4051d791566f289683ee377effd774a80b7eb2b251e604e3eeabf923d75c0c98

Resubmissions

19-10-2023 11:09

231019-m9hf6agh68 10

Analysis

max time kernel
435s
max time network
452s
platform
windows10-2004_x64
resource
win10v2004-20230915-ja
resource tags

arch:x64arch:x86image:win10v2004-20230915-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
19-10-2023 11:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LastActivityView 1.2.7/Сохранить отчет LastActivityView.bat
Size

100B
MD5

fee395eb478f2f4e7645d82bf48c3fd8
SHA1

69fab669e47201d349128648519ab57067d8bd74
SHA256

f51c87997520b087f73e80a0809352a9824c65406c903b91ee4abb12216b88bb
SHA512

1197b01afeca3aec71f17278f0a4e7d6a4ba7c859a9f8a14b9cec02dcfbe4daf2e055ab2a81c4f080efd2ecc55c7844459d80cb5462b4eb83332b6866c963c06

Score

9^/10

upx

Malware Config

Signatures

Nirsoft 1 IoCs

resource	yara_rule
behavioral8/memory/1780-2-0x0000000000400000-0x0000000000432000-memory.dmp	Nirsoft

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral8/memory/1780-0-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral8/memory/1780-2-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeBackupPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeBackupPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe
Token: SeSecurityPrivilege	1780	LastActivityView.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 4952	1156	cmd.exe	86
PID 1156 wrote to memory of 4952	1156	cmd.exe	86
PID 1156 wrote to memory of 1780	1156	cmd.exe	87
PID 1156 wrote to memory of 1780	1156	cmd.exe	87
PID 1156 wrote to memory of 1780	1156	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\LastActivityView 1.2.7\Сохранить отчет LastActivityView.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\system32\chcp.com
  chcp 1251
  2⤵
  PID:4952
- C:\Users\Admin\AppData\Local\Temp\LastActivityView 1.2.7\LastActivityView.exe
  LastActivityView.exe /sverhtml "SXUYPNET#Admin Отчет LAV.html"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1780-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1780-2-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download