Overview
overview
7Static
static
3epsilon.exe
windows7-x64
7epsilon.exe
windows10-1703-x64
7epsilon.exe
windows10-2004-x64
7epsilon.exe
windows11-21h2-x64
7LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-1703-x64
4LICENSES.c...m.html
windows10-2004-x64
1LICENSES.c...m.html
windows11-21h2-x64
1resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-1703-x64
4resources/elevate.exe
windows10-2004-x64
1resources/elevate.exe
windows11-21h2-x64
1update.exe
windows7-x64
1update.exe
windows10-1703-x64
7update.exe
windows10-2004-x64
7update.exe
windows11-21h2-x64
7Analysis
-
max time kernel
602s -
max time network
389s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
28-04-2024 09:54
Static task
static1
Behavioral task
behavioral1
Sample
epsilon.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
epsilon.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
epsilon.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral4
Sample
epsilon.exe
Resource
win11-20240419-en
Behavioral task
behavioral5
Sample
LICENSES.chromium.html
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
LICENSES.chromium.html
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11-20240419-en
Behavioral task
behavioral9
Sample
resources/elevate.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
resources/elevate.exe
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
resources/elevate.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral12
Sample
resources/elevate.exe
Resource
win11-20240419-en
Behavioral task
behavioral13
Sample
update.exe
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
update.exe
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
update.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral16
Sample
update.exe
Resource
win11-20240419-en
General
-
Target
resources/elevate.exe
-
Size
105KB
-
MD5
792b92c8ad13c46f27c7ced0810694df
-
SHA1
d8d449b92de20a57df722df46435ba4553ecc802
-
SHA256
9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
-
SHA512
6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
-
SSDEEP
3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid process 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 2368 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 2368 taskmgr.exe Token: SeSystemProfilePrivilege 2368 taskmgr.exe Token: SeCreateGlobalPrivilege 2368 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe 2368 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage