Analysis

  • max time kernel
    278s
  • max time network
    315s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2023, 14:50

General

  • Target

    Activator/ConsoleAct_2.3.exe

  • Size

    856KB

  • MD5

    e5b2c576f778dbfd501d7b3dc29d1c89

  • SHA1

    0d7a583ace8a0c598dde33b0b4fc8c3b74111fbd

  • SHA256

    3bb2533f9465a9c3e8e0c4491a194fe139aefb0c75e91537fb2b1b59e66ec43a

  • SHA512

    dfbbff1cdef6412a448a4ea63796c3e09dc25bbbb163a9c1da38342478c2c31f2b7e4f6b184fb52b841c0540b859f871b3e3001bf8132fc6fcd81f6f57911aab

  • SSDEEP

    24576:nJr6ro7aR6pqUxfop9228fRrcoH3y/+3fT92:nJrb7aYYUx02227y/+PTU

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Activator\ConsoleAct_2.3.exe
    "C:\Users\Admin\AppData\Local\Temp\Activator\ConsoleAct_2.3.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1424
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\Activator\ConsoleAct_2.3.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4732
      • C:\Windows\System32\Wbem\WMIC.exe
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\Activator\ConsoleAct_2.3.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:444
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy C:\Windows\System32\Tasks\ConsoleAct "C:\Users\Admin\AppData\Local\Temp\ConsoleAct.tmp" /Y 2>&1
      2⤵
        PID:892
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\Activator\Act.dll"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1476
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\Activator\Act.dll"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2152
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\System32\SppExtComObjPatcher.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4408
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\System32\SppExtComObjPatcher.exe"
          3⤵
            PID:2508
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\System32\SppExtComObjHook.dll"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2248
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\System32\SppExtComObjHook.dll"
            3⤵
              PID:4832

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1424-0-0x0000000140000000-0x00000001401E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1424-1-0x0000000140000000-0x00000001401E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1424-4-0x0000000140000000-0x00000001401E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1424-5-0x0000000140000000-0x00000001401E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1424-6-0x0000000140000000-0x00000001401E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1424-8-0x0000000140000000-0x00000001401E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1424-9-0x0000000140000000-0x00000001401E4000-memory.dmp

          Filesize

          1.9MB