Analysis
-
max time kernel
149s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 16:41
Static task
static1
Behavioral task
behavioral1
Sample
5fb159bef67b39c045a61372b7609a64e860b69522e232526a9b2ceb4768cdb0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5fb159bef67b39c045a61372b7609a64e860b69522e232526a9b2ceb4768cdb0.exe
Resource
win10v2004-20240412-en
General
-
Target
5fb159bef67b39c045a61372b7609a64e860b69522e232526a9b2ceb4768cdb0.exe
-
Size
70KB
-
MD5
244a4454dda7cb9b99a2f1ee0369b86b
-
SHA1
ace308393a488a77709d2eee7744731d838f59c8
-
SHA256
5fb159bef67b39c045a61372b7609a64e860b69522e232526a9b2ceb4768cdb0
-
SHA512
9c8196210f90074596ff9982de61be152d8903c0e38a593aee51a7a09c6ad33feb1778ab222040c5a73095f8e5e9b078df47f594e2a67d5dcd91378e6b96c48b
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8sl4:Olg35GTslA5t3/w8h
Malware Config
Signatures
-
Processes:
okpupum.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" okpupum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" okpupum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" okpupum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" okpupum.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
okpupum.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A495857-4553-4e48-4A49-585745534e48} okpupum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A495857-4553-4e48-4A49-585745534e48}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" okpupum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A495857-4553-4e48-4A49-585745534e48}\IsInstalled = "1" okpupum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A495857-4553-4e48-4A49-585745534e48}\StubPath = "C:\\Windows\\system32\\epfeagid.exe" okpupum.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
Processes:
okpupum.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe okpupum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" okpupum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ouxseveg.exe" okpupum.exe -
Executes dropped EXE 2 IoCs
Processes:
okpupum.exeokpupum.exepid process 3792 okpupum.exe 1876 okpupum.exe -
Processes:
okpupum.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" okpupum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" okpupum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" okpupum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" okpupum.exe -
Modifies WinLogon 2 TTPs 5 IoCs
Processes:
okpupum.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} okpupum.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify okpupum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" okpupum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\asheavab-icoab.dll" okpupum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" okpupum.exe -
Drops file in System32 directory 9 IoCs
Processes:
okpupum.exe5fb159bef67b39c045a61372b7609a64e860b69522e232526a9b2ceb4768cdb0.exedescription ioc process File opened for modification C:\Windows\SysWOW64\epfeagid.exe okpupum.exe File created C:\Windows\SysWOW64\asheavab-icoab.dll okpupum.exe File created C:\Windows\SysWOW64\ouxseveg.exe okpupum.exe File created C:\Windows\SysWOW64\okpupum.exe 5fb159bef67b39c045a61372b7609a64e860b69522e232526a9b2ceb4768cdb0.exe File opened for modification C:\Windows\SysWOW64\ouxseveg.exe okpupum.exe File created C:\Windows\SysWOW64\epfeagid.exe okpupum.exe File opened for modification C:\Windows\SysWOW64\asheavab-icoab.dll okpupum.exe File opened for modification C:\Windows\SysWOW64\okpupum.exe okpupum.exe File opened for modification C:\Windows\SysWOW64\okpupum.exe 5fb159bef67b39c045a61372b7609a64e860b69522e232526a9b2ceb4768cdb0.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
okpupum.exeokpupum.exepid process 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 1876 okpupum.exe 1876 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe 3792 okpupum.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5fb159bef67b39c045a61372b7609a64e860b69522e232526a9b2ceb4768cdb0.exeokpupum.exedescription pid process Token: SeDebugPrivilege 2852 5fb159bef67b39c045a61372b7609a64e860b69522e232526a9b2ceb4768cdb0.exe Token: SeDebugPrivilege 3792 okpupum.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5fb159bef67b39c045a61372b7609a64e860b69522e232526a9b2ceb4768cdb0.exeokpupum.exedescription pid process target process PID 2852 wrote to memory of 3792 2852 5fb159bef67b39c045a61372b7609a64e860b69522e232526a9b2ceb4768cdb0.exe okpupum.exe PID 2852 wrote to memory of 3792 2852 5fb159bef67b39c045a61372b7609a64e860b69522e232526a9b2ceb4768cdb0.exe okpupum.exe PID 2852 wrote to memory of 3792 2852 5fb159bef67b39c045a61372b7609a64e860b69522e232526a9b2ceb4768cdb0.exe okpupum.exe PID 3792 wrote to memory of 612 3792 okpupum.exe winlogon.exe PID 3792 wrote to memory of 1876 3792 okpupum.exe okpupum.exe PID 3792 wrote to memory of 1876 3792 okpupum.exe okpupum.exe PID 3792 wrote to memory of 1876 3792 okpupum.exe okpupum.exe PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE PID 3792 wrote to memory of 3424 3792 okpupum.exe Explorer.EXE
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\5fb159bef67b39c045a61372b7609a64e860b69522e232526a9b2ceb4768cdb0.exe"C:\Users\Admin\AppData\Local\Temp\5fb159bef67b39c045a61372b7609a64e860b69522e232526a9b2ceb4768cdb0.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\okpupum.exe"C:\Windows\system32\okpupum.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\okpupum.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\asheavab-icoab.dllFilesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
C:\Windows\SysWOW64\epfeagid.exeFilesize
72KB
MD5d7970a9a256b1dd77567faaab82464e8
SHA18da0f5a3c613c4e0be3a83ab80164f8ae6856f8e
SHA256679d1a807dba1af0148a00c0b6855153b925d06c3f78038f300363de0c034dd9
SHA5129797d7dc30e454dda0318d4c07a0d27994473018ed56a59e98154f28c34f10d18a2b4e180b5ed3401f70038aacce39f956626c6c6ce64bbcec1d197e2d438e7d
-
C:\Windows\SysWOW64\okpupum.exeFilesize
70KB
MD5244a4454dda7cb9b99a2f1ee0369b86b
SHA1ace308393a488a77709d2eee7744731d838f59c8
SHA2565fb159bef67b39c045a61372b7609a64e860b69522e232526a9b2ceb4768cdb0
SHA5129c8196210f90074596ff9982de61be152d8903c0e38a593aee51a7a09c6ad33feb1778ab222040c5a73095f8e5e9b078df47f594e2a67d5dcd91378e6b96c48b
-
C:\Windows\SysWOW64\ouxseveg.exeFilesize
73KB
MD5f528592bf169b2518d7e1b10eea1eb05
SHA10371854c1cf7d87e6226121c388d96427824127c
SHA2561d48927a9757f9bcaa95dc5c677ea19b6353b088792a6fb4941a043b26a2fb95
SHA512fa2752310818aaed87fe93566c727b872288e2577abaa39fd5e2e974789b666d7bb434336b40728b7f84d570d5ac94afce1409b7b50d6ccc904703afcf39ecf8
-
memory/2852-5-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB