Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
22/04/2024, 12:37
Static task
static1
1 signatures
General
-
Target
EPOKA V2.exe
-
Size
349KB
-
MD5
d046c7c32423489927bc7ecbc1864ef0
-
SHA1
6425baebaaa91f3557e7ee19d278ee09a5643e42
-
SHA256
66782c5ef8178fbc10751a66741548ce7ae9e6e35f1dcb3e7418f1fe04aee636
-
SHA512
1483f647ab93ee3b82b7e57699ea2a1d14e56eafe7c6529c9860b4cb88d12f54162980a3b897b11d170c45c04814d9cf76e6d9ef8485e0922ddd7c3980d788fa
-
SSDEEP
3072:zq6+ouCpk2mpcWJ0r+QNTBfjiRsOyXkrKzgrKzBhnQ0rrzUde6Id6x:zldk1cWQRNTBbB4x
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\en-US\pacer.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\de-DE\mouclass.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\de-DE\rndismpx.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\de-DE\i8042prt.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\de-DE\usbhub.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\storport.sys cmd.exe File opened for modification C:\Windows\System32\drivers\discache.sys cmd.exe File opened for modification C:\Windows\System32\drivers\es-ES\atikmdag.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\it-IT\pscr.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\de-DE\afd.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\mouclass.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ja-JP\tunnel.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\scfilter.sys cmd.exe File opened for modification C:\Windows\System32\drivers\vwififlt.sys cmd.exe File opened for modification C:\Windows\System32\drivers\drmkaud.sys cmd.exe File opened for modification C:\Windows\System32\drivers\es-ES\qwavedrv.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\it-IT\pcmcia.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ndiscap.sys cmd.exe File opened for modification C:\Windows\System32\drivers\fr-FR\ohci1394.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\it-IT\pnpmem.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ja-JP\rdbss.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\rasl2tp.sys cmd.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\bfe.dll.mui cmd.exe File opened for modification C:\Windows\System32\drivers\hdaudbus.sys cmd.exe File opened for modification C:\Windows\System32\drivers\mouhid.sys cmd.exe File opened for modification C:\Windows\System32\drivers\fr-FR\disk.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\fr-FR\fvevol.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\it-IT\ntfs.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\it-IT\volmgrx.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ja-JP\partmgr.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\FWPKCLNT.SYS cmd.exe File opened for modification C:\Windows\System32\drivers\RNDISMP.sys cmd.exe File opened for modification C:\Windows\System32\drivers\es-ES\ohci1394.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\es-ES\usbhub.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\npfs.sys cmd.exe File opened for modification C:\Windows\System32\drivers\es-ES\mouhid.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\fr-FR\bthpan.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\fr-FR\msdsm.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\hidusb.sys cmd.exe File opened for modification C:\Windows\System32\drivers\de-DE\HdAudio.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\es-ES\intelppm.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ja-JP\GAGP30KX.SYS.mui cmd.exe File opened for modification C:\Windows\System32\drivers\tssecsrv.sys cmd.exe File opened for modification C:\Windows\System32\drivers\it-IT\scfilter.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\es-ES\hidbth.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ja-JP\MTConfig.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\i8042prt.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\tpm.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\wd.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\de-DE\WpdMtpDr.dll.mui cmd.exe File opened for modification C:\Windows\System32\drivers\es-ES\ndiscap.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\fr-FR\HdAudio.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\fr-FR\umbus.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\rdyboost.sys cmd.exe File opened for modification C:\Windows\System32\drivers\es-ES\cdrom.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\es-ES\i8042prt.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\vga.sys cmd.exe File opened for modification C:\Windows\System32\drivers\es-ES\volsnap.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\it-IT\hdaudbus.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ja-JP\amdk8.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ja-JP\ataport.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\de-DE\sermouse.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\1394ohci.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\fr-FR\hidbth.sys.mui cmd.exe -
Manipulates Digital Signatures 2 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File opened for modification C:\Windows\System32\wintrust.dll cmd.exe File opened for modification C:\Windows\SysWOW64\wintrust.dll cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 52 IoCs
description ioc Process File opened for modification C:\Windows\winsxs\AMB6BD~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM15B7~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\X814D8~1.175\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM0353~1.175\desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM5C97~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AMC003~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AMCF3A~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AMDF32~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AMC0AD~1.175\desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM281C~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AMB8AA~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM814E~1.175\desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM912A~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM71C7~1.163\desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM2971~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AMFB84~1.175\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM6927~1.175\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM50D0~1.175\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM9934~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\assembly\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM5043~1.164\desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM989B~1.175\desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM076B~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AMFF91~1.164\desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM3E43~1.175\desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM9AF0~1.163\desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM7B95~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM082E~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM0112~1.175\desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AMB428~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AMF946~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM28D3~1.163\desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AMAB03~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM425B~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AMEEEB~1.163\desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AMA45F~1.175\desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AMFA6B~1.175\desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AME009~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM0FD6~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM3A5B~1.175\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AMD694~1.175\desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AMEE05~1.175\desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AMC04C~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM1464~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM2473~1.163\desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AMFD52~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM5CD3~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AMCCDB~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM1B18~1.163\desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AMCA4A~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AME19A~1.163\Desktop.ini cmd.exe File opened for modification C:\Windows\winsxs\AM131F~1.163\Desktop.ini cmd.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\winsxs\X8D42B~1.163\autorun.inf cmd.exe File opened for modification C:\Windows\BITLOC~1\autorun.inf cmd.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ja-JP\syskey.exe.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\sstpsvc.dll.mui cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\es-ES\prnrc00c.inf_loc cmd.exe File opened for modification C:\Windows\System32\en-US\dmutil.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\en-US\wdc.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\fr-FR\vbscript.dll.mui cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\FILERE~1\PRNHP0~1.INF\Amd64\HPO1500T.GPD cmd.exe File opened for modification C:\Windows\System32\it-IT\ubpm.dll.mui cmd.exe File opened for modification C:\Windows\System32\wbem\irda.mof cmd.exe File opened for modification C:\Windows\SysWOW64\de-DE\cmstplua.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\es-ES\iasacct.dll.mui cmd.exe File opened for modification C:\Windows\System32\choice.exe cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\FILERE~1\PRNKY0~1.INF\Amd64\KYKM3232.PPD cmd.exe File opened for modification C:\Windows\System32\en-US\DFDTS.dll.mui cmd.exe File opened for modification C:\Windows\System32\it-IT\kernel32.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\Dism\ja-JP\DmiProvider.dll.mui cmd.exe File opened for modification C:\Windows\System32\com\en-US\comrepl.exe.mui cmd.exe File opened for modification C:\Windows\System32\nshipsec.dll cmd.exe File opened for modification C:\Windows\SysWOW64\iaspolcy.dll cmd.exe File opened for modification C:\Windows\System32\Dxpserver.exe cmd.exe File opened for modification C:\Windows\System32\it-IT\fltlib.dll.mui cmd.exe File opened for modification C:\Windows\System32\ja-JP\bthci.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\sqlcese30.dll cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\FILERE~1\NETRND~1.INF\netrndis.PNF cmd.exe File opened for modification C:\Windows\System32\ja-JP\inetpp.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\OEM\PROFES~2\license.rtf cmd.exe File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\OEM\HOMEBA~1\license.rtf cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\FILERE~1\PRE456~1.INF\Amd64\EP0NOE09.DLL cmd.exe File opened for modification C:\Windows\System32\fr-FR\Licenses\eval\Starter\license.rtf cmd.exe File opened for modification C:\Windows\System32\NlsData0039.dll cmd.exe File opened for modification C:\Windows\SysWOW64\ja-JP\logman.exe.mui cmd.exe File opened for modification C:\Windows\System32\it-IT\dmutil.dll.mui cmd.exe File opened for modification C:\Windows\System32\it-IT\mprdim.dll.mui cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\FILERE~1\WIALX0~2.INF\lxa2iobj.DLL cmd.exe File opened for modification C:\Windows\System32\ja-JP\ntlanman.dll.mui cmd.exe File opened for modification C:\Windows\System32\wbem\ja-JP\rdpencom.mfl cmd.exe File opened for modification C:\Windows\SysWOW64\de-DE\themeui.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\it-IT\bfe.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\mspaint.exe cmd.exe File opened for modification C:\Windows\SysWOW64\wbem\de-DE\WmiPerfInst.dll.mui cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\FILERE~1\PRNCA0~4.INF\Amd64\CNBP_318.DLL cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\FILERE~1\PRNSV0~1.INF\Amd64\SVC4540.GPD cmd.exe File opened for modification C:\Windows\System32\ja-JP\SCardDlg.dll.mui cmd.exe File opened for modification C:\Windows\System32\WINDOW~1\v1.0\en-US\about_logical_operators.help.txt cmd.exe File opened for modification C:\Windows\SysWOW64\en-US\glu32.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\WINDOW~1\v1.0\fr-FR\about_types.ps1xml.help.txt cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\FILERE~1\PRNSH0~1.INF\Amd64\SHK12N03.GPD cmd.exe File opened for modification C:\Windows\System32\fr-FR\dnsrslvr.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\_Default\PROFES~3\license.rtf cmd.exe File opened for modification C:\Windows\SysWOW64\Setup\RasMigPlugin.dll cmd.exe File opened for modification C:\Windows\SysWOW64\WlanMM.dll cmd.exe File opened for modification C:\Windows\System32\ja-JP\sntsearch.dll.mui cmd.exe File opened for modification C:\Windows\System32\ko-KR\WMPhoto.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\de-DE\msxml6r.dll.mui cmd.exe File opened for modification C:\Windows\System32\fr-FR\Wpc.dll.mui cmd.exe File opened for modification C:\Windows\System32\WINDOW~1\v1.0\fr-FR\about_remote_output.help.txt cmd.exe File opened for modification C:\Windows\SysWOW64\de-DE\certenc.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\en-US\msctfui.dll.mui cmd.exe File opened for modification C:\Windows\SysWOW64\it-IT\vfwwdm32.dll.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\wsqmcons.exe.mui cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\FILERE~1\SMARTC~1.INF\cmbp0wdm.sys cmd.exe File opened for modification C:\Windows\SysWOW64\wbem\wdigest.mof cmd.exe File opened for modification C:\Windows\System32\de-DE\setspn.exe.mui cmd.exe File opened for modification C:\Windows\System32\DRIVER~1\FILERE~1\PR9A57~2.INF\Amd64\CNBBR286.DLL cmd.exe -
Modifies termsrv.dll 1 TTPs 1 IoCs
Commonly used to allow simultaneous RDP sessions.
description ioc Process File opened for modification C:\Windows\System32\termsrv.dll cmd.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~1\DVDMAK~1\Shared\DVDSTY~1\RECTAN~1\NavigationUp_SelectionSubpicture.png cmd.exe File opened for modification C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.0\it\System.Printing.resources.dll cmd.exe File opened for modification C:\PROGRA~2\COMMON~1\System\OLEDB~1\msdaenum.dll cmd.exe File opened for modification C:\PROGRA~2\WI4223~1\Gadgets\CURREN~1.GAD\images\row_over.png cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\MICROS~1\ink\ipsesp.xml cmd.exe File opened for modification C:\PROGRA~1\DVDMAK~1\Shared\DVDSTY~1\Memories\16_9-frame-overlay.png cmd.exe File opened for modification C:\PROGRA~2\WI4223~1\Gadgets\WEATHE~1.GAD\images\11.png cmd.exe File opened for modification C:\PROGRA~1\DVDMAK~1\Shared\DVDSTY~1\cloud_Thumbnail.bmp cmd.exe File opened for modification C:\PROGRA~1\WI4223~1\Gadgets\CALEND~1.GAD\ja-JP\calendar.html cmd.exe File opened for modification C:\PROGRA~2\WI4223~1\es-ES\sbdrop.dll.mui cmd.exe File opened for modification C:\PROGRA~2\WI4223~1\Gadgets\RSSFEE~1.GAD\images\item_hover_flyout.png cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\DEVICE~1\Task\{E35BE~1\de-DE\resource.xml cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\System\msadc\ja-JP\msdaprsr.dll.mui cmd.exe File opened for modification C:\PROGRA~2\COMMON~1\System\msadc\es-ES\msdaremr.dll.mui cmd.exe File opened for modification C:\PROGRA~2\WI54FB~1\it-IT\wmpnssui.dll.mui cmd.exe File opened for modification C:\PROGRA~2\WI4223~1\Gadgets\WEATHE~1.GAD\images\2.png cmd.exe File opened for modification C:\PROGRA~2\WI4223~1\sbdrop.dll cmd.exe File opened for modification C:\PROGRA~1\WI4223~1\Gadgets\PICTUR~1.GAD\Images\setting_back.png cmd.exe File opened for modification C:\PROGRA~1\DVDMAK~1\Shared\DVDSTY~1\Pets\Notes_INTRO_BG.wmv cmd.exe File opened for modification C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.5\System.ComponentModel.DataAnnotations.dll cmd.exe File opened for modification C:\PROGRA~2\WINDOW~1\ja-JP\WinMail.exe.mui cmd.exe File opened for modification C:\PROGRA~2\WI4223~1\Gadgets\CLOCK~1.GAD\images\trad_h.png cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\System\OLEDB~1\de-DE\msdasqlr.dll.mui cmd.exe File opened for modification C:\PROGRA~1\DVDMAK~1\Shared\DVDSTY~1\SPECIA~1\SpecialNavigationRight_ButtonGraphic.png cmd.exe File opened for modification C:\PROGRA~1\WI4223~1\Gadgets\WEATHE~1.GAD\images\docked_black_moon-last-quarter.png cmd.exe File opened for modification C:\PROGRA~2\WI4223~1\Gadgets\WEATHE~1.GAD\images\144DPI\(144DPI)alertIcon.png cmd.exe File opened for modification C:\PROGRA~1\DVDMAK~1\Shared\DVDSTY~1\SPECIA~1\scenesscroll.png cmd.exe File opened for modification C:\PROGRA~1\WI4223~1\Gadgets\MEDIAC~1.GAD\images\button_right_mouseout.png cmd.exe File opened for modification C:\PROGRA~2\WI4223~1\Gadgets\CURREN~1.GAD\images\info.png cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\System\ja-JP\wab32res.dll.mui cmd.exe File opened for modification C:\PROGRA~1\DVDMAK~1\Shared\DVDSTY~1\BabyGirl\16_9-frame-highlight.png cmd.exe File opened for modification C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.0\de\System.Speech.resources.dll cmd.exe File opened for modification C:\PROGRA~1\WI4223~1\Gadgets\CURREN~1.GAD\fr-FR\js\service.js cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\MICROS~1\ink\FSDEFI~1\main\baseAltGr_rtl.xml cmd.exe File opened for modification C:\PROGRA~1\WI4223~1\Gadgets\CLOCK~1.GAD\ja-JP\css\clock.css cmd.exe File opened for modification C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.0\de\System.IdentityModel.Selectors.Resources.dll cmd.exe File opened for modification C:\PROGRA~2\WI4223~1\en-US\Sidebar.exe.mui cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\MICROS~1\ink\ja-JP\ShapeCollector.exe.mui cmd.exe File opened for modification C:\PROGRA~1\DVDMAK~1\Shared\DVDSTY~1\rectangle_plain_Thumbnail.bmp cmd.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\PDFSIG~1.PDF cmd.exe File opened for modification C:\PROGRA~2\COMMON~1\System\msadc\fr-FR\msdaprsr.dll.mui cmd.exe File opened for modification C:\PROGRA~1\DVDMAK~1\Shared\DVDSTY~1\SPECIA~1\SpecialNavigationRight_SelectionSubpicture.png cmd.exe File opened for modification C:\PROGRA~2\WI4223~1\Gadgets\CPU~1.GAD\logo.png cmd.exe File opened for modification C:\PROGRA~1\WI0FCF~1\ja-JP\JNTFiltr.dll.mui cmd.exe File opened for modification C:\PROGRA~2\WI4223~1\Gadgets\CURREN~1.GAD\en-US\js\library.js cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\MICROS~1\MSInfo\de-DE\msinfo32.exe.mui cmd.exe File opened for modification C:\PROGRA~1\DVDMAK~1\Shared\DVDSTY~1\BabyGirl\flower_trans_matte.wmv cmd.exe File opened for modification C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.5\es\System.Windows.Presentation.resources.dll cmd.exe File opened for modification C:\PROGRA~2\WI4223~1\Gadgets\WEATHE~1.GAD\es-ES\settings.html cmd.exe File opened for modification C:\PROGRA~1\DVDMAK~1\Shared\DVDSTY~1\Stacking\NavigationRight_ButtonGraphic.png cmd.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\es-ES\TipRes.dll.mui cmd.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\imjplm.dll cmd.exe File opened for modification C:\PROGRA~1\WI4223~1\Gadgets\CLOCK~1.GAD\images\cronometer_dot.png cmd.exe File opened for modification C:\PROGRA~1\WI4223~1\Gadgets\WEATHE~1.GAD\drag.png cmd.exe File opened for modification C:\PROGRA~2\WI4223~1\Gadgets\PICTUR~1.GAD\ja-JP\css\picturePuzzle.css cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\MICROS~1\ink\ipsnld.xml cmd.exe File opened for modification C:\PROGRA~1\WINDOW~4\PhotoViewer.dll cmd.exe File opened for modification C:\PROGRA~1\WI4223~1\Gadgets\CLOCK~1.GAD\it-IT\css\clock.css cmd.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\STATIO~1\ShadesOfBlue.jpg cmd.exe File opened for modification C:\PROGRA~1\WI4223~1\Gadgets\WEATHE~1.GAD\images\120DPI\(120DPI)alertIcon.png cmd.exe File opened for modification C:\PROGRA~2\WI4223~1\Gadgets\CURREN~1.GAD\ja-JP\currency.html cmd.exe File opened for modification C:\PROGRA~1\WINDOW~3\ja-JP\MpAsDesc.dll.mui cmd.exe File opened for modification C:\PROGRA~1\WI0FCF~1\TEMPLA~1\To_Do_List.jtp cmd.exe File opened for modification C:\PROGRA~1\WINDOW~1\wabfind.dll cmd.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\winsxs\MANIFE~2\AM317C~1.MAN cmd.exe File opened for modification C:\Windows\PLA\Rules\de-DE\Rules.System.Memory.xml cmd.exe File opened for modification C:\Windows\winsxs\AM25F2~1.163\PCAUID~1.MUI cmd.exe File opened for modification C:\Windows\winsxs\AMA150~1.163\WETDLL~1.MUI cmd.exe File opened for modification C:\Windows\winsxs\AM88DF~3.163\CNBP_3~1.MUI cmd.exe File opened for modification C:\Windows\winsxs\X861D3~1.163\SYSTEM~1.MUI cmd.exe File opened for modification C:\Windows\winsxs\AMBB12~1.163\CXRAPH~1.ROM cmd.exe File opened for modification C:\Windows\winsxs\Backup\AMB87B~1.DLL cmd.exe File opened for modification C:\Windows\Help\Help\de-DE\Help_AssetId.H1K cmd.exe File opened for modification C:\Windows\winsxs\FileMaps\$$F143~1.CDF cmd.exe File opened for modification C:\Windows\winsxs\MANIFE~2\MS7F0B~1.MAN cmd.exe File opened for modification C:\Windows\MICROS~1.NET\FRAMEW~2\V20~1.507\es\System.Web.Resources.dll cmd.exe File opened for modification C:\Windows\winsxs\AM0371~1.175\lprmon.dll cmd.exe File opened for modification C:\Windows\winsxs\AM699E~2.175\ARPEXE~1.MUI cmd.exe File opened for modification C:\Windows\winsxs\Backup\AM5BB6~1.TTF cmd.exe File opened for modification C:\Windows\winsxs\MANIFE~2\AMF11B~1.MAN cmd.exe File opened for modification C:\Windows\winsxs\MANIFE~2\AM4DB8~1.MAN cmd.exe File opened for modification C:\Windows\winsxs\MANIFE~2\AMDCFF~1.MAN cmd.exe File opened for modification C:\Windows\winsxs\MANIFE~2\AMF908~3.MAN cmd.exe File opened for modification C:\Windows\winsxs\AM10EA~1.163\NETRAS~1.INF cmd.exe File opened for modification C:\Windows\winsxs\MANIFE~2\AMECB9~1.MAN cmd.exe File opened for modification C:\Windows\winsxs\MANIFE~2\X8B62E~1.MAN cmd.exe File opened for modification C:\Windows\winsxs\MANIFE~2\X8B585~1.MAN cmd.exe File opened for modification C:\Windows\winsxs\X8AD1E~1.163\FMSDLL~1.MUI cmd.exe File opened for modification C:\Windows\winsxs\X81489~1.163\WSDAPI~1.MUI cmd.exe File opened for modification C:\Windows\winsxs\AMCFBF~1.163\EVENTC~1.MUI cmd.exe File opened for modification C:\Windows\winsxs\MANIFE~2\AM1585~1.MAN cmd.exe File opened for modification C:\Windows\winsxs\AM2C07~2.163\MEGASA~1.INF cmd.exe File opened for modification C:\Windows\winsxs\AM0772~1.175\browcli.dll cmd.exe File opened for modification C:\Windows\winsxs\MANIFE~2\X8A8FE~1.MAN cmd.exe File opened for modification C:\Windows\winsxs\X83BFD~1.163\shrpubw.exe cmd.exe File opened for modification C:\Windows\winsxs\AMC8D4~1.163\PCL5UR~1.MUI cmd.exe File opened for modification C:\Windows\winsxs\FileMaps\$$71E6~1.CDF cmd.exe File opened for modification C:\Windows\winsxs\MANIFE~2\AM1FB5~1.MAN cmd.exe File opened for modification C:\Windows\winsxs\MANIFE~2\AM2BD0~1.MAN cmd.exe File opened for modification C:\Windows\Help\mui\0411\authm.CHM cmd.exe File opened for modification C:\Windows\winsxs\MANIFE~2\AM4542~2.MAN cmd.exe File opened for modification C:\Windows\winsxs\MANIFE~2\X8DF6F~1.MAN cmd.exe File opened for modification C:\Windows\winsxs\AM4106~2.163\IPNATH~1.MUI cmd.exe File opened for modification C:\Windows\winsxs\MANIFE~2\AM65A6~1.MAN cmd.exe File opened for modification C:\Windows\winsxs\X84413~1.163\MPRDIM~1.MUI cmd.exe File opened for modification C:\Windows\winsxs\AMA758~2.163\MMCBAS~1.MUI cmd.exe File opened for modification C:\Windows\winsxs\AM150E~1.175\SED80A~1.XRM cmd.exe File opened for modification C:\Windows\winsxs\WODF58~1.163\WINMGM~1.MUI cmd.exe File opened for modification C:\Windows\winsxs\X8F701~1.163\IERNON~1.MUI cmd.exe File opened for modification C:\Windows\winsxs\AM9F57~1.163\CNHF1LM.DLL cmd.exe File opened for modification C:\Windows\winsxs\AM5307~1.175\RASMAN~1.MUI cmd.exe File opened for modification C:\Windows\winsxs\MANIFE~2\AMAE05~1.MAN cmd.exe File opened for modification C:\Windows\winsxs\MANIFE~2\X8837F~1.MAN cmd.exe File opened for modification C:\Windows\winsxs\Backup\AMC0DE~1.MUI cmd.exe File opened for modification C:\Windows\winsxs\AM318C~1.163\MCHGR~1.INF cmd.exe File opened for modification C:\Windows\winsxs\Backup\X8EF8A~1.MAN cmd.exe File opened for modification C:\Windows\winsxs\MANIFE~2\AM76E4~1.MAN cmd.exe File opened for modification C:\Windows\winsxs\X8CAC5~1.163\WPDSHE~2.MUI cmd.exe File opened for modification C:\Windows\winsxs\MANIFE~2\MSBFE0~1.MAN cmd.exe File opened for modification C:\Windows\winsxs\MANIFE~2\AM59C9~1.MAN cmd.exe File opened for modification C:\Windows\winsxs\AM2B7A~1.163\RUA39E~1.XML cmd.exe File opened for modification C:\Windows\winsxs\AM1583~1.163\COMCTL~1.MUI cmd.exe File opened for modification C:\Windows\winsxs\FileMaps\$$4C60~1.CDF cmd.exe File opened for modification C:\Windows\winsxs\MANIFE~2\AM3709~1.MAN cmd.exe File opened for modification C:\Windows\winsxs\MANIFE~2\AMA655~1.MAN cmd.exe File opened for modification C:\Windows\winsxs\MANIFE~2\AM1D28~1.MAN cmd.exe File opened for modification C:\Windows\winsxs\X8CFBE~1.163\p2p-pnrp.mfl cmd.exe File opened for modification C:\Windows\winsxs\AMFB65~1.163\IMAPID~1.MUI cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2912 wrote to memory of 1920 2912 EPOKA V2.exe 28 PID 2912 wrote to memory of 1920 2912 EPOKA V2.exe 28 PID 2912 wrote to memory of 1920 2912 EPOKA V2.exe 28 PID 2912 wrote to memory of 1920 2912 EPOKA V2.exe 28 PID 1920 wrote to memory of 2148 1920 cmd.exe 30 PID 1920 wrote to memory of 2148 1920 cmd.exe 30 PID 1920 wrote to memory of 2148 1920 cmd.exe 30 PID 1920 wrote to memory of 2256 1920 cmd.exe 31 PID 1920 wrote to memory of 2256 1920 cmd.exe 31 PID 1920 wrote to memory of 2256 1920 cmd.exe 31 PID 1920 wrote to memory of 2340 1920 cmd.exe 32 PID 1920 wrote to memory of 2340 1920 cmd.exe 32 PID 1920 wrote to memory of 2340 1920 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\EPOKA V2.exe"C:\Users\Admin\AppData\Local\Temp\EPOKA V2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\12C6.tmp\12C7.tmp\12C8.bat "C:\Users\Admin\AppData\Local\Temp\EPOKA V2.exe""2⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Modifies termsrv.dll
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f3⤵PID:2148
-
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:2256
-
-
C:\Windows\system32\reg.exereg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_SZ /d 1 /f3⤵PID:2340
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD58830a94d4cfbf251014b4d1c38212b56
SHA1e46df32ae98f041018f962c8cc0dac04b8e79193
SHA25699effffdb9f285215daab136e7348b8dbd5e6bfa1082b05a155e50dc375920b8
SHA5128e8e36d0b47f80b00016f2199ab7a9df8b37e5e0f0579d3b8485a3954c2641813e18e4a2a74c7a32e1152a8dcf7fb4d28f5c6120dcf7b55c483f20e486bd9c92