a55b716b1f4a69e66001ad035e651ce84407a79611128b643738c6a40dbf2956

Analysis

max time kernel
96s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20240220-en
resource tags

arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Activation.exe
Size 703KB
Sample240220-nd6pjsfd3y
SHA256 a55b716b1f4a69e66001ad035e651ce84407a79611128b643738c6a40dbf2956
MD5 dbc21bad0ecf7ecc4050b98c725ce0ba
SHA1 ecf2c8f91a75434b57458d5834b75b322a7039bb
SHA512 5c23aac6a8dc66171a6fdeb47bfe8db94761dff615dfe02411f65de0785917b729de55a697157dfb3b40cbcc5af7f94e3363d9c3b89006d6e0173e01af3d8a2b
SSDEEP 6144:5UPAUV624Zk+nC+f8Z7DgMvVXYNlV8F/2/6utZeiXhOy8oMmkCOutH5BysohXEwm:5mV620nN8ZoAutZeiXhOBuOaBTo64ZY
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 3 IoCs

exploit

pid	Process
3128	takeown.exe
4072	icacls.exe
2872	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4023562663-3911442808-1494947993-1000\Control Panel\International\Geo\Nation	cmd.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3128	takeown.exe
4072	icacls.exe
2872	icacls.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\IME\permissions.bat	Activation.exe
File created	C:\Windows\IME\reset.bat	Activation.exe
File created	C:\Windows\IME\activator.bat	Activation.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3168	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4023562663-3911442808-1494947993-1000_Classes\Local Settings	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1516	powershell.exe
1516	powershell.exe
404	powershell.exe
404	powershell.exe
888	powershell.exe
888	powershell.exe
4164	powershell.exe
4164	powershell.exe
1128	powershell.exe
1128	powershell.exe
4528	powershell.exe
4528	powershell.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3128	takeown.exe
Token: SeDebugPrivilege	1516	powershell.exe
Token: SeDebugPrivilege	404	powershell.exe
Token: SeDebugPrivilege	888	powershell.exe
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeBackupPrivilege	1128	powershell.exe
Token: SeBackupPrivilege	1128	powershell.exe
Token: SeRestorePrivilege	1128	powershell.exe
Token: SeSecurityPrivilege	1128	powershell.exe
Token: SeDebugPrivilege	4528	powershell.exe
Token: SeBackupPrivilege	4528	powershell.exe
Token: SeBackupPrivilege	4528	powershell.exe
Token: SeRestorePrivilege	4528	powershell.exe
Token: SeSecurityPrivilege	4528	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 4392	1176	Activation.exe	85
PID 1176 wrote to memory of 4392	1176	Activation.exe	85
PID 1176 wrote to memory of 1404	1176	Activation.exe	86
PID 1176 wrote to memory of 1404	1176	Activation.exe	86
PID 1176 wrote to memory of 3832	1176	Activation.exe	87
PID 1176 wrote to memory of 3832	1176	Activation.exe	87
PID 1176 wrote to memory of 4760	1176	Activation.exe	88
PID 1176 wrote to memory of 4760	1176	Activation.exe	88
PID 1176 wrote to memory of 3652	1176	Activation.exe	89
PID 1176 wrote to memory of 3652	1176	Activation.exe	89
PID 1176 wrote to memory of 4988	1176	Activation.exe	90
PID 1176 wrote to memory of 4988	1176	Activation.exe	90
PID 1176 wrote to memory of 5080	1176	Activation.exe	91
PID 1176 wrote to memory of 5080	1176	Activation.exe	91
PID 1176 wrote to memory of 2820	1176	Activation.exe	92
PID 1176 wrote to memory of 2820	1176	Activation.exe	92
PID 1176 wrote to memory of 2948	1176	Activation.exe	93
PID 1176 wrote to memory of 2948	1176	Activation.exe	93
PID 1176 wrote to memory of 5016	1176	Activation.exe	94
PID 1176 wrote to memory of 5016	1176	Activation.exe	94
PID 1176 wrote to memory of 2928	1176	Activation.exe	95
PID 1176 wrote to memory of 2928	1176	Activation.exe	95
PID 1176 wrote to memory of 2864	1176	Activation.exe	96
PID 1176 wrote to memory of 2864	1176	Activation.exe	96
PID 1176 wrote to memory of 2288	1176	Activation.exe	100
PID 1176 wrote to memory of 2288	1176	Activation.exe	100
PID 1176 wrote to memory of 1988	1176	Activation.exe	101
PID 1176 wrote to memory of 1988	1176	Activation.exe	101
PID 1176 wrote to memory of 3940	1176	Activation.exe	102
PID 1176 wrote to memory of 3940	1176	Activation.exe	102
PID 1176 wrote to memory of 5032	1176	Activation.exe	103
PID 1176 wrote to memory of 5032	1176	Activation.exe	103
PID 5032 wrote to memory of 3128	5032	cmd.exe	104
PID 5032 wrote to memory of 3128	5032	cmd.exe	104
PID 5032 wrote to memory of 4072	5032	cmd.exe	105
PID 5032 wrote to memory of 4072	5032	cmd.exe	105
PID 5032 wrote to memory of 2872	5032	cmd.exe	106
PID 5032 wrote to memory of 2872	5032	cmd.exe	106
PID 1176 wrote to memory of 664	1176	Activation.exe	107
PID 1176 wrote to memory of 664	1176	Activation.exe	107
PID 1176 wrote to memory of 2136	1176	Activation.exe	108
PID 1176 wrote to memory of 2136	1176	Activation.exe	108
PID 1176 wrote to memory of 4728	1176	Activation.exe	109
PID 1176 wrote to memory of 4728	1176	Activation.exe	109
PID 4728 wrote to memory of 1516	4728	cmd.exe	110
PID 4728 wrote to memory of 1516	4728	cmd.exe	110
PID 1176 wrote to memory of 5012	1176	Activation.exe	111
PID 1176 wrote to memory of 5012	1176	Activation.exe	111
PID 5012 wrote to memory of 404	5012	cmd.exe	112
PID 5012 wrote to memory of 404	5012	cmd.exe	112
PID 1176 wrote to memory of 4832	1176	Activation.exe	114
PID 1176 wrote to memory of 4832	1176	Activation.exe	114
PID 4832 wrote to memory of 888	4832	cmd.exe	113
PID 4832 wrote to memory of 888	4832	cmd.exe	113
PID 1176 wrote to memory of 4704	1176	Activation.exe	115
PID 1176 wrote to memory of 4704	1176	Activation.exe	115
PID 4704 wrote to memory of 4164	4704	cmd.exe	116
PID 4704 wrote to memory of 4164	4704	cmd.exe	116
PID 1176 wrote to memory of 1824	1176	Activation.exe	117
PID 1176 wrote to memory of 1824	1176	Activation.exe	117
PID 1824 wrote to memory of 1128	1824	cmd.exe	118
PID 1824 wrote to memory of 1128	1824	cmd.exe	118
PID 1176 wrote to memory of 1768	1176	Activation.exe	119
PID 1176 wrote to memory of 1768	1176	Activation.exe	119

C:\Users\Admin\AppData\Local\Temp\Activation.exe
"C:\Users\Admin\AppData\Local\Temp\Activation.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c title Windows Activation Fix
  2⤵
  PID:4392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 0b
  2⤵
  PID:1404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  PID:3832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo This tool will fix your Windows Activation
  2⤵
  PID:4760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  PID:3652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  PID:4988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  PID:5080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo MadeBY N3K4A#9315
  2⤵
  PID:2820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  PID:2948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo.
  2⤵
  PID:2928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:2864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo Starting...
  2⤵
  PID:3940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c %windir%\IME\permissions.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\system32\takeown.exe
    takeown /F C:\Windows\System32\sppsvc.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3128
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32 /grant administrators:F /T
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4072
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\spp /grant administrators:F /T
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo Applying permissions...
  2⤵
  PID:2136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe -c $acl = Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -AclObject $acl
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c $acl = Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -AclObject $acl
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe -c $acl = Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP' -AclObject $acl
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c $acl = Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP' -AclObject $acl
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe -c $acl = Get-Acl 'HKLM:\SYSTEM\CurrentControlSet\Services\SPPSVC'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\SPPSVC' -AclObject $acl
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe -c $acl = Get-Acl 'HKLM:\SYSTEM\WPA'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SYSTEM\WPA' -AclObject $acl
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c $acl = Get-Acl 'HKLM:\SYSTEM\WPA'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SYSTEM\WPA' -AclObject $acl
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe -c $acl = Get-Acl '%windir%\System32'; $rule = New-Object System.Security.AccessControl.FileSystemAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path '%windir%\System32' -AclObject $acl
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c $acl = Get-Acl 'C:\Windows\System32'; $rule = New-Object System.Security.AccessControl.FileSystemAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'C:\Windows\System32' -AclObject $acl
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe -c $acl = Get-Acl '%windir%\System32\spp'; $rule = New-Object System.Security.AccessControl.FileSystemAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path '%windir%\System32\spp' -AclObject $acl
  2⤵
  PID:1768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c $acl = Get-Acl 'C:\Windows\System32\spp'; $rule = New-Object System.Security.AccessControl.FileSystemAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'C:\Windows\System32\spp' -AclObject $acl
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c %windir%\IME\reset.bat
  2⤵
  PID:3360
- - C:\Windows\system32\net.exe
    net stop sppsvc
    3⤵
    PID:4332
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sppsvc
      4⤵
      PID:4328
- - C:\Windows\system32\net.exe
    net start sppsvc
    3⤵
    PID:3140
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start sppsvc
      4⤵
      PID:2120
- - C:\Windows\system32\cscript.exe
    cscript.exe C:\Windows\System32\slmgr.vbs /rilc
    3⤵
    PID:2508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c %windir%\IME\activator.bat
  2⤵
  - Checks computer location settings
  - Modifies registry class
  PID:1520
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" //B /ipk W269N-WFGWX-YVC9B-4J6C9-T83GX
    3⤵
    PID:3132
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" //B /skms kms8.msguides.com
    3⤵
    PID:1788
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" //B /ato
    3⤵
    PID:1880
- - C:\Windows\system32\timeout.exe
    timeout /T 3 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:3168

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -c $acl = Get-Acl 'HKLM:\SYSTEM\CurrentControlSet\Services\SPPSVC'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\SPPSVC' -AclObject $acl
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:888

C:\Windows\system32\winver.exe
"C:\Windows\system32\winver.exe"
1⤵
PID:756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact