Analysis
-
max time kernel
31s -
max time network
87s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 16:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fa73085ab18b3c1878366c12734c1dc31f0f6b5b404d18f8a702659ffed3aebd.dll
Resource
win7-20240903-en
windows7-x64
24 signatures
120 seconds
General
-
Target
fa73085ab18b3c1878366c12734c1dc31f0f6b5b404d18f8a702659ffed3aebd.dll
-
Size
624KB
-
MD5
ef7f6311e29192dff8699df2780477b7
-
SHA1
982133187b07f58c91c4eeb9e8f1b1edaf7bdc84
-
SHA256
fa73085ab18b3c1878366c12734c1dc31f0f6b5b404d18f8a702659ffed3aebd
-
SHA512
824fedaa0ed21c68acd0a3dc63c1f93ed7d2776b9f0fa746f0a0902d4e160780688a956b055fb9e6ff1100b7133ab12b98312cb4945b566c391c1919a8b20202
-
SSDEEP
12288:8hpUrEIZJqr1AkBWwNa5R0EYl795/amaX3QXaPKUVrCsB9ks:8/jG01NHXaPlCs1
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" svchost.exe -
Ramnit family
-
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" svchost.exe -
Executes dropped EXE 2 IoCs
pid Process 2828 rundll32mgr.exe 2848 WaterMark.exe -
Loads dropped DLL 4 IoCs
pid Process 2712 rundll32.exe 2712 rundll32.exe 2828 rundll32mgr.exe 2828 rundll32mgr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32mgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" WaterMark.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc WaterMark.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WaterMark.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WaterMark.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\H: WaterMark.exe File opened (read-only) \??\I: WaterMark.exe File opened (read-only) \??\N: WaterMark.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\L: WaterMark.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\E: WaterMark.exe File opened (read-only) \??\G: WaterMark.exe File opened (read-only) \??\J: WaterMark.exe File opened (read-only) \??\K: WaterMark.exe File opened (read-only) \??\M: WaterMark.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
resource yara_rule behavioral1/memory/2828-22-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2828-21-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2828-15-0x00000000028B0000-0x000000000393E000-memory.dmp upx behavioral1/memory/2828-19-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2828-18-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2828-17-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2828-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2828-32-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2848-36-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/2848-55-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/2848-54-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/2848-57-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2848-56-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/2848-46-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/2848-43-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/2848-50-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2848-44-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/2848-42-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/2848-45-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/2848-475-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/2848-477-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2848-793-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2848-794-0x0000000002680000-0x000000000370E000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\msxactps.dll svchost.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\ado\msadox.dll svchost.exe File opened for modification C:\Program Files\DVD Maker\OmdBase.dll svchost.exe File opened for modification C:\Program Files\DVD Maker\Pipeline.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll svchost.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\sqloledb.dll svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\msdaosp.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm svchost.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadco.dll svchost.exe File opened for modification C:\Program Files\DVD Maker\OmdProject.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL svchost.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msaddsr.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\wab32.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll svchost.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\DirectDB.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdaremr.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\oledb32r.dll svchost.exe File opened for modification C:\Program Files\DVD Maker\PipeTran.dll svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px2C3E.tmp rundll32mgr.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\ado\msador15.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL svchost.exe File opened for modification C:\Program Files\Common Files\System\ado\msadrh15.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdarem.dll svchost.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI WaterMark.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2640 2712 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2848 WaterMark.exe 2848 WaterMark.exe 2848 WaterMark.exe 2640 WerFault.exe 2640 WerFault.exe 2640 WerFault.exe 2640 WerFault.exe 2640 WerFault.exe 2848 WaterMark.exe 2848 WaterMark.exe 2848 WaterMark.exe 2848 WaterMark.exe 2848 WaterMark.exe 2848 WaterMark.exe 1488 svchost.exe 1488 svchost.exe 2848 WaterMark.exe 1488 svchost.exe 2056 svchost.exe 1488 svchost.exe 1488 svchost.exe 2056 svchost.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2848 WaterMark.exe Token: SeDebugPrivilege 2848 WaterMark.exe Token: SeDebugPrivilege 2848 WaterMark.exe Token: SeDebugPrivilege 2640 WerFault.exe Token: SeDebugPrivilege 1488 svchost.exe Token: SeDebugPrivilege 2848 WaterMark.exe Token: SeDebugPrivilege 2712 rundll32.exe Token: SeDebugPrivilege 2640 WerFault.exe Token: SeDebugPrivilege 2848 WaterMark.exe Token: SeDebugPrivilege 2056 svchost.exe Token: SeDebugPrivilege 2056 svchost.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2828 rundll32mgr.exe 2848 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2076 wrote to memory of 2712 2076 rundll32.exe 30 PID 2076 wrote to memory of 2712 2076 rundll32.exe 30 PID 2076 wrote to memory of 2712 2076 rundll32.exe 30 PID 2076 wrote to memory of 2712 2076 rundll32.exe 30 PID 2076 wrote to memory of 2712 2076 rundll32.exe 30 PID 2076 wrote to memory of 2712 2076 rundll32.exe 30 PID 2076 wrote to memory of 2712 2076 rundll32.exe 30 PID 2712 wrote to memory of 2828 2712 rundll32.exe 31 PID 2712 wrote to memory of 2828 2712 rundll32.exe 31 PID 2712 wrote to memory of 2828 2712 rundll32.exe 31 PID 2712 wrote to memory of 2828 2712 rundll32.exe 31 PID 2828 wrote to memory of 2848 2828 rundll32mgr.exe 32 PID 2828 wrote to memory of 2848 2828 rundll32mgr.exe 32 PID 2828 wrote to memory of 2848 2828 rundll32mgr.exe 32 PID 2828 wrote to memory of 2848 2828 rundll32mgr.exe 32 PID 2712 wrote to memory of 2640 2712 rundll32.exe 33 PID 2712 wrote to memory of 2640 2712 rundll32.exe 33 PID 2712 wrote to memory of 2640 2712 rundll32.exe 33 PID 2712 wrote to memory of 2640 2712 rundll32.exe 33 PID 2848 wrote to memory of 2056 2848 WaterMark.exe 34 PID 2848 wrote to memory of 2056 2848 WaterMark.exe 34 PID 2848 wrote to memory of 2056 2848 WaterMark.exe 34 PID 2848 wrote to memory of 2056 2848 WaterMark.exe 34 PID 2848 wrote to memory of 2056 2848 WaterMark.exe 34 PID 2848 wrote to memory of 2056 2848 WaterMark.exe 34 PID 2848 wrote to memory of 2056 2848 WaterMark.exe 34 PID 2848 wrote to memory of 2056 2848 WaterMark.exe 34 PID 2848 wrote to memory of 2056 2848 WaterMark.exe 34 PID 2848 wrote to memory of 2056 2848 WaterMark.exe 34 PID 2848 wrote to memory of 1116 2848 WaterMark.exe 19 PID 2848 wrote to memory of 1180 2848 WaterMark.exe 20 PID 2848 wrote to memory of 1244 2848 WaterMark.exe 21 PID 2848 wrote to memory of 1440 2848 WaterMark.exe 23 PID 2848 wrote to memory of 2076 2848 WaterMark.exe 29 PID 2848 wrote to memory of 2712 2848 WaterMark.exe 30 PID 2848 wrote to memory of 2712 2848 WaterMark.exe 30 PID 2848 wrote to memory of 2640 2848 WaterMark.exe 33 PID 2848 wrote to memory of 2640 2848 WaterMark.exe 33 PID 2848 wrote to memory of 1488 2848 WaterMark.exe 35 PID 2848 wrote to memory of 1488 2848 WaterMark.exe 35 PID 2848 wrote to memory of 1488 2848 WaterMark.exe 35 PID 2848 wrote to memory of 1488 2848 WaterMark.exe 35 PID 2848 wrote to memory of 1488 2848 WaterMark.exe 35 PID 2848 wrote to memory of 1488 2848 WaterMark.exe 35 PID 2848 wrote to memory of 1488 2848 WaterMark.exe 35 PID 2848 wrote to memory of 1488 2848 WaterMark.exe 35 PID 2848 wrote to memory of 1488 2848 WaterMark.exe 35 PID 2848 wrote to memory of 1488 2848 WaterMark.exe 35 PID 1488 wrote to memory of 256 1488 svchost.exe 1 PID 1488 wrote to memory of 256 1488 svchost.exe 1 PID 1488 wrote to memory of 256 1488 svchost.exe 1 PID 1488 wrote to memory of 256 1488 svchost.exe 1 PID 1488 wrote to memory of 256 1488 svchost.exe 1 PID 1488 wrote to memory of 336 1488 svchost.exe 2 PID 1488 wrote to memory of 336 1488 svchost.exe 2 PID 1488 wrote to memory of 336 1488 svchost.exe 2 PID 1488 wrote to memory of 336 1488 svchost.exe 2 PID 1488 wrote to memory of 336 1488 svchost.exe 2 PID 1488 wrote to memory of 384 1488 svchost.exe 3 PID 1488 wrote to memory of 384 1488 svchost.exe 3 PID 1488 wrote to memory of 384 1488 svchost.exe 3 PID 1488 wrote to memory of 384 1488 svchost.exe 3 PID 1488 wrote to memory of 384 1488 svchost.exe 3 PID 1488 wrote to memory of 392 1488 svchost.exe 4 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WaterMark.exe
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:256
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:336
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:608
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1440
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1044
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:684
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:756
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:828
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1180
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:864
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:980
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:272
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:308
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1080
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1116
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:624
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:1852
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2752
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:488
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:496
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:392
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1244
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fa73085ab18b3c1878366c12734c1dc31f0f6b5b404d18f8a702659ffed3aebd.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fa73085ab18b3c1878366c12734c1dc31f0f6b5b404d18f8a702659ffed3aebd.dll,#13⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2828 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2848 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2056
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 2324⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2640
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize342KB
MD5daad746390ee2b2cbe1fd927deb5ba9f
SHA1c1a6fd2c7b49a790227f265fb3a17a1a9a60aad2
SHA25665f47a93bfebf0c4153f842d18d2f183aff1f3a3d84dbe5fb2cc5f44eacd43a7
SHA512b0f0de3358837c987211e55772c2d331a991430df70e3128be038d1290520b71dfcec870153b8059219dfb4e07326b023a334687a71f8c1da2ea4710fb525d00
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize338KB
MD5b1d8a5bfe10cd6fcf8254a64c1e2d654
SHA11bf92d4dbf69dbe24bd7f2988b0bc3d32f03911b
SHA256f5e98423934a080a583bdc2eb1e9700a7c4397e13e7758df9198153678d6a485
SHA512b1d153aa1cae87b555f69a1ca0788d6b5c45881e41b29bff4b83773f4bc390fef6e1424b4d3a1596c3e1996b62ecf206ae8ef70783087f97ff8c42aba402a06b
-
Filesize
257B
MD5de93c675eac10eb82c2e109f0136534c
SHA1dd222ecaddb38ffa67fe962a1ff4cfb2df0123f7
SHA25648564a045564d879e28b42efb761b26c4d5a270150cdd2a4e8999881986ac959
SHA5123b6233194e9226ee5ea38eb94acd4c3098063c4776afad29bc4b807a262f4b056b2a033ce47a30bfbc893e7a2320e3a7a0a93cf76e242496c1b84a4ce1a09d47
-
Filesize
100KB
MD575df286252dbc145c34f646f73083f95
SHA16c5a66768cf727e0572b48b43f5c3b1e1211b7f2
SHA25667e99da713443da462f6e4e90c9dede0a28fbd92ea23288e3e86dd2d732d69fb
SHA512517f5423395047c4e01fd1b7a61d853529a90764ae4305a94bd5b862314fbc56558b0097e838d26e6f751fecff96ae87a26418868aa5c0bcc34c74ba260deb61
-
Filesize
164KB
MD5a3b1f1c4cd75bea10095e054f990bf1d
SHA115bf037b2166d2533e12bbec9f1d5f9a3ad8c81b
SHA256a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee
SHA5127457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94