Analysis
-
max time kernel
21s -
max time network
42s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
22/04/2023, 20:07
General
-
Target
ep_setup 12.exe
-
Size
1.7MB
-
MD5
17b928ba118f578e9e3fe800238343d2
-
SHA1
4e4ea78a27f5ae9bbca60afa7116404169518296
-
SHA256
856b184fafa717d9335c64aebcd7b92ffac0a199cb64c4963e1b1aebbb8ab411
-
SHA512
2395dec30a60b29543c08bf6e458d8b02d0e376925e36321cc8fded01e3a040845da423f2e0c7f539f92db4a008c96d93b146e6f5f3c032605bdbe7d5dbce68f
-
SSDEEP
24576:QaCaSY0GxtC5/ZhQwKDl6MyEVM9vnoFSySXM7qaiaYHJFUP:grY0t26V9fohgToYXU
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 4 IoCs
-
Registers COM server for autorun 1 TTPs 6 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 8 IoCs
-
Drops file in Windows directory 2 IoCs
-
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
-
Modifies registry class 33 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of FindShellTrayWindow 39 IoCs
-
Suspicious use of SendNotifyMessage 10 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ep_setup 12.exe"C:\Users\Admin\AppData\Local\Temp\ep_setup 12.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB2⤵
- Launches sc.exe
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"2⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"2⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD5c44baed957b05b9327bd371dbf0dbe99
SHA180b48c656b8555ebc588de3de0ec6c7e75ae4bf1
SHA256ad8bb426a8e438493db4d703242f373d9cb36d8c13e88b6647cd083716e09bef
SHA512ad1b76594dca7cde6bbcde55bc3abe811f9e903e2cf6613d49201e14e789cfc763cb528d499dd2db84db097a210d63c7d88cc909ca1c836d831e3519c2ce7b35
-
Filesize
136KB
MD5c44baed957b05b9327bd371dbf0dbe99
SHA180b48c656b8555ebc588de3de0ec6c7e75ae4bf1
SHA256ad8bb426a8e438493db4d703242f373d9cb36d8c13e88b6647cd083716e09bef
SHA512ad1b76594dca7cde6bbcde55bc3abe811f9e903e2cf6613d49201e14e789cfc763cb528d499dd2db84db097a210d63c7d88cc909ca1c836d831e3519c2ce7b35
-
Filesize
243KB
MD57861db5011cb8fcef56c8190c4c92c3f
SHA160f671a22a531c38999fce98be5cf1b12f4730aa
SHA25616611afa51db3dca3995dfbc4f34098dd664d34ee4d5076c451885fb05a69d1a
SHA512f9062386680bc4d104dfc5581e8320e936525d9fb7e0a53eac5127e09a98dc96ef3f7dd64797b94a67181a010a228d487b449708566a19021c074f2629c8ad02
-
Filesize
243KB
MD57861db5011cb8fcef56c8190c4c92c3f
SHA160f671a22a531c38999fce98be5cf1b12f4730aa
SHA25616611afa51db3dca3995dfbc4f34098dd664d34ee4d5076c451885fb05a69d1a
SHA512f9062386680bc4d104dfc5581e8320e936525d9fb7e0a53eac5127e09a98dc96ef3f7dd64797b94a67181a010a228d487b449708566a19021c074f2629c8ad02
-
Filesize
109KB
MD578afc90569c2e3d913ca7541c1681f31
SHA1f9a4dcac5c9742700d0fe2e384e863311c7ed84a
SHA25661f3e0c52b84d953e1a3a2a1379e51874f4235d6949dfcda3394cda723996236
SHA512b586a00518195cab9c2e6272e5f0000e9e1e19815a71669d6a10f15d8269bb79c22e4742058ed3bacb56bfa58bc32851556647e37885aec046b4daa94ecf5cbb
-
Filesize
109KB
MD578afc90569c2e3d913ca7541c1681f31
SHA1f9a4dcac5c9742700d0fe2e384e863311c7ed84a
SHA25661f3e0c52b84d953e1a3a2a1379e51874f4235d6949dfcda3394cda723996236
SHA512b586a00518195cab9c2e6272e5f0000e9e1e19815a71669d6a10f15d8269bb79c22e4742058ed3bacb56bfa58bc32851556647e37885aec046b4daa94ecf5cbb
-
Filesize
1KB
MD5151084388b5c77d5684198cc06866284
SHA13224d66adfc1e4fda6636437dedd621a63c80cc0
SHA2564308fdb7409acc52b4bb2eab3b502e9ac85577bf234b6944f937266783c6f662
SHA512d6bf39ff2e55bc4ace71952630a4d27362b244f284f11c6bfb578e2217efe67471e21855ef4006835b8bc4bde8d6a658aee6e1f2e5cf9f3965b64bedf9e05aa5
-
Filesize
28KB
MD584a4a43e4d3e8876b53c7d879261878b
SHA1e3403ce51d39745d2cce9fd9c8a25c76c4f62c77
SHA256cde133a8c79728abce622dc788848be9e85ae3cced7fd6ce01601f4d922e17c1
SHA5128e319c8b5c69b01bbae54ce64d0f1bdaba9216de2eb2a3d18851af463fc9e9401136a2bc019f7450afc481bf6dfefd0452c89e54dec28aae72a4a0e84008bdbb
-
Filesize
5B
MD534bd1dfb9f72cf4f86e6df6da0a9e49a
SHA15f96d66f33c81c0b10df2128d3860e3cb7e89563
SHA2568e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
SHA512e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96
-
Filesize
5B
MD5c204e9faaf8565ad333828beff2d786e
SHA17d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1
SHA256d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
SHA512e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8
-
Filesize
1.0MB
MD59a867f775f12b94ec632faadaa8fbdf0
SHA1730e284b43ea0ace198f3a314f89e6420e9a68d4
SHA256c28afe750da50c6dca12049e856977e44214e3e49a6d8dc3d470880831e97bd5
SHA5121ddc136d65b4c704098a533b0764ce01691e4c184e903e3837c4a7aa0489c066a9e900af9156858e25d997d21af1342610bae12f58bfedb06d745a23a8fc8468
-
Filesize
75KB
MD565019a5db517d9fb830d8a57406a03ea
SHA1817faf2ffe8461f653519e7bd96e7ee75021c891
SHA2563ae88b3a99e6b785bdb44760790bc03ac722ef5b673ad5b3ca49b5cc5eecf84f
SHA512bcc985d3fa48efcbb4a334b1a341a6686ef6c69f237d6d9bdcd9885696d148519ab824b9150194d783cb03189c1cc00a483f1b73ebce323f1f6a303a05b8ea62
-
Filesize
17.9MB
MD5bc8958ca4f0f0760befa3523238c7d67
SHA15f75add01201e78860be47a0eb65582733e823c3
SHA256589c2ff9e4ac0465a8b682d6fb988c81b4e91af9f760d174811315681d94b954
SHA5123da6524215e011655c441bd6c085531ce54b81162a6bcb7412977b1f9e488ff600d1a0c6f54252c6c21b76bc8af3b6261632df8f1eccd96e385a0d552a615699
-
Filesize
608KB
MD55cb32354028311ab9b086e0131bc3ae7
SHA1b0752fa7926ff2968cf35954afc1014889a0367f
SHA256c8b206cb5c8d0511af764d16ae46d1fa2b36fe1a7f7c33faa90bf077bcabbea7
SHA51265da00d78e4b56c4ee51a46436922833882fc521387d81f4fa2a82c28e662c441dc84504d7341eef6f778ef37d3226727b4a6fc927743974ed6f319a79a1d4fd
-
Filesize
608KB
MD55cb32354028311ab9b086e0131bc3ae7
SHA1b0752fa7926ff2968cf35954afc1014889a0367f
SHA256c8b206cb5c8d0511af764d16ae46d1fa2b36fe1a7f7c33faa90bf077bcabbea7
SHA51265da00d78e4b56c4ee51a46436922833882fc521387d81f4fa2a82c28e662c441dc84504d7341eef6f778ef37d3226727b4a6fc927743974ed6f319a79a1d4fd
-
Filesize
608KB
MD55cb32354028311ab9b086e0131bc3ae7
SHA1b0752fa7926ff2968cf35954afc1014889a0367f
SHA256c8b206cb5c8d0511af764d16ae46d1fa2b36fe1a7f7c33faa90bf077bcabbea7
SHA51265da00d78e4b56c4ee51a46436922833882fc521387d81f4fa2a82c28e662c441dc84504d7341eef6f778ef37d3226727b4a6fc927743974ed6f319a79a1d4fd
-
Filesize
608KB
MD55cb32354028311ab9b086e0131bc3ae7
SHA1b0752fa7926ff2968cf35954afc1014889a0367f
SHA256c8b206cb5c8d0511af764d16ae46d1fa2b36fe1a7f7c33faa90bf077bcabbea7
SHA51265da00d78e4b56c4ee51a46436922833882fc521387d81f4fa2a82c28e662c441dc84504d7341eef6f778ef37d3226727b4a6fc927743974ed6f319a79a1d4fd
-
Filesize
4.6MB
-
Filesize
328KB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
6.1MB
-
Filesize
328KB
-
Filesize
5.9MB
-
Filesize
328KB
-
Filesize
4.6MB
-
Filesize
280KB
-
Filesize
2.1MB
-
Filesize
328KB
-
Filesize
320KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
320KB
-
Filesize
236KB
-
Filesize
4.6MB
-
Filesize
4KB
-
Filesize
7.2MB
-
Filesize
7.2MB
-
Filesize
116KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
7.5MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB