Analysis
-
max time kernel
122s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11-10-2023 13:01
Static task
static1
Behavioral task
behavioral1
Sample
Windows_Office Activator By RXS.exe
Resource
win7-20230831-en
General
-
Target
Windows_Office Activator By RXS.exe
-
Size
779KB
-
MD5
7fc8b5c1779a9aeeecfcb4241e263d00
-
SHA1
e106ecab86ae0aa5fd94bffe49279fe793bb5e2c
-
SHA256
a8f2fe0ab643b948071bdb619fd4579740336e5744bfd4f2aed4c674f7c75f4f
-
SHA512
b99b746339cff5142d504bdeb4551d305034f8463f991100f200f83e10805a79c573a611a4a24558c4c41eab7460f5dafecd40c69fdc32d4c0faefd86285c947
-
SSDEEP
24576:FBuDErbOl69QjPPN15Nxtug2GNqfpcgHN:zuUE6aVNxtlaRc0N
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1155956024495308830/o395pHkaR0VtcxpxF8d-fTNY_r32FGWRVqhqpd3v2J7ysT_PVR1FckU2n2mU2vV4jiQL
Signatures
-
Detect Umbral payload 3 IoCs
resource yara_rule behavioral1/files/0x0031000000015c7f-14.dat family_umbral behavioral1/files/0x0031000000015c7f-15.dat family_umbral behavioral1/memory/2988-21-0x0000000000C80000-0x0000000000CC0000-memory.dmp family_umbral -
Executes dropped EXE 2 IoCs
pid Process 2720 Windows+Office Activator By RXS.exe 2988 office.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2136 powershell.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeDebugPrivilege 2136 powershell.exe Token: SeDebugPrivilege 2988 office.exe Token: SeIncreaseQuotaPrivilege 1508 wmic.exe Token: SeSecurityPrivilege 1508 wmic.exe Token: SeTakeOwnershipPrivilege 1508 wmic.exe Token: SeLoadDriverPrivilege 1508 wmic.exe Token: SeSystemProfilePrivilege 1508 wmic.exe Token: SeSystemtimePrivilege 1508 wmic.exe Token: SeProfSingleProcessPrivilege 1508 wmic.exe Token: SeIncBasePriorityPrivilege 1508 wmic.exe Token: SeCreatePagefilePrivilege 1508 wmic.exe Token: SeBackupPrivilege 1508 wmic.exe Token: SeRestorePrivilege 1508 wmic.exe Token: SeShutdownPrivilege 1508 wmic.exe Token: SeDebugPrivilege 1508 wmic.exe Token: SeSystemEnvironmentPrivilege 1508 wmic.exe Token: SeRemoteShutdownPrivilege 1508 wmic.exe Token: SeUndockPrivilege 1508 wmic.exe Token: SeManageVolumePrivilege 1508 wmic.exe Token: 33 1508 wmic.exe Token: 34 1508 wmic.exe Token: 35 1508 wmic.exe Token: SeIncreaseQuotaPrivilege 1508 wmic.exe Token: SeSecurityPrivilege 1508 wmic.exe Token: SeTakeOwnershipPrivilege 1508 wmic.exe Token: SeLoadDriverPrivilege 1508 wmic.exe Token: SeSystemProfilePrivilege 1508 wmic.exe Token: SeSystemtimePrivilege 1508 wmic.exe Token: SeProfSingleProcessPrivilege 1508 wmic.exe Token: SeIncBasePriorityPrivilege 1508 wmic.exe Token: SeCreatePagefilePrivilege 1508 wmic.exe Token: SeBackupPrivilege 1508 wmic.exe Token: SeRestorePrivilege 1508 wmic.exe Token: SeShutdownPrivilege 1508 wmic.exe Token: SeDebugPrivilege 1508 wmic.exe Token: SeSystemEnvironmentPrivilege 1508 wmic.exe Token: SeRemoteShutdownPrivilege 1508 wmic.exe Token: SeUndockPrivilege 1508 wmic.exe Token: SeManageVolumePrivilege 1508 wmic.exe Token: 33 1508 wmic.exe Token: 34 1508 wmic.exe Token: 35 1508 wmic.exe -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 1604 wrote to memory of 2136 1604 Windows_Office Activator By RXS.exe 28 PID 1604 wrote to memory of 2136 1604 Windows_Office Activator By RXS.exe 28 PID 1604 wrote to memory of 2136 1604 Windows_Office Activator By RXS.exe 28 PID 1604 wrote to memory of 2720 1604 Windows_Office Activator By RXS.exe 30 PID 1604 wrote to memory of 2720 1604 Windows_Office Activator By RXS.exe 30 PID 1604 wrote to memory of 2720 1604 Windows_Office Activator By RXS.exe 30 PID 1604 wrote to memory of 2720 1604 Windows_Office Activator By RXS.exe 30 PID 1604 wrote to memory of 2988 1604 Windows_Office Activator By RXS.exe 32 PID 1604 wrote to memory of 2988 1604 Windows_Office Activator By RXS.exe 32 PID 1604 wrote to memory of 2988 1604 Windows_Office Activator By RXS.exe 32 PID 2720 wrote to memory of 2524 2720 Windows+Office Activator By RXS.exe 33 PID 2720 wrote to memory of 2524 2720 Windows+Office Activator By RXS.exe 33 PID 2720 wrote to memory of 2524 2720 Windows+Office Activator By RXS.exe 33 PID 2720 wrote to memory of 2524 2720 Windows+Office Activator By RXS.exe 33 PID 2524 wrote to memory of 112 2524 cmd.exe 34 PID 2524 wrote to memory of 112 2524 cmd.exe 34 PID 2524 wrote to memory of 112 2524 cmd.exe 34 PID 2524 wrote to memory of 112 2524 cmd.exe 34 PID 2720 wrote to memory of 2676 2720 Windows+Office Activator By RXS.exe 35 PID 2720 wrote to memory of 2676 2720 Windows+Office Activator By RXS.exe 35 PID 2720 wrote to memory of 2676 2720 Windows+Office Activator By RXS.exe 35 PID 2720 wrote to memory of 2676 2720 Windows+Office Activator By RXS.exe 35 PID 2720 wrote to memory of 1496 2720 Windows+Office Activator By RXS.exe 36 PID 2720 wrote to memory of 1496 2720 Windows+Office Activator By RXS.exe 36 PID 2720 wrote to memory of 1496 2720 Windows+Office Activator By RXS.exe 36 PID 2720 wrote to memory of 1496 2720 Windows+Office Activator By RXS.exe 36 PID 2720 wrote to memory of 2548 2720 Windows+Office Activator By RXS.exe 37 PID 2720 wrote to memory of 2548 2720 Windows+Office Activator By RXS.exe 37 PID 2720 wrote to memory of 2548 2720 Windows+Office Activator By RXS.exe 37 PID 2720 wrote to memory of 2548 2720 Windows+Office Activator By RXS.exe 37 PID 2720 wrote to memory of 2552 2720 Windows+Office Activator By RXS.exe 38 PID 2720 wrote to memory of 2552 2720 Windows+Office Activator By RXS.exe 38 PID 2720 wrote to memory of 2552 2720 Windows+Office Activator By RXS.exe 38 PID 2720 wrote to memory of 2552 2720 Windows+Office Activator By RXS.exe 38 PID 2552 wrote to memory of 2504 2552 cmd.exe 39 PID 2552 wrote to memory of 2504 2552 cmd.exe 39 PID 2552 wrote to memory of 2504 2552 cmd.exe 39 PID 2552 wrote to memory of 2504 2552 cmd.exe 39 PID 2720 wrote to memory of 2512 2720 Windows+Office Activator By RXS.exe 40 PID 2720 wrote to memory of 2512 2720 Windows+Office Activator By RXS.exe 40 PID 2720 wrote to memory of 2512 2720 Windows+Office Activator By RXS.exe 40 PID 2720 wrote to memory of 2512 2720 Windows+Office Activator By RXS.exe 40 PID 2720 wrote to memory of 2564 2720 Windows+Office Activator By RXS.exe 41 PID 2720 wrote to memory of 2564 2720 Windows+Office Activator By RXS.exe 41 PID 2720 wrote to memory of 2564 2720 Windows+Office Activator By RXS.exe 41 PID 2720 wrote to memory of 2564 2720 Windows+Office Activator By RXS.exe 41 PID 2720 wrote to memory of 3060 2720 Windows+Office Activator By RXS.exe 43 PID 2720 wrote to memory of 3060 2720 Windows+Office Activator By RXS.exe 43 PID 2720 wrote to memory of 3060 2720 Windows+Office Activator By RXS.exe 43 PID 2720 wrote to memory of 3060 2720 Windows+Office Activator By RXS.exe 43 PID 2720 wrote to memory of 2812 2720 Windows+Office Activator By RXS.exe 42 PID 2720 wrote to memory of 2812 2720 Windows+Office Activator By RXS.exe 42 PID 2720 wrote to memory of 2812 2720 Windows+Office Activator By RXS.exe 42 PID 2720 wrote to memory of 2812 2720 Windows+Office Activator By RXS.exe 42 PID 2988 wrote to memory of 1508 2988 office.exe 46 PID 2988 wrote to memory of 1508 2988 office.exe 46 PID 2988 wrote to memory of 1508 2988 office.exe 46 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2504 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Windows_Office Activator By RXS.exe"C:\Users\Admin\AppData\Local\Temp\Windows_Office Activator By RXS.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAcwB6ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG4AeABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHUAcQBuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAYgB1ACMAPgA="2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2136
-
-
C:\Users\Admin\AppData\Local\Temp\Windows+Office Activator By RXS.exe"C:\Users\Admin\AppData\Local\Temp\Windows+Office Activator By RXS.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c mode con:cols=0080 lines=00253⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\mode.commode con:cols=0080 lines=00254⤵PID:112
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c title Windows+Office Activator By RXS3⤵PID:2676
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\myfiles" mkdir "C:\Users\Admin\AppData\Local\Temp\myfiles"3⤵PID:1496
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\wtmpd" mkdir "C:\Users\Admin\AppData\Local\Temp\wtmpd"3⤵PID:2548
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\wtmpd3⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\attrib.exeattrib +h C:\Users\Admin\AppData\Local\Temp\wtmpd4⤵
- Views/modifies file attributes
PID:2504
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo:0>C:\Users\Admin\AppData\Local\Temp\i6.t3⤵PID:2512
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\i6.bat3⤵PID:2564
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c pause3⤵PID:2812
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c3⤵PID:3060
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c3⤵PID:368
-
-
-
C:\Users\Admin\AppData\Local\Temp\office.exe"C:\Users\Admin\AppData\Local\Temp\office.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1508
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
539KB
MD597701b0653e97ef63e5ab2ece9078193
SHA1476943cbdf022d93a9a7b742f6b1672d969283c1
SHA2569f220a38f35889402f76e22c8faffdaec9c1cf8196c34f81d9f8efe2448084bc
SHA5123a22c94127dde5ab397cccd27d337591fbe6c8724fb70863795b00ef7714539090e193da5f6a80f1e989ec35d8428c3334a0958980c12426220e68540a32ee2f
-
Filesize
539KB
MD597701b0653e97ef63e5ab2ece9078193
SHA1476943cbdf022d93a9a7b742f6b1672d969283c1
SHA2569f220a38f35889402f76e22c8faffdaec9c1cf8196c34f81d9f8efe2448084bc
SHA5123a22c94127dde5ab397cccd27d337591fbe6c8724fb70863795b00ef7714539090e193da5f6a80f1e989ec35d8428c3334a0958980c12426220e68540a32ee2f
-
Filesize
539KB
MD597701b0653e97ef63e5ab2ece9078193
SHA1476943cbdf022d93a9a7b742f6b1672d969283c1
SHA2569f220a38f35889402f76e22c8faffdaec9c1cf8196c34f81d9f8efe2448084bc
SHA5123a22c94127dde5ab397cccd27d337591fbe6c8724fb70863795b00ef7714539090e193da5f6a80f1e989ec35d8428c3334a0958980c12426220e68540a32ee2f
-
Filesize
173B
MD50f8f70e88009593eefaa155a8e31b1d6
SHA1eabcc3f2135e0919e9456da0a4b1084f3382d4b6
SHA256941c169c07670650fc6c6148c1cae068b69bac209e05010594e164aafc7cdf8b
SHA51294df468b963f3c9d133a25e1ffa57039fac01fe960f0f738552ca6440e6242ff48d0b410fe70dd05a62e4842c925c9f2b0220ca9eb9cb4ff5490ada443c9a750
-
Filesize
3B
MD5a5ea0ad9260b1550a14cc58d2c39b03d
SHA1f0aedf295071ed34ab8c6a7692223d22b6a19841
SHA256f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04
SHA5127c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74
-
Filesize
231KB
MD568c29400b505fdb81b893319f0f1be96
SHA168116a02d6192d3886b4eaf2e1c1a7ee6dae5d14
SHA2569abd3922e63f5f827d98b48543005f91307ed371d3f252a97b8b5a1949761832
SHA5124f94ad68b7ea48de0f9e6adb0c71dd229876355209e5572c95f2fbcc640f61e9cbe72d2a31e9619401cb346993699794bee674fe14252ec957f6e81c56c55da3
-
Filesize
231KB
MD568c29400b505fdb81b893319f0f1be96
SHA168116a02d6192d3886b4eaf2e1c1a7ee6dae5d14
SHA2569abd3922e63f5f827d98b48543005f91307ed371d3f252a97b8b5a1949761832
SHA5124f94ad68b7ea48de0f9e6adb0c71dd229876355209e5572c95f2fbcc640f61e9cbe72d2a31e9619401cb346993699794bee674fe14252ec957f6e81c56c55da3