Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    18-04-2024 21:29

General

  • Target

    499cd2617fef2e72476ace0e5733168dedf22970e3d7cfd489ba3746fec25643.exe

  • Size

    6.8MB

  • MD5

    6b68a3ecf391a162b17cbd470c1fe2a6

  • SHA1

    a9e4690c01f8aca9408b7d260207340f93bd085c

  • SHA256

    499cd2617fef2e72476ace0e5733168dedf22970e3d7cfd489ba3746fec25643

  • SHA512

    0ed7bbbc9a735cf2b48fb714cabf7dbb7fe643afac8841d24e32eb0f630db5758ada9447921ec9d80cbe4b0d2ebd5b490c1fa936c17c58c8d85a54791e6d4bff

  • SSDEEP

    98304:cAc0gJCw2IbHEEpdSWiLKeNkBhjvJCpy/2qW2LjDfKMic8qMKtyp8QNO0:wlJCdokEpdSHLKa0WazKLxvJ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\499cd2617fef2e72476ace0e5733168dedf22970e3d7cfd489ba3746fec25643.exe
    "C:\Users\Admin\AppData\Local\Temp\499cd2617fef2e72476ace0e5733168dedf22970e3d7cfd489ba3746fec25643.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\InstallNavi.exe
      "C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\InstallNavi.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2636

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\BG\wac_np.htm

    Filesize

    1KB

    MD5

    42ba5a671a13fee8be38a9bc31798ff3

    SHA1

    d5abc4c71602c1a29e0fa474dbbb7d7e4652b603

    SHA256

    5f130b89f4d57fb6a422951269fc1fee721ea41ccbd611bb8f36545c06223f5c

    SHA512

    69051c19b4bbcde977f201367250b64768a107c7cf1ef12ea6ac28409c3c2e57230b3de3f33e2b3ad9d2aa6383d85f6f6105e967aaddc6997d176dc5fe2d0573

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_bg00.gif

    Filesize

    70B

    MD5

    98944e8fc7cb2085a00c11b1d940d12e

    SHA1

    d4dc13a801c110c56c8059ee6847f99953cf2045

    SHA256

    0d036bd0b4c1f067cba0796e393adeb6d45526191daa01e568c5688904375702

    SHA512

    7b5af9a226a72c59aa17745ca5d69e7ee008e92c48a12639c3c849dd1eaaceb348a5970102483c5d09500544a9f3861ecf323464766357357aed300c35ea818a

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_bg01.gif

    Filesize

    78B

    MD5

    03b70b6ded5bdf0ad359fefe55fbbb7b

    SHA1

    d666c656772c9533bf8b4d6238675fdecba8046b

    SHA256

    ddf47f612b39ff7cc6855a57d0b82abc41a8796f757b73505ccc2aef39ccf429

    SHA512

    4468ce86067701583051c86dbac8b63bc3e8349405abd684f228a3b3d8b79234bd9f48415990c983a080e4262b903599e39a2dee52b564e337bde19843c9d786

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_bg02.gif

    Filesize

    91B

    MD5

    4906a79d563569467d10f3f976181cfe

    SHA1

    fcfa7be9f3f157a891cfcfe50bc1bc30e409035d

    SHA256

    150c760550d2cd7f34f8a7336ede04b6db8a4c7bbf10bc5a1c3175633323e2cb

    SHA512

    279471ddf327249d9ebae088fc9b8cc2f49200d86318987f90882c409aa5fb8ce108426cb4eb2903975f8b97234cb6fbabc230b0e694e4b05b6db47386908d9b

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_bg03.gif

    Filesize

    111B

    MD5

    ad291476ab8204998e640b6bf5a39c41

    SHA1

    87b280d06b438b41eca2dc98bb36bc909d4bf5d5

    SHA256

    5d1e9abf491b6851a60fa78c6a8a4bcc463ca38696a20076f6783af435e8daa6

    SHA512

    55eb7b5d51d72c01f69f46798dec9bbd6767e6037dc870d33278676e2adb9e99361342f46dcd2de8afd7e3f1f644407ba8de18cc1ddda63bdb56e9cfd9a34a8d

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_bg04.gif

    Filesize

    90B

    MD5

    2164ec9253803b0f65bbf20a0eb2319d

    SHA1

    7c316031888add380c16340630c0336c892fe0a6

    SHA256

    2f558da91e726deca694af1f8ba6092e10e4b8d850ed51e3dd2c4170fef2c618

    SHA512

    66ba763602cbb1cbb17a16ea38422ee57f1bdd2310a4e77cb8e461b4fdcd5d5633a37415b73c422893b66dc358a0ee480a5ab17f8a0b94bcb7028129d468e00b

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_st01.gif

    Filesize

    131B

    MD5

    811ad24c9f5bf947090d058eda0745b7

    SHA1

    af72c699f8ac485c5a58439fc38793eacb36f6cc

    SHA256

    647da8994798e061e34af7fefff8abc1d4363f4b457db2dc72a3ce9a68d5a3e4

    SHA512

    e2f447b46a2bf82db16b5f92b1b73aecd46414b09da9e45c5aaa03b84117e78b5374686af1120f68ae8f8c26a68c676eaf52a8bd55f4a2cb2f0f6590b58561f6

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_st02.gif

    Filesize

    197B

    MD5

    ea7dcf0645895f711bbb93ceb37ffd58

    SHA1

    6391a8b3ca3feae99017ae114b7f10793414ecfd

    SHA256

    a369d2853f10396eb68986420125ae9a31edc4ae4a85d2dad5579e5e86ae8b4d

    SHA512

    154dbbb100509c06a53c219c6c66d62188cc4500ad297cb70223e27ce7d2dffdd71bc9bfe833cd93662862d1e9505eeb3e974ad5c1f435baf92d83184659d71b

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_st03.gif

    Filesize

    204B

    MD5

    4e330c05599507376a2e568c22f41793

    SHA1

    c4127bfb2b10cf150d02915d4f46cd22e71f1a88

    SHA256

    67fd5ed4817898181c278a112cb153c91b3ad2f8617e0e69f9f8562a7d8852b7

    SHA512

    326cec49efd410f043015adee4a3ac1eca18834cd2a221c336cbee48d0fc710d67537c604760011d3f9b11c9480a09168a12b2db430f342b1a707518ea553211

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_st04.gif

    Filesize

    138B

    MD5

    27469b720447a5d7581865e6880b9194

    SHA1

    fe1e9e66360f07ab97c8db620583393aee8d2387

    SHA256

    568ecd45659dc64b4142402233a22497ff62bc2680e5ec23e236402ce998c91b

    SHA512

    7a2ae5f0ab34ffd436260cfc03a189dd30c8dfddc2841fcee9226746fb32be7b2c996c93bbd0f8f18bb5826b1f70c74cd7c5b9a7e2d712f45ff227841321d903

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_st05.gif

    Filesize

    197B

    MD5

    6831e611d8c7cdde68da55dcc8f052a0

    SHA1

    90e10936647cc3af1b91e9090aca2b856b381ea0

    SHA256

    48043a700a61d16799c7377754fa6e1a8e8eca0c890889458cbb48c23a772e56

    SHA512

    d63a2ecf1474a92412b6ae22de76aee64cecd1dc818734a26d2cfe8bbd5b83906b1ea6a0f23ed5407a6a17999153ebe7a4410fbf556b36fdf582a47d5a3be634

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_st06.gif

    Filesize

    204B

    MD5

    81acb0875f44e84aff09e3b30c586d73

    SHA1

    22f7bdd10944bec121e732518e65e607553df87d

    SHA256

    7cf6b75efd7bce6dcc44c69570275946b8aa2a1a4cebb8370a0a7b5e183c14ac

    SHA512

    aa30de2a2b0bf815eca773ab319c4ef03cfbcc4ac1ece9b831f0855c1ba60965b4b715e55aa3a95900c544a83f339b29c886302f026e45709b3abd5c98b073db

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_st07.gif

    Filesize

    133B

    MD5

    cba4d1c5ebc9623c9df19889c3105ffb

    SHA1

    d993923f4d04e9ca682c893d68037ea21b701582

    SHA256

    1075bc76a8707126addbea2212e58c6ff4ff3e7a50a13ffe9459775241a1cd9a

    SHA512

    41e890aabbee941ce57d146a3fa1667b4d910dc279f28f1c8f4cb505d343a20645123af35538bebe3eb73a113d2cd97445e09a7743a362dd349d0a774a1d9fc8

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_st08.gif

    Filesize

    212B

    MD5

    0bedc54a6a6f281105dbcc13fc8323e6

    SHA1

    7d48c0d882b147b31d050c30cde93d25795a3d1f

    SHA256

    b9ac4661259cf22a64ef4a414d6561de390516d3b94b5ce0b7982a61ad927ed1

    SHA512

    3c5d1b8f29da94d6a4ff263c9264d89e7cc90bd9854bce4a6f7e7edc49493365cadb48e074bd0d33407c51526ebd39586fe55924bd2e8e71761b712c958fa279

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_st09.gif

    Filesize

    208B

    MD5

    3155ff06df638f09893e2577a9653d1d

    SHA1

    24c0a54c87520049a540c389addf595e7dadbe52

    SHA256

    cf11a84a09e8d4585d792f46abf705803f26cd54045d0c02942bd5efb6e45b29

    SHA512

    24b0e14e69d4a02fed931a4f6520c33ab114f026124801d5a185487b315004619c2c1b5821c90c5018bb664ee5c7abb9bf26ad82c7f0e878ed2b4a064792cd03

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_st10.gif

    Filesize

    228B

    MD5

    40d728d3826aaad3a9a52b1d6ff1249e

    SHA1

    12f914b7ef294c63c28f5bd5e08e85665c516533

    SHA256

    e84a1af7fe62a46d40147c32f77bd5be74e7e20c3fca1a396c32d92cc4dc4809

    SHA512

    f2500dac3da1684983093a1b61e92c1f0b714529c631b909131cc8e1692748bfd3733c0799e4eb4b5fc3110aad4aca33daac19829f44b0674d1e45eea47ebc1f

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\SetupGuide\DA\files\mark_wa.gif

    Filesize

    628B

    MD5

    2e30664efaecd7484069bb42b11842bd

    SHA1

    1346c2ee4e6ce38f80fee743327e9708abb918f9

    SHA256

    8f3a5c606f68b13225e063743f4477ef20f79931e4c5b75ecb6517b9eb8b5957

    SHA512

    571c13dc4d2a2dcfba33075d82c4d2c5d26d3751ab2ff5b1913e625cec1c3d20d5495558c515385e2e8e4163df34be9375219d98aaf66f5a4b901e4ee8497627

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\SetupGuide\DE\_style.css

    Filesize

    5KB

    MD5

    e9fa1230d5a67702b7fc35eeca0021d4

    SHA1

    21947fb4a8adc3a5537d276afd1d53a471e348f4

    SHA256

    fed597ef7bf33aaefc49eeca921ac259de37278277bcdaef30204ba35e913bc1

    SHA512

    289166d3c2449447fefbedc852ece524dd611de2ed98fd1bfa4b583a389f125485370f4c06db6e3bd5e0d1d21bd49533633f919f832bb9f446e2d3c6c5ad8042

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\SetupGuide\DE\files\_sdisc07.css

    Filesize

    3KB

    MD5

    8bed575c0b8949949f407d07ec754f46

    SHA1

    458a43299e3bf06a7fe318f0fe4610da07e996f4

    SHA256

    6823abfd7be79e2dca30e2acda2c2f0c8e7e198567708f4b4a8aac55bbcd489e

    SHA512

    31855f572862da0e5f58731422d6b1210bdeca58226278f577981fe483ff257884ead563c92e24c1888a501bc9d2977c46270901b8f41d624b9310218e1a4379

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\SetupGuide\DE\files\mark_im.gif

    Filesize

    624B

    MD5

    4ea7649975ad26018babc9963569c30e

    SHA1

    f2a84438ffd66d0a8203f1dbf7eb3f8437e42d83

    SHA256

    c8b6c0bb5d2f7d44a86e8e7a439ff70ff534df55100ce25e93f2f13c7f43fed2

    SHA512

    92fcfee62f378f1de4e60b68c41dd8d75f8bebd602181cc2b7f4516e3cf9f744f2474d8e703904c2c456b373e89cc1d0b0af9ff93d135b098c38cd74493a25ba

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\SetupGuide\DE\files\mark_no.gif

    Filesize

    169B

    MD5

    fe73248369fd57577eb2e449f694dc0e

    SHA1

    e3dad813f69d2bf385e3e2b30bac250d8d9d1c49

    SHA256

    fc83fb2df02272085387e37fa550dafe572678561b9ea579815f804a21d79693

    SHA512

    c8486524f69094475c6b03fa3e0ab1d340d0ef6da549ce50b17a44d9c2e599db323e274da302b83465a2b8cc3085b7fa255981a59a60d88e60757d77f41c9a44

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\_cdres\_html\EN\la.htm

    Filesize

    10KB

    MD5

    133c3a04b7f6e3804af8dc6b06a612aa

    SHA1

    5aea88a81b9397f787632ae974a001859983c0f0

    SHA256

    0f93744e79d2cfcf3bbea030436b36bcdc406d1f41050496778d06f3bbf8485f

    SHA512

    d83355fc79a98ca3d62caccd9a44d8e7c5b30c8d694a8466347bd6e4ec2609c64e11d48f69c6a5ec8290b0de7e3a71eb78d027b56c4491bb6fc2fd77c416f528

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\_cdres\_html\_style.css

    Filesize

    5KB

    MD5

    f618a203519456af3145163fc0f0de97

    SHA1

    15f3e6b2d547b7292c21b1b7b2b4e464adfbc905

    SHA256

    14d4c8f62d2e0fff90ffc18300266edc90c3654505ca9f273f77b316b21cab6c

    SHA512

    e1158a0f14967f6a6ea295656ec7a91db2b4e0f5fb9a2dacd3e5030e05576025bd6e91d0a2a53e4f8ba2039f451aa6eef93e29a8592a5bf87ad988fbb71a0b6e

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\_cdres\_icon\_logo.png

    Filesize

    3KB

    MD5

    500bbad62224f572ac33be0bcad7bb70

    SHA1

    eee8bb21232e29e2f4fb00397fd0501a286ef2d7

    SHA256

    61cfd674e957d507b9bbe61f702a6f239b057e948a8e53ad0d2e689ec252b29b

    SHA512

    abd1d687484bb7c065cab4a8677174b49a08e38348c5d532c2274dbdd84261cbc89dd58b764fe5dd45eae9f8fbc951799c8ac8b97f8646adeb0ca250b786f5bd

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\_cdres\_icon\_main.png

    Filesize

    34KB

    MD5

    cf40831915026aed6f5c3194ed8f710e

    SHA1

    271811e25557930ae8164abcaf068262a1aba030

    SHA256

    5cf6fc67c8063ae869fafee382d3998d5c875080a3117104c8bbed67d5573b31

    SHA512

    4996065c68f5f8bb31c584e48907501e4ac852274d53d95ae0b8dc24fc785e1406f7bfe996c734a3c8147f86a88bd676424569a42057fd01bd506be13b6f04d2

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\_cdres\_style\LanguageInfo.ini

    Filesize

    2KB

    MD5

    a17785420ee82167e8bd068a03ae70d2

    SHA1

    b2438de816a40d56f71312b1e35cd35236665152

    SHA256

    437a0af40da285ffe26168361553e4dc81d744028c0afb22fe0ff16c30d5c132

    SHA512

    8906ef61c1d940e8c5800270c65a4a35e28c7b644b9ef42bd9b829aa823f602a5e1e73711bf2677a14edcc5992416258ef4db07258d2ae4cdc7164f370a8196a

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\_cdres\_style\Language\string.h

    Filesize

    30KB

    MD5

    9e048b8f89cf73c36fbafda05086054d

    SHA1

    e38e152f522c5282ada6501e28cfc8877f7862b1

    SHA256

    0052bbe81a6eb6bc5bcab761672f42b96e61e347af89dc8543b62519663890af

    SHA512

    7fba4ec94522a7f3ce298e63737255e62bd5a8ee072238297b68db19c24b338e653d839855c6d6bf1d4410b46614626bde86d7bd8f492c810b15e6dff1fd0640

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\_cdres\_style\style.ini

    Filesize

    563B

    MD5

    5be738578dea98ed09a28dd51b83edac

    SHA1

    49a5eff21de273c33c51cfc73260befd9cb51382

    SHA256

    8dd86434de24c73836ae2fc5c680359e184b735f6a7c95ed4f2602b6e9e452f5

    SHA512

    e948385dbb45623ef047a91ac074b17d44849a0ae07d20a06edd7cd3cb152f659316ba4825c3029871ef24c57ed9fcfd407a4771a43a6982a304675c5a8871be

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\_cdres\default.ini

    Filesize

    272B

    MD5

    5242fb1719b1879ca318a2c035848d96

    SHA1

    485ee39c8aa542651a293e37cca6ffffb0f3330e

    SHA256

    cb7e4f630b577907c12a4bdde167df5bb26c127819fb25323e3da3817afc21ca

    SHA512

    d1bbdf6a1343be79ced1f9222d526334a1f81519cfa3da982185f344a4b7198d852b4a09834d248c55d7edbcba9cf20e407af7de99d444206068c0a4840daa33

  • C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\_model\model.ini

    Filesize

    764B

    MD5

    6ad7420a0d669073ba84615e89d37687

    SHA1

    3435e084f4ddc248ee97c3404c90affb3f768d00

    SHA256

    385988efb40d010ac47468502539ac8b47fe22f46cbdd8a6bf4ac3499d097db6

    SHA512

    387e8021bbe51bd81cf47e3e92208df12c6ac1259546584e41acad6a330dea9bfa8c1f8474df9127481e70d1c90665ed315996f2fe56a98339ea90f127b59936

  • \Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\InstallNavi.exe

    Filesize

    2.2MB

    MD5

    48f17bcb2d38ce8b4c025c487ebb46d1

    SHA1

    b535ca49589e736cb0885b598986fd9fa22d8bf6

    SHA256

    4eeecd4af623b888a035d1e7bafc6bda9298d1c9b531f847b4c80ccbb535a7be

    SHA512

    0f7b7b3115c02453ca7fd6eff5879c66613e8fa3e605f71ae100ae4f3fd69f2a669a0744f1e1b2a6a5b068384b51158352ed843b93892c9ca9863d56d2e35013

  • \Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\_cdres\_dll\E_PRLGR7.dll

    Filesize

    100KB

    MD5

    2ee89b932e4c0a7f503dd349d587630b

    SHA1

    159ecabf22e39588350ec8785dddf0936385ae8e

    SHA256

    ea650215af1d90d83c4bbfebe814926d8ddb4ffb9797be83b93bef35b2bbabd4

    SHA512

    c6113f1a991e53b6b765dd6d93a55dc51ec2d5b4f317e0bb92002240e217cac1c10afd02b9b5b561e68b822de93fe227db6b2d104967e99ba6b7e24dfd8acb70