Overview
overview
7Static
static
3epsilon.exe
windows7-x64
7epsilon.exe
windows10-1703-x64
7epsilon.exe
windows10-2004-x64
7epsilon.exe
windows11-21h2-x64
7LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-1703-x64
4LICENSES.c...m.html
windows10-2004-x64
1LICENSES.c...m.html
windows11-21h2-x64
1resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-1703-x64
4resources/elevate.exe
windows10-2004-x64
1resources/elevate.exe
windows11-21h2-x64
1update.exe
windows7-x64
1update.exe
windows10-1703-x64
7update.exe
windows10-2004-x64
7update.exe
windows11-21h2-x64
7Analysis
-
max time kernel
599s -
max time network
366s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 09:54
Static task
static1
Behavioral task
behavioral1
Sample
epsilon.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
epsilon.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
epsilon.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral4
Sample
epsilon.exe
Resource
win11-20240419-en
Behavioral task
behavioral5
Sample
LICENSES.chromium.html
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
LICENSES.chromium.html
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11-20240419-en
Behavioral task
behavioral9
Sample
resources/elevate.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
resources/elevate.exe
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
resources/elevate.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral12
Sample
resources/elevate.exe
Resource
win11-20240419-en
Behavioral task
behavioral13
Sample
update.exe
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
update.exe
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
update.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral16
Sample
update.exe
Resource
win11-20240419-en
General
-
Target
update.exe
-
Size
164.7MB
-
MD5
e797f43c14812e2d2a8635cb208b1b4a
-
SHA1
e47dfbd6b0c44e8bdc51eb201f6227c5ee9fb22f
-
SHA256
934d4dbacab813549ae7d96c1278d84c0fdeecf09cd920ff9c24f5074605fc10
-
SHA512
29398f346a81cca87e3ccf25b8b7bb49a0700d181b4d5643ed3bc017187a3ec86e8942cc8b2090fb6fe86d751c03bc163dae32b904168334ba29c3231bb99c52
-
SSDEEP
1572864:Dtc2cEGwGrRSREICCr3ka8YrcSAfII01aLadS5sDNd+Ipx9cF3LfxNEK2Ho8jlgY:V+CHrJIgIsV
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid process 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 2072 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 2072 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe 2072 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\update.exe"C:\Users\Admin\AppData\Local\Temp\update.exe"1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage