d13c956afd1babccadeb2ecbb93506dd4f88bcc689dbffc9320f1d8e8f5a0dfa

General

Target
ep_setup.exe
Size 2.4MB
Sample240227-v7b6csfc25
SHA256 d13c956afd1babccadeb2ecbb93506dd4f88bcc689dbffc9320f1d8e8f5a0dfa
MD5 c47d4cf1e370213e034373c1ee3be58b
SHA1 a5c699f6b32464d6e01683a578bd33d817aec895
SHA512 8889eb9d97417d6129a73bb12d7351e147f8ba82b35c4c1c151ae70bf9aab2b0093da253eff277dc1e5c2d3edc4cd145e795e9fda926c135aba4d1dc5c79c27e
SSDEEP 24576:PEKqrnSBiuNmIGjpI79wP6AqZU+RRfoOtRmm8iuRboToiz3yYqIp7glQ3Xf/Zlk4:rqrnbVjdP6xuRE9uEpclQZlk4
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Modifies Installed Components in the registry 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1681664450-2645008397-319333953-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\ExplorerPatcher\WebView2Loader.dll	ep_setup.exe
File created	C:\Program Files\ExplorerPatcher\ep_gui.dll	ep_setup.exe
File created	C:\Program Files\ExplorerPatcher\ep_weather_host.dll	ep_setup.exe
File created	C:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll	ep_setup.exe
File created	C:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dll	ep_setup.exe
File created	C:\Program Files\ExplorerPatcher\ep_dwm.exe	ep_setup.exe
File created	C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll	ep_setup.exe
File created	C:\Program Files\ExplorerPatcher\ep_setup.exe	ep_setup.exe
File opened for modification	C:\Program Files\ExplorerPatcher\ep_setup.exe	ep_setup.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\dxgi.dll	ep_setup.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll	ep_setup.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4220	sc.exe
4780	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
4816	taskkill.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4816	taskkill.exe
Token: SeShutdownPrivilege	4292	explorer.exe
Token: SeCreatePagefilePrivilege	4292	explorer.exe
Token: SeShutdownPrivilege	4292	explorer.exe
Token: SeCreatePagefilePrivilege	4292	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4224	ep_setup.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4224	ep_setup.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 4816	4224	ep_setup.exe	72
PID 4224 wrote to memory of 4816	4224	ep_setup.exe	72
PID 4224 wrote to memory of 4220	4224	ep_setup.exe	75
PID 4224 wrote to memory of 4220	4224	ep_setup.exe	75
PID 4224 wrote to memory of 4780	4224	ep_setup.exe	77
PID 4224 wrote to memory of 4780	4224	ep_setup.exe	77
PID 4224 wrote to memory of 4292	4224	ep_setup.exe	79
PID 4224 wrote to memory of 4292	4224	ep_setup.exe	79

C:\Users\Admin\AppData\Local\Temp\ep_setup.exe
"C:\Users\Admin\AppData\Local\Temp\ep_setup.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\system32\taskkill.exe
  "C:\Windows\system32\taskkill.exe" /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4816
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
  2⤵
  - Launches sc.exe
  PID:4220
- C:\Windows\system32\sc.exe
  "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
  2⤵
  - Launches sc.exe
  PID:4780
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies Installed Components in the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:4292