Overview

overview

10

Static

static

10

AnyDesk v3...V).exe

windows10-2004-x64

1

DLL Explor...32.exe

windows10-2004-x64

7

DLL Explor...64.exe

windows10-2004-x64

7

DLL UnInje...or.exe

windows10-2004-x64

1

Everything...ng.exe

windows10-2004-x64

7

Everything...up.exe

windows10-2004-x64

4

LastActivi...ew.exe

windows10-2004-x64

9

LastActivi...ew.bat

windows10-2004-x64

9

Lastproverka.bat

windows10-2004-x64

3

NirCMD 2.8...md.exe

windows10-2004-x64

9

NirCMD 2.8...xe.bat

windows10-2004-x64

9

NirCMD 2.8...xe.bat

windows10-2004-x64

9

OpenedFile...32.exe

windows10-2004-x64

9

OpenedFile...64.exe

windows10-2004-x64

8

Process Hacker 2.lnk

windows10-2004-x64

3

Recuva 1.5...le.exe

windows10-2004-x64

7

Shellbag_a...er.exe

windows10-2004-x64

10

USBDeview ...ew.exe

windows10-2004-x64

9

UserAssist...ew.exe

windows10-2004-x64

9

processhac...up.exe

windows10-2004-x64

7

Resubmissions

19-10-2023 11:09

231019-m9hf6agh68 10

Analysis

  • max time kernel
    601s
  • max time network
    453s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-ja
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-jalocale:ja-jpos:windows10-2004-x64systemwindows
  • submitted
    19-10-2023 11:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    LastActivityView 1.2.7/LastActivityView.exe

  • Size

    70KB

  • MD5

    25d9f5250c1b506f6c55acae76a2401f

  • SHA1

    180b24e28b9d81c2a9c3777a3d0b7add17e94e6d

  • SHA256

    5a66c173e3f604aecdcf63e45c8876289679030ec19b531e121c6b42cf064963

  • SHA512

    c9316d727043f88f9a117226b8218ef988596a478ec5af38d7043f10b5ffc10dccc10d7664b2583e099c2c4a69ab2427006d9404f18a1eedf11bf2e479990f87

  • SSDEEP

    1536:xZNZOm2wkLTYqzIvMCx6YfhNP4YbPXNCyk9Nvr1HhD6cJ8qbiQ:xXowkLTYNV6YfXhwy858cXX

Score
9/10
discoveryupx

Malware Config

Signatures

  • Nirsoft 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LastActivityView 1.2.7\LastActivityView.exe
    "C:\Users\Admin\AppData\Local\Temp\LastActivityView 1.2.7\LastActivityView.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:4324

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4324-0-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

    Download

  • memory/4324-1-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

    Download