Analysis
-
max time kernel
143s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 08:59
Static task
static1
Behavioral task
behavioral1
Sample
eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7.exe
Resource
win10v2004-20220812-en
General
-
Target
eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7.exe
-
Size
45KB
-
MD5
ec94ccab1e5cd763f38fc2b02d647360
-
SHA1
13ce5c0eb17f1dffbc5d95a5f83dbce836cd1bca
-
SHA256
eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7
-
SHA512
af9af72f1e2c071434560d41419753abd08fefb9224bc62a5226679aede6915f72a410a7e936d25008aac49062c788890fa560ba74a2bf6dd7312f2d6820dd93
-
SSDEEP
768:ZIZyyHfD0GGY+K6Zaim3IL1WGIpup0yDVTlZ3hhhKOCpP4chAE2d/qkk/1H5qp:ZO83Yb6YPm4GbBDTZ3hhhKxPNhAEU/4
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
Processes:
eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7.exe -
Executes dropped EXE 1 IoCs
Processes:
Ejpopi32.exepid process 1840 Ejpopi32.exe -
Drops file in System32 directory 3 IoCs
Processes:
eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7.exedescription ioc process File created C:\Windows\SysWOW64\Ejpopi32.exe eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7.exe File opened for modification C:\Windows\SysWOW64\Ejpopi32.exe eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7.exe File created C:\Windows\SysWOW64\Jepppc32.dll eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
Ejpopi32.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess Ejpopi32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess\BrowseNewProcess = "yes" Ejpopi32.exe -
Modifies registry class 6 IoCs
Processes:
eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jepppc32.dll" eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Ejpopi32.exepid process 1840 Ejpopi32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7.exedescription pid process target process PID 952 wrote to memory of 1840 952 eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7.exe Ejpopi32.exe PID 952 wrote to memory of 1840 952 eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7.exe Ejpopi32.exe PID 952 wrote to memory of 1840 952 eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7.exe Ejpopi32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7.exe"C:\Users\Admin\AppData\Local\Temp\eb8624f57570441527221c33fbabfc9a9eb5c825541fea0eaf924b28fe0cf8e7.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ejpopi32.exeC:\Windows\system32\Ejpopi32.exe2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\Ejpopi32.exeFilesize
45KB
MD55c086043e4f90774889ace4ec2357bc6
SHA18b69461a3fcc61c2fa9ae82f502a4bd01345a7d6
SHA25698780e4502391478c13e1f46245644b66cfec38d4ba0444ab54fe321288e2c10
SHA512e315f46a076b069202ec11a1fbbe8af045f1a77a050a9cab2e82427723b2826cce1aa3aa6eaa66778279304fb47cd04f64604fd471f785fc463af3b6945df95a
-
C:\Windows\SysWOW64\Ejpopi32.exeFilesize
45KB
MD55c086043e4f90774889ace4ec2357bc6
SHA18b69461a3fcc61c2fa9ae82f502a4bd01345a7d6
SHA25698780e4502391478c13e1f46245644b66cfec38d4ba0444ab54fe321288e2c10
SHA512e315f46a076b069202ec11a1fbbe8af045f1a77a050a9cab2e82427723b2826cce1aa3aa6eaa66778279304fb47cd04f64604fd471f785fc463af3b6945df95a
-
memory/952-132-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/952-136-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1840-133-0x0000000000000000-mapping.dmp
-
memory/1840-137-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1840-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB