Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 23:29
Static task
static1
Behavioral task
behavioral1
Sample
7bdc9232b71c3aaaee483526abe3b2b633136cdedefbb514f335b96e426971ee.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
7bdc9232b71c3aaaee483526abe3b2b633136cdedefbb514f335b96e426971ee.exe
Resource
win10v2004-20240508-en
General
-
Target
7bdc9232b71c3aaaee483526abe3b2b633136cdedefbb514f335b96e426971ee.exe
-
Size
68KB
-
MD5
27729fa2a75c8d953c3742976957cb5b
-
SHA1
7869c34b67d7c855317e96295773dec024fe7a3a
-
SHA256
7bdc9232b71c3aaaee483526abe3b2b633136cdedefbb514f335b96e426971ee
-
SHA512
a53b082ae16c06dc9fbd633a2bc46dab8a37ab6729d296620fa51c9f9d27ba8c72c50d3b4a4078e9b7e8b45d99770ae7fdd98578c0971cf4ca5b9ec5b9d79b56
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8u:Olg35GTslA5t3/w8u
Malware Config
Signatures
-
Processes:
evpikeac.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" evpikeac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" evpikeac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" evpikeac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" evpikeac.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
evpikeac.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5549424E-514e-4d41-5549-424E514E4d41} evpikeac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5549424E-514e-4d41-5549-424E514E4d41}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" evpikeac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5549424E-514e-4d41-5549-424E514E4d41}\IsInstalled = "1" evpikeac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5549424E-514e-4d41-5549-424E514E4d41}\StubPath = "C:\\Windows\\system32\\eapleafoab.exe" evpikeac.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
Processes:
evpikeac.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" evpikeac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ihseasit.exe" evpikeac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe evpikeac.exe -
Executes dropped EXE 2 IoCs
Processes:
evpikeac.exeevpikeac.exepid process 2864 evpikeac.exe 2656 evpikeac.exe -
Loads dropped DLL 3 IoCs
Processes:
7bdc9232b71c3aaaee483526abe3b2b633136cdedefbb514f335b96e426971ee.exeevpikeac.exepid process 1732 7bdc9232b71c3aaaee483526abe3b2b633136cdedefbb514f335b96e426971ee.exe 1732 7bdc9232b71c3aaaee483526abe3b2b633136cdedefbb514f335b96e426971ee.exe 2864 evpikeac.exe -
Processes:
evpikeac.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" evpikeac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" evpikeac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" evpikeac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" evpikeac.exe -
Modifies WinLogon 2 TTPs 5 IoCs
Processes:
evpikeac.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} evpikeac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify evpikeac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" evpikeac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ahnupoat-oudat.dll" evpikeac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" evpikeac.exe -
Drops file in System32 directory 9 IoCs
Processes:
7bdc9232b71c3aaaee483526abe3b2b633136cdedefbb514f335b96e426971ee.exeevpikeac.exedescription ioc process File created C:\Windows\SysWOW64\evpikeac.exe 7bdc9232b71c3aaaee483526abe3b2b633136cdedefbb514f335b96e426971ee.exe File opened for modification C:\Windows\SysWOW64\ahnupoat-oudat.dll evpikeac.exe File opened for modification C:\Windows\SysWOW64\evpikeac.exe evpikeac.exe File opened for modification C:\Windows\SysWOW64\evpikeac.exe 7bdc9232b71c3aaaee483526abe3b2b633136cdedefbb514f335b96e426971ee.exe File opened for modification C:\Windows\SysWOW64\ihseasit.exe evpikeac.exe File created C:\Windows\SysWOW64\ihseasit.exe evpikeac.exe File opened for modification C:\Windows\SysWOW64\eapleafoab.exe evpikeac.exe File created C:\Windows\SysWOW64\eapleafoab.exe evpikeac.exe File created C:\Windows\SysWOW64\ahnupoat-oudat.dll evpikeac.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
evpikeac.exeevpikeac.exepid process 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2656 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe 2864 evpikeac.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7bdc9232b71c3aaaee483526abe3b2b633136cdedefbb514f335b96e426971ee.exeevpikeac.exedescription pid process Token: SeDebugPrivilege 1732 7bdc9232b71c3aaaee483526abe3b2b633136cdedefbb514f335b96e426971ee.exe Token: SeDebugPrivilege 2864 evpikeac.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7bdc9232b71c3aaaee483526abe3b2b633136cdedefbb514f335b96e426971ee.exeevpikeac.exedescription pid process target process PID 1732 wrote to memory of 2864 1732 7bdc9232b71c3aaaee483526abe3b2b633136cdedefbb514f335b96e426971ee.exe evpikeac.exe PID 1732 wrote to memory of 2864 1732 7bdc9232b71c3aaaee483526abe3b2b633136cdedefbb514f335b96e426971ee.exe evpikeac.exe PID 1732 wrote to memory of 2864 1732 7bdc9232b71c3aaaee483526abe3b2b633136cdedefbb514f335b96e426971ee.exe evpikeac.exe PID 1732 wrote to memory of 2864 1732 7bdc9232b71c3aaaee483526abe3b2b633136cdedefbb514f335b96e426971ee.exe evpikeac.exe PID 2864 wrote to memory of 432 2864 evpikeac.exe winlogon.exe PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 2656 2864 evpikeac.exe evpikeac.exe PID 2864 wrote to memory of 2656 2864 evpikeac.exe evpikeac.exe PID 2864 wrote to memory of 2656 2864 evpikeac.exe evpikeac.exe PID 2864 wrote to memory of 2656 2864 evpikeac.exe evpikeac.exe PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE PID 2864 wrote to memory of 1180 2864 evpikeac.exe Explorer.EXE
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\7bdc9232b71c3aaaee483526abe3b2b633136cdedefbb514f335b96e426971ee.exe"C:\Users\Admin\AppData\Local\Temp\7bdc9232b71c3aaaee483526abe3b2b633136cdedefbb514f335b96e426971ee.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\evpikeac.exe"C:\Windows\system32\evpikeac.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\evpikeac.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\ahnupoat-oudat.dllFilesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
C:\Windows\SysWOW64\eapleafoab.exeFilesize
71KB
MD5c0c91404d42055bd237de245bfe0fb1e
SHA186cce0b116605cbb699e5159e2ee2e27b00e253b
SHA256d0f09bf161f9ac9e9315bf54347abced83182f6c5d31af16f87b2f2be617840e
SHA51297d42e263e82521e2a8cc3e0f0ea70d4d4330d686a3821f4e7bb959d84dcddf6a84a5966b6c33a72fcdfd542fbe1c003956ebb0cc1acd22bcdd916e9f452e167
-
C:\Windows\SysWOW64\ihseasit.exeFilesize
72KB
MD5a780e6f94a8bb6d4803064bcb6ee9729
SHA1b6d14e1559f1cf9409095752dfa9b53e2a4582db
SHA2563230405e5d2ea4e3459d6b422474663e3db3f293337ae08d7c4acf0196aa0c06
SHA512c28814c872f57b11bf3cba215d005ef80b9177c9e2e04e1df1b05cb9fc07266b653e8b4ab5175cf7d24ca441eb060a1e4d4dc7a590c27cb009c48113a2fa3605
-
\Windows\SysWOW64\evpikeac.exeFilesize
68KB
MD527729fa2a75c8d953c3742976957cb5b
SHA17869c34b67d7c855317e96295773dec024fe7a3a
SHA2567bdc9232b71c3aaaee483526abe3b2b633136cdedefbb514f335b96e426971ee
SHA512a53b082ae16c06dc9fbd633a2bc46dab8a37ab6729d296620fa51c9f9d27ba8c72c50d3b4a4078e9b7e8b45d99770ae7fdd98578c0971cf4ca5b9ec5b9d79b56
-
memory/1732-10-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2656-56-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2864-55-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB