Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 21:29
Static task
static1
Behavioral task
behavioral1
Sample
499cd2617fef2e72476ace0e5733168dedf22970e3d7cfd489ba3746fec25643.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
499cd2617fef2e72476ace0e5733168dedf22970e3d7cfd489ba3746fec25643.exe
Resource
win10v2004-20240412-en
General
-
Target
499cd2617fef2e72476ace0e5733168dedf22970e3d7cfd489ba3746fec25643.exe
-
Size
6.8MB
-
MD5
6b68a3ecf391a162b17cbd470c1fe2a6
-
SHA1
a9e4690c01f8aca9408b7d260207340f93bd085c
-
SHA256
499cd2617fef2e72476ace0e5733168dedf22970e3d7cfd489ba3746fec25643
-
SHA512
0ed7bbbc9a735cf2b48fb714cabf7dbb7fe643afac8841d24e32eb0f630db5758ada9447921ec9d80cbe4b0d2ebd5b490c1fa936c17c58c8d85a54791e6d4bff
-
SSDEEP
98304:cAc0gJCw2IbHEEpdSWiLKeNkBhjvJCpy/2qW2LjDfKMic8qMKtyp8QNO0:wlJCdokEpdSHLKa0WazKLxvJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2636 InstallNavi.exe -
Loads dropped DLL 2 IoCs
pid Process 2160 499cd2617fef2e72476ace0e5733168dedf22970e3d7cfd489ba3746fec25643.exe 2636 InstallNavi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" InstallNavi.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main InstallNavi.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch InstallNavi.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2636 InstallNavi.exe 2636 InstallNavi.exe 2636 InstallNavi.exe 2636 InstallNavi.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2160 wrote to memory of 2636 2160 499cd2617fef2e72476ace0e5733168dedf22970e3d7cfd489ba3746fec25643.exe 28 PID 2160 wrote to memory of 2636 2160 499cd2617fef2e72476ace0e5733168dedf22970e3d7cfd489ba3746fec25643.exe 28 PID 2160 wrote to memory of 2636 2160 499cd2617fef2e72476ace0e5733168dedf22970e3d7cfd489ba3746fec25643.exe 28 PID 2160 wrote to memory of 2636 2160 499cd2617fef2e72476ace0e5733168dedf22970e3d7cfd489ba3746fec25643.exe 28 PID 2160 wrote to memory of 2636 2160 499cd2617fef2e72476ace0e5733168dedf22970e3d7cfd489ba3746fec25643.exe 28 PID 2160 wrote to memory of 2636 2160 499cd2617fef2e72476ace0e5733168dedf22970e3d7cfd489ba3746fec25643.exe 28 PID 2160 wrote to memory of 2636 2160 499cd2617fef2e72476ace0e5733168dedf22970e3d7cfd489ba3746fec25643.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\499cd2617fef2e72476ace0e5733168dedf22970e3d7cfd489ba3746fec25643.exe"C:\Users\Admin\AppData\Local\Temp\499cd2617fef2e72476ace0e5733168dedf22970e3d7cfd489ba3746fec25643.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\InstallNavi.exe"C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\InstallNavi.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2636
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\BG\wac_np.htm
Filesize1KB
MD542ba5a671a13fee8be38a9bc31798ff3
SHA1d5abc4c71602c1a29e0fa474dbbb7d7e4652b603
SHA2565f130b89f4d57fb6a422951269fc1fee721ea41ccbd611bb8f36545c06223f5c
SHA51269051c19b4bbcde977f201367250b64768a107c7cf1ef12ea6ac28409c3c2e57230b3de3f33e2b3ad9d2aa6383d85f6f6105e967aaddc6997d176dc5fe2d0573
-
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_bg00.gif
Filesize70B
MD598944e8fc7cb2085a00c11b1d940d12e
SHA1d4dc13a801c110c56c8059ee6847f99953cf2045
SHA2560d036bd0b4c1f067cba0796e393adeb6d45526191daa01e568c5688904375702
SHA5127b5af9a226a72c59aa17745ca5d69e7ee008e92c48a12639c3c849dd1eaaceb348a5970102483c5d09500544a9f3861ecf323464766357357aed300c35ea818a
-
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_bg01.gif
Filesize78B
MD503b70b6ded5bdf0ad359fefe55fbbb7b
SHA1d666c656772c9533bf8b4d6238675fdecba8046b
SHA256ddf47f612b39ff7cc6855a57d0b82abc41a8796f757b73505ccc2aef39ccf429
SHA5124468ce86067701583051c86dbac8b63bc3e8349405abd684f228a3b3d8b79234bd9f48415990c983a080e4262b903599e39a2dee52b564e337bde19843c9d786
-
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_bg02.gif
Filesize91B
MD54906a79d563569467d10f3f976181cfe
SHA1fcfa7be9f3f157a891cfcfe50bc1bc30e409035d
SHA256150c760550d2cd7f34f8a7336ede04b6db8a4c7bbf10bc5a1c3175633323e2cb
SHA512279471ddf327249d9ebae088fc9b8cc2f49200d86318987f90882c409aa5fb8ce108426cb4eb2903975f8b97234cb6fbabc230b0e694e4b05b6db47386908d9b
-
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_bg03.gif
Filesize111B
MD5ad291476ab8204998e640b6bf5a39c41
SHA187b280d06b438b41eca2dc98bb36bc909d4bf5d5
SHA2565d1e9abf491b6851a60fa78c6a8a4bcc463ca38696a20076f6783af435e8daa6
SHA51255eb7b5d51d72c01f69f46798dec9bbd6767e6037dc870d33278676e2adb9e99361342f46dcd2de8afd7e3f1f644407ba8de18cc1ddda63bdb56e9cfd9a34a8d
-
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_bg04.gif
Filesize90B
MD52164ec9253803b0f65bbf20a0eb2319d
SHA17c316031888add380c16340630c0336c892fe0a6
SHA2562f558da91e726deca694af1f8ba6092e10e4b8d850ed51e3dd2c4170fef2c618
SHA51266ba763602cbb1cbb17a16ea38422ee57f1bdd2310a4e77cb8e461b4fdcd5d5633a37415b73c422893b66dc358a0ee480a5ab17f8a0b94bcb7028129d468e00b
-
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_st01.gif
Filesize131B
MD5811ad24c9f5bf947090d058eda0745b7
SHA1af72c699f8ac485c5a58439fc38793eacb36f6cc
SHA256647da8994798e061e34af7fefff8abc1d4363f4b457db2dc72a3ce9a68d5a3e4
SHA512e2f447b46a2bf82db16b5f92b1b73aecd46414b09da9e45c5aaa03b84117e78b5374686af1120f68ae8f8c26a68c676eaf52a8bd55f4a2cb2f0f6590b58561f6
-
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_st02.gif
Filesize197B
MD5ea7dcf0645895f711bbb93ceb37ffd58
SHA16391a8b3ca3feae99017ae114b7f10793414ecfd
SHA256a369d2853f10396eb68986420125ae9a31edc4ae4a85d2dad5579e5e86ae8b4d
SHA512154dbbb100509c06a53c219c6c66d62188cc4500ad297cb70223e27ce7d2dffdd71bc9bfe833cd93662862d1e9505eeb3e974ad5c1f435baf92d83184659d71b
-
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_st03.gif
Filesize204B
MD54e330c05599507376a2e568c22f41793
SHA1c4127bfb2b10cf150d02915d4f46cd22e71f1a88
SHA25667fd5ed4817898181c278a112cb153c91b3ad2f8617e0e69f9f8562a7d8852b7
SHA512326cec49efd410f043015adee4a3ac1eca18834cd2a221c336cbee48d0fc710d67537c604760011d3f9b11c9480a09168a12b2db430f342b1a707518ea553211
-
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_st04.gif
Filesize138B
MD527469b720447a5d7581865e6880b9194
SHA1fe1e9e66360f07ab97c8db620583393aee8d2387
SHA256568ecd45659dc64b4142402233a22497ff62bc2680e5ec23e236402ce998c91b
SHA5127a2ae5f0ab34ffd436260cfc03a189dd30c8dfddc2841fcee9226746fb32be7b2c996c93bbd0f8f18bb5826b1f70c74cd7c5b9a7e2d712f45ff227841321d903
-
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_st05.gif
Filesize197B
MD56831e611d8c7cdde68da55dcc8f052a0
SHA190e10936647cc3af1b91e9090aca2b856b381ea0
SHA25648043a700a61d16799c7377754fa6e1a8e8eca0c890889458cbb48c23a772e56
SHA512d63a2ecf1474a92412b6ae22de76aee64cecd1dc818734a26d2cfe8bbd5b83906b1ea6a0f23ed5407a6a17999153ebe7a4410fbf556b36fdf582a47d5a3be634
-
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_st06.gif
Filesize204B
MD581acb0875f44e84aff09e3b30c586d73
SHA122f7bdd10944bec121e732518e65e607553df87d
SHA2567cf6b75efd7bce6dcc44c69570275946b8aa2a1a4cebb8370a0a7b5e183c14ac
SHA512aa30de2a2b0bf815eca773ab319c4ef03cfbcc4ac1ece9b831f0855c1ba60965b4b715e55aa3a95900c544a83f339b29c886302f026e45709b3abd5c98b073db
-
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_st07.gif
Filesize133B
MD5cba4d1c5ebc9623c9df19889c3105ffb
SHA1d993923f4d04e9ca682c893d68037ea21b701582
SHA2561075bc76a8707126addbea2212e58c6ff4ff3e7a50a13ffe9459775241a1cd9a
SHA51241e890aabbee941ce57d146a3fa1667b4d910dc279f28f1c8f4cb505d343a20645123af35538bebe3eb73a113d2cd97445e09a7743a362dd349d0a774a1d9fc8
-
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_st08.gif
Filesize212B
MD50bedc54a6a6f281105dbcc13fc8323e6
SHA17d48c0d882b147b31d050c30cde93d25795a3d1f
SHA256b9ac4661259cf22a64ef4a414d6561de390516d3b94b5ce0b7982a61ad927ed1
SHA5123c5d1b8f29da94d6a4ff263c9264d89e7cc90bd9854bce4a6f7e7edc49493365cadb48e074bd0d33407c51526ebd39586fe55924bd2e8e71761b712c958fa279
-
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_st09.gif
Filesize208B
MD53155ff06df638f09893e2577a9653d1d
SHA124c0a54c87520049a540c389addf595e7dadbe52
SHA256cf11a84a09e8d4585d792f46abf705803f26cd54045d0c02942bd5efb6e45b29
SHA51224b0e14e69d4a02fed931a4f6520c33ab114f026124801d5a185487b315004619c2c1b5821c90c5018bb664ee5c7abb9bf26ad82c7f0e878ed2b4a064792cd03
-
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\PanelGuide\_img\_st10.gif
Filesize228B
MD540d728d3826aaad3a9a52b1d6ff1249e
SHA112f914b7ef294c63c28f5bd5e08e85665c516533
SHA256e84a1af7fe62a46d40147c32f77bd5be74e7e20c3fca1a396c32d92cc4dc4809
SHA512f2500dac3da1684983093a1b61e92c1f0b714529c631b909131cc8e1692748bfd3733c0799e4eb4b5fc3110aad4aca33daac19829f44b0674d1e45eea47ebc1f
-
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\SetupGuide\DA\files\mark_wa.gif
Filesize628B
MD52e30664efaecd7484069bb42b11842bd
SHA11346c2ee4e6ce38f80fee743327e9708abb918f9
SHA2568f3a5c606f68b13225e063743f4477ef20f79931e4c5b75ecb6517b9eb8b5957
SHA512571c13dc4d2a2dcfba33075d82c4d2c5d26d3751ab2ff5b1913e625cec1c3d20d5495558c515385e2e8e4163df34be9375219d98aaf66f5a4b901e4ee8497627
-
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\SetupGuide\DE\_style.css
Filesize5KB
MD5e9fa1230d5a67702b7fc35eeca0021d4
SHA121947fb4a8adc3a5537d276afd1d53a471e348f4
SHA256fed597ef7bf33aaefc49eeca921ac259de37278277bcdaef30204ba35e913bc1
SHA512289166d3c2449447fefbedc852ece524dd611de2ed98fd1bfa4b583a389f125485370f4c06db6e3bd5e0d1d21bd49533633f919f832bb9f446e2d3c6c5ad8042
-
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\SetupGuide\DE\files\_sdisc07.css
Filesize3KB
MD58bed575c0b8949949f407d07ec754f46
SHA1458a43299e3bf06a7fe318f0fe4610da07e996f4
SHA2566823abfd7be79e2dca30e2acda2c2f0c8e7e198567708f4b4a8aac55bbcd489e
SHA51231855f572862da0e5f58731422d6b1210bdeca58226278f577981fe483ff257884ead563c92e24c1888a501bc9d2977c46270901b8f41d624b9310218e1a4379
-
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\SetupGuide\DE\files\mark_im.gif
Filesize624B
MD54ea7649975ad26018babc9963569c30e
SHA1f2a84438ffd66d0a8203f1dbf7eb3f8437e42d83
SHA256c8b6c0bb5d2f7d44a86e8e7a439ff70ff534df55100ce25e93f2f13c7f43fed2
SHA51292fcfee62f378f1de4e60b68c41dd8d75f8bebd602181cc2b7f4516e3cf9f744f2474d8e703904c2c456b373e89cc1d0b0af9ff93d135b098c38cd74493a25ba
-
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\Manual\SetupGuide\DE\files\mark_no.gif
Filesize169B
MD5fe73248369fd57577eb2e449f694dc0e
SHA1e3dad813f69d2bf385e3e2b30bac250d8d9d1c49
SHA256fc83fb2df02272085387e37fa550dafe572678561b9ea579815f804a21d79693
SHA512c8486524f69094475c6b03fa3e0ab1d340d0ef6da549ce50b17a44d9c2e599db323e274da302b83465a2b8cc3085b7fa255981a59a60d88e60757d77f41c9a44
-
Filesize
10KB
MD5133c3a04b7f6e3804af8dc6b06a612aa
SHA15aea88a81b9397f787632ae974a001859983c0f0
SHA2560f93744e79d2cfcf3bbea030436b36bcdc406d1f41050496778d06f3bbf8485f
SHA512d83355fc79a98ca3d62caccd9a44d8e7c5b30c8d694a8466347bd6e4ec2609c64e11d48f69c6a5ec8290b0de7e3a71eb78d027b56c4491bb6fc2fd77c416f528
-
Filesize
5KB
MD5f618a203519456af3145163fc0f0de97
SHA115f3e6b2d547b7292c21b1b7b2b4e464adfbc905
SHA25614d4c8f62d2e0fff90ffc18300266edc90c3654505ca9f273f77b316b21cab6c
SHA512e1158a0f14967f6a6ea295656ec7a91db2b4e0f5fb9a2dacd3e5030e05576025bd6e91d0a2a53e4f8ba2039f451aa6eef93e29a8592a5bf87ad988fbb71a0b6e
-
Filesize
3KB
MD5500bbad62224f572ac33be0bcad7bb70
SHA1eee8bb21232e29e2f4fb00397fd0501a286ef2d7
SHA25661cfd674e957d507b9bbe61f702a6f239b057e948a8e53ad0d2e689ec252b29b
SHA512abd1d687484bb7c065cab4a8677174b49a08e38348c5d532c2274dbdd84261cbc89dd58b764fe5dd45eae9f8fbc951799c8ac8b97f8646adeb0ca250b786f5bd
-
Filesize
34KB
MD5cf40831915026aed6f5c3194ed8f710e
SHA1271811e25557930ae8164abcaf068262a1aba030
SHA2565cf6fc67c8063ae869fafee382d3998d5c875080a3117104c8bbed67d5573b31
SHA5124996065c68f5f8bb31c584e48907501e4ac852274d53d95ae0b8dc24fc785e1406f7bfe996c734a3c8147f86a88bd676424569a42057fd01bd506be13b6f04d2
-
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\_cdres\_style\LanguageInfo.ini
Filesize2KB
MD5a17785420ee82167e8bd068a03ae70d2
SHA1b2438de816a40d56f71312b1e35cd35236665152
SHA256437a0af40da285ffe26168361553e4dc81d744028c0afb22fe0ff16c30d5c132
SHA5128906ef61c1d940e8c5800270c65a4a35e28c7b644b9ef42bd9b829aa823f602a5e1e73711bf2677a14edcc5992416258ef4db07258d2ae4cdc7164f370a8196a
-
C:\Users\Admin\AppData\Local\Temp\WebIns\Epson_WF-100_Series_EA_11_Web\_cdres\_style\Language\string.h
Filesize30KB
MD59e048b8f89cf73c36fbafda05086054d
SHA1e38e152f522c5282ada6501e28cfc8877f7862b1
SHA2560052bbe81a6eb6bc5bcab761672f42b96e61e347af89dc8543b62519663890af
SHA5127fba4ec94522a7f3ce298e63737255e62bd5a8ee072238297b68db19c24b338e653d839855c6d6bf1d4410b46614626bde86d7bd8f492c810b15e6dff1fd0640
-
Filesize
563B
MD55be738578dea98ed09a28dd51b83edac
SHA149a5eff21de273c33c51cfc73260befd9cb51382
SHA2568dd86434de24c73836ae2fc5c680359e184b735f6a7c95ed4f2602b6e9e452f5
SHA512e948385dbb45623ef047a91ac074b17d44849a0ae07d20a06edd7cd3cb152f659316ba4825c3029871ef24c57ed9fcfd407a4771a43a6982a304675c5a8871be
-
Filesize
272B
MD55242fb1719b1879ca318a2c035848d96
SHA1485ee39c8aa542651a293e37cca6ffffb0f3330e
SHA256cb7e4f630b577907c12a4bdde167df5bb26c127819fb25323e3da3817afc21ca
SHA512d1bbdf6a1343be79ced1f9222d526334a1f81519cfa3da982185f344a4b7198d852b4a09834d248c55d7edbcba9cf20e407af7de99d444206068c0a4840daa33
-
Filesize
764B
MD56ad7420a0d669073ba84615e89d37687
SHA13435e084f4ddc248ee97c3404c90affb3f768d00
SHA256385988efb40d010ac47468502539ac8b47fe22f46cbdd8a6bf4ac3499d097db6
SHA512387e8021bbe51bd81cf47e3e92208df12c6ac1259546584e41acad6a330dea9bfa8c1f8474df9127481e70d1c90665ed315996f2fe56a98339ea90f127b59936
-
Filesize
2.2MB
MD548f17bcb2d38ce8b4c025c487ebb46d1
SHA1b535ca49589e736cb0885b598986fd9fa22d8bf6
SHA2564eeecd4af623b888a035d1e7bafc6bda9298d1c9b531f847b4c80ccbb535a7be
SHA5120f7b7b3115c02453ca7fd6eff5879c66613e8fa3e605f71ae100ae4f3fd69f2a669a0744f1e1b2a6a5b068384b51158352ed843b93892c9ca9863d56d2e35013
-
Filesize
100KB
MD52ee89b932e4c0a7f503dd349d587630b
SHA1159ecabf22e39588350ec8785dddf0936385ae8e
SHA256ea650215af1d90d83c4bbfebe814926d8ddb4ffb9797be83b93bef35b2bbabd4
SHA512c6113f1a991e53b6b765dd6d93a55dc51ec2d5b4f317e0bb92002240e217cac1c10afd02b9b5b561e68b822de93fe227db6b2d104967e99ba6b7e24dfd8acb70