0x000000000399E000-memory.dmp upx behavioral1/memory/1432-28-0x0000000002910000-0x000000000399E000-memory.dmp upx behavioral1/memory/1432-42-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1432-41-0x0000000002910000-0x000000000399E000-memory.dmp upx behavioral1/memory/1432-25-0x0000000002910000-0x000000000399E000-memory.dmp upx behavioral1/memory/1432-26-0x0000000002910000-0x000000000399E000-memory.dmp upx behavioral1/memory/1432-22-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1432-21-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1432-20-0x0000000002910000-0x000000000399E000-memory.dmp upx behavioral1/memory/1432-11-0x0000000002910000-0x000000000399E000-memory.dmp upx behavioral1/memory/1432-45-0x0000000002910000-0x000000000399E000-memory.dmp upx behavioral1/memory/1432-53-0x0000000002910000-0x000000000399E000-memory.dmp upx behavioral1/memory/2452-80-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2452-76-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1432-44-0x0000000002910000-0x000000000399E000-memory.dmp upx behavioral1/memory/2452-413-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_dummy_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_hevc_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpsychedelic_plugin.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClientsideProviders.resources.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\javafx-font.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libcompressor_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libx264_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_delay_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\jvm.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProvider.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libswscale_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\libxslt.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MAPISHELL.DLL svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libwin_msg_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\logger\libfile_logger_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll svchost.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Speech.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px9128.tmp rundll32mgr.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationCore.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libasf_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libps_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libclone_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libkaraoke_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationTypes.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_standard_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_stats_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxmedia.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\NAMEEXT.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libspdif_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libwav_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libwingdi_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunmscapi.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\msdbg2.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\plugin2\msvcr100.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Printing.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libaiff_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxwebkit.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe svchost.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\VISSHE.DLL svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\deploy.dll svchost.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libfingerprinter_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\libarchive_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Journal\jnwppr.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\JdbcOdbc.dll svchost.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI rundll32mgr.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 1432 rundll32mgr.exe 2452 WaterMark.exe 2452 WaterMark.exe 2452 WaterMark.exe 2452 WaterMark.exe 2452 WaterMark.exe 2452 WaterMark.exe 2452 WaterMark.exe 2452 WaterMark.exe 2868 svchost.exe 2868 svchost.exe 2868 svchost.exe 2868 svchost.exe 2868 svchost.exe 2868 svchost.exe 2868 svchost.exe 2868 svchost.exe 2868 svchost.exe 2868 svchost.exe 2868 svchost.exe 2868 svchost.exe 2868 svchost.exe 2868 svchost.exe 2868 svchost.exe 2868 svchost.exe 2868 svchost.exe 2868 svchost.exe 2868 svchost.exe 2868 svchost.exe 2868 svchost.exe 2868 svchost.exe 2868 svchost.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 1432 rundll32mgr.exe Token: SeDebugPrivilege 1432 rundll32mgr.exe Token: SeDebugPrivilege 1432 rundll32mgr.exe Token: SeDebugPrivilege 1432 rundll32mgr.exe Token: SeDebugPrivilege 1432 rundll32mgr.exe Token: SeDebugPrivilege 1432 rundll32mgr.exe Token: SeDebugPrivilege 1432 rundll32mgr.exe Token: SeDebugPrivilege 1432 rundll32mgr.exe Token: SeDebugPrivilege 1432 rundll32mgr.exe Token: SeDebugPrivilege 1432 rundll32mgr.exe Token: SeDebugPrivilege 1432 rundll32mgr.exe Token: SeDebugPrivilege 1432 rundll32mgr.exe Token: SeDebugPrivilege 1432 rundll32mgr.exe Token: SeDebugPrivilege 1432 rundll32mgr.exe Token: SeDebugPrivilege 1432 rundll32mgr.exe Token: SeDebugPrivilege 1432 rundll32mgr.exe Token: SeDebugPrivilege 1432 rundll32mgr.exe Token: SeDebugPrivilege 1432 rundll32mgr.exe Token: SeDebugPrivilege 1432 rundll32mgr.exe Token: SeDebugPrivilege 1432 rundll32mgr.exe Token: SeDebugPrivilege 1432 rundll32mgr.exe Token: SeDebugPrivilege 1432 rundll32mgr.exe Token: SeDebugPrivilege 2452 WaterMark.exe Token: SeDebugPrivilege 2868 svchost.exe Token: SeDebugPrivilege 2452 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1432 rundll32mgr.exe 2452 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1740 wrote to memory of 1172 1740 rundll32.exe 30 PID 1740 wrote to memory of 1172 1740 rundll32.exe 30 PID 1740 wrote to memory of 1172 1740 rundll32.exe 30 PID 1740 wrote to memory of 1172 1740 rundll32.exe 30 PID 1740 wrote to memory of 1172 1740 rundll32.exe 30 PID 1740 wrote to memory of 1172 1740 rundll32.exe 30 PID 1740 wrote to memory of 1172 1740 rundll32.exe 30 PID 1172 wrote to memory of 1432 1172 rundll32.exe 31 PID 1172 wrote to memory of 1432 1172 rundll32.exe 31 PID 1172 wrote to memory of 1432 1172 rundll32.exe 31 PID 1172 wrote to memory of 1432 1172 rundll32.exe 31 PID 1432 wrote to memory of 1128 1432 rundll32mgr.exe 19 PID 1432 wrote to memory of 1192 1432 rundll32mgr.exe 20 PID 1432 wrote to memory of 1240 1432 rundll32mgr.exe 21 PID 1432 wrote to memory of 864 1432 rundll32mgr.exe 23 PID 1432 wrote to memory of 2452 1432 rundll32mgr.exe 32 PID 1432 wrote to memory of 2452 1432 rundll32mgr.exe 32 PID 1432 wrote to memory of 2452 1432 rundll32mgr.exe 32 PID 1432 wrote to memory of 2452 1432 rundll32mgr.exe 32 PID 2452 wrote to memory of 2384 2452 WaterMark.exe 33 PID 2452 wrote to memory of 2384 2452 WaterMark.exe 33 PID 2452 wrote to memory of 2384 2452 WaterMark.exe 33 PID 2452 wrote to memory of 2384 2452 WaterMark.exe 33 PID 2452 wrote to memory of 2384 2452 WaterMark.exe 33 PID 2452 wrote to memory of 2384 2452 WaterMark.exe 33 PID 2452 wrote to memory of 2384 2452 WaterMark.exe 33 PID 2452 wrote to memory of 2384 2452 WaterMark.exe 33 PID 2452 wrote to memory of 2384 2452 WaterMark.exe 33 PID 2452 wrote to memory of 2384 2452 WaterMark.exe 33 PID 2452 wrote to memory of 2868 2452 WaterMark.exe 34 PID 2452 wrote to memory of 2868 2452 WaterMark.exe 34 PID 2452 wrote to memory of 2868 2452 WaterMark.exe 34 PID 2452 wrote to memory of 2868 2452 WaterMark.exe 34 PID 2452 wrote to memory of 2868 2452 WaterMark.exe 34 PID 2452 wrote to memory of 2868 2452 WaterMark.exe 34 PID 2452 wrote to memory of 2868 2452 WaterMark.exe 34 PID 2452 wrote to memory of 2868 2452 WaterMark.exe 34 PID 2452 wrote to memory of 2868 2452 WaterMark.exe 34 PID 2452 wrote to memory of 2868 2452 WaterMark.exe 34 PID 2868 wrote to memory of 256 2868 svchost.exe 1 PID 2868 wrote to memory of 256 2868 svchost.exe 1 PID 2868 wrote to memory of 256 2868 svchost.exe 1 PID 2868 wrote to memory of 256 2868 svchost.exe 1 PID 2868 wrote to memory of 256 2868 svchost.exe 1 PID 2868 wrote to memory of 332 2868 svchost.exe 2 PID 2868 wrote to memory of 332 2868 svchost.exe 2 PID 2868 wrote to memory of 332 2868 svchost.exe 2 PID 2868 wrote to memory of 332 2868 svchost.exe 2 PID 2868 wrote to memory of 332 2868 svchost.exe 2 PID 2868 wrote to memory of 384 2868 svchost.exe 3 PID 2868 wrote to memory of 384 2868 svchost.exe 3 PID 2868 wrote to memory of 384 2868 svchost.exe 3 PID 2868 wrote to memory of 384 2868 svchost.exe 3 PID 2868 wrote to memory of 384 2868 svchost.exe 3 PID 2868 wrote to memory of 392 2868 svchost.exe 4 PID 2868 wrote to memory of 392 2868 svchost.exe 4 PID 2868 wrote to memory of 392 2868 svchost.exe 4 PID 2868 wrote to memory of 392 2868 svchost.exe 4 PID 2868 wrote to memory of 392 2868 svchost.exe 4 PID 2868 wrote to memory of 432 2868 svchost.exe 5 PID 2868 wrote to memory of 432 2868 svchost.exe 5 PID 2868 wrote to memory of 432 2868 svchost.exe 5 PID 2868 wrote to memory of 432 2868 svchost.exe 5 PID 2868 wrote to memory of 432 2868 svchost.exe 5 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32mgr.exe
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:256
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:332
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:616
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:864
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1876
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:696
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:772
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:832
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1192
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:868
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵PID:1108
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:980
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:280
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:292
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1044
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1128
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:1088
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2288
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2236
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:392
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1240
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b35dc58b3ec34a86831ec82f925d71075d863a0c83646782650f099f2ca91d79.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b35dc58b3ec34a86831ec82f925d71075d863a0c83646782650f099f2ca91d79.dll,#13⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1432 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2384
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize342KB
MD5b26ac46cebe8ef900b475029762ebcc0
SHA12ae98e370540215dc23c844ea1e6259ec765a970
SHA2567f89a5960e28473da9838b349df5e41ab74461ca7acea703af0f11fc1875d3cc
SHA51243276dec21e0d4f2aa4af1b6ad1b8d0caed68085a1645b83d97fd934a3dbe22b66bbdad48d48f0e6c1e1ba68d001a7a4d4e90630af3fa9c3ec15dbab2da0227d
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize338KB
MD5784a9a085c56dc2bcb2b3dcd661f1a6e
SHA185ea21466d0a26ab69b94dfebbab425b7ba8bcb2
SHA25601d079fbd3f9f54374579971b4944983f380b3210d6e0d0e8b736f8c6e4ed0f0
SHA512b413445da713c62a01c2ac482774a9fb93b951a50731a36af8e805c74e2252754aa935706aa522882410db64ac9058cfd0b5ae10fcc67062553a1f8d0c977e87
-
Filesize
164KB
MD5a3b1f1c4cd75bea10095e054f990bf1d
SHA115bf037b2166d2533e12bbec9f1d5f9a3ad8c81b
SHA256a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee
SHA5127457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94