Analysis
-
max time kernel
34s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 00:57
General
-
Target
DG_MSActivator.exe
-
Size
15.6MB
-
MD5
1c36d0bfc25cb44b08a33a014bb349d8
-
SHA1
434b5b0f4c3dac53890ba503ee13fbfdc0209cfa
-
SHA256
b800105d30813807305d2649378669aceed89d948cdc044517f24910bac5b4c6
-
SHA512
c9a1f4df940d8c010cee37c3fa3625a30e2eaf7637d68f22373ef1499ef5445f67c59e2bfb723c7fe607c31e04d6194541ebca8fcd7c242cdc0138f2a2cdae1f
-
SSDEEP
393216:nC2gPsUHF5pzIsk5U3KL5z1IatTQ853RlmHbKwMHxzhzxiZ:nCzIlq3KLJZWOxH9lg
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DG_MSActivator.exe"C:\Users\Admin\AppData\Local\Temp\DG_MSActivator.exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ApplicationFrameHelperRunner.exe"C:\Users\Admin\AppData\Local\Temp\ApplicationFrameHelperRunner.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ApplicationFrameHelper.exe"ApplicationFrameHelper.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD54c40cd83b86fd96de9382f02b4d6f64c
SHA120a62b4229292d2709e6e20aa1fa95fb3ff9fcd2
SHA2565792e1966beb02ddfd5dcf6ce1cdd83bdc6cbf6ce787e95c69dac58a4927f233
SHA5121d5133554a043e8d47ea494636efcab9a877be344270be79cdb322832ceed2dee26f747b2cbdb6452f09f612ef874adc4ad0725b30d7bfc70ee61a2b209c9148
-
Filesize
2KB
MD5196ef26e37664e710726075010b550d7
SHA1394e1cdbca381b22e0537e04492d04efc308a1b6
SHA2569f28209d595e25f85a87add2abe381542a3b0e42e99985ab5ab74f54f1bd6cc1
SHA512a4bc80214af704ebea39d0dbdd2d3187022320103995a4731df05e525f9bab261660634412baf1ed357259295ddb4e1048393ed4ceffd53411027bc978e57dd4
-
Filesize
1KB
MD5308eb3c54471c9a486e8bab221baeb8d
SHA1b92383ceab061ef4e305afdbb7196233594d7225
SHA256e70182fa4140117c0c06ae7322b87de257acf7a51a328e85b6f1b8303180790c
SHA512c7428c6ad98be175580d598d8667140a582810015fbf3af3d72fd372e8f0457785a23bccea479e3f4571ae7cbbe2089f3af49f512d95a8d424818d252c00e199
-
Filesize
2KB
MD57d1178c8121f05435e98bbede99aee0f
SHA1c865749460acf9a01daac12082634a7cf8297fbc
SHA256d1e04210299be25cf90c72872339130dcc59781375e4ab75937d1b79b04077cc
SHA51279d35cda06db07889d4e0d675747c68c5095022b2a209724ba63b5c3160765bcd911fb90b032a69580da3da9ed53be045a2f1967b0db07b147253ab666156bae
-
Filesize
1KB
MD504502ace94066e4d88cd5a178d76beb8
SHA19b19743a8c97cedad82083c7c858a64fdb17e3ff
SHA256f45b13c9ba2694bb35da494e9b87a0c2aee471a1f4dc34c566c1472e6f4d4547
SHA51295f219450523e5eb495ab3fe88e59d71ce34685db23457aa89118a7a54626dabc50865863b845a3714e46710d1f50ed1d1c6d0b406327edb2e6bbd31986c3e84
-
Filesize
1KB
MD5f23eca8f41873211bdc8196d89cc8d1a
SHA1dba0637ccb059ded23aa6b43b2ad51bae2a2912a
SHA25662cd5310c2aa451f968b0536a3c436a2f85410a526fd7de4cacbe604b40261d7
SHA5123d47c372836f30f69f4d7d4901ab93b2875105686c0e81362d61fe279ee3b68514f47cf99dadaed21885f11884e96310e5d5bcc9667bc51da523ec9a4a1b1d21
-
Filesize
2KB
MD59a9b81e00b128cbaad769c47d1ec58b9
SHA132fc6ef7c7fdf56a0eb50b27ff213eb633f3df12
SHA25607ef8b4b9a05d18eab20d53d275a19df2fd4deab8ff03ab4f8089b146a6d92d5
SHA51246e8f4322b40b18078d00b02fe6834b481c527af409df46f487638f5a4558aa0d71e0ddd0a28c655bf58830e1b7b0a4f827ad36c35a427a6822321a3955a8c7b
-
Filesize
1KB
MD58cad8b00f28bc937a92571d0230add1b
SHA10a153e1396cd32ae3057e663b3732752e8144773
SHA2561ed9e4b5ed2108e9acf830133662e43810a0552b2a5ed92b84414d846c04a785
SHA51261f11317a82d0868597a6974f0d20cb1a2526705db179ce1678d54265400393b15cc23a398bd10539370d9be2e827aea683093cda9c670345c84236247ffdeaf
-
Filesize
823B
MD56d1af2da69efe7c699d64251a913ff2f
SHA12cfd10f1da663386c98e62ff18d8c0ab851ccb75
SHA256801759250ed08e1b525d7920b85156b6070e67c8ba207fa9d1897797040a507e
SHA512d84b7c7add8db65f67fb825d6c0bfeeecc931c3d87cc2b42a059f517c79e6cb055776025dabe8da36deb70f3da334f6794b03c570d4311933b5129bab11901a2
-
Filesize
1KB
MD54f072c7da01355b4046c9a6191a5a983
SHA18348ab758fc941d9b3d859adf04654ad901fa696
SHA256d28ebeeabc2017f4bdb7bf8d3ab118d4a5d7a40facab253bf86e982a8a20d7a9
SHA51241684cfcc4b6abff8cbf2042a96ae6fe54c22d904e9d5bfc2f7df8525155c280154eae3d2549a636f26603bb948f223be468de70c7618b853d7ed5fb0c767d75
-
Filesize
2KB
MD564cdfa6d4cd120332bdc93431f7c7bf6
SHA1c0b732e690b7d29097f27d35d40b592ccdf01d8e
SHA256830ab27c5d6861ec6103c7e4b3bed3276f099f33706c7484b0519bc94cf28ca0
SHA51208dc85eeac06d59fa9d7a52ee0aa649c00f15b06027a34509fd1fe31bf45b4e693d622ad14f583af0752be059dedd96d1aecb637725c115dd0b233eaa40b7983
-
Filesize
2KB
MD57b94496ec6775d315e1f3a1b4cf226b1
SHA102f75de7be73fa8d82b2636364282d8239898820
SHA25683b7c915ac6ff1296cb516525b6f4e7dcfeb6e1cb5915d2371a68e3b1bd624ad
SHA512eb287fb1d978ebc0ed9667ba4456d3e2ca568b0e2b4a0bafb2a0c849e5c3edccb1718f50a157fe141d7939177d01e7b1727582c59567fc85a2b487e738a2fd05
-
Filesize
1KB
MD54b3cc5324a4efd06e19edd5ba71f92a4
SHA1a9ad0d096a4cf547bfdb4f64425fc197cda849a9
SHA2560636145c712a8f0d133185b9ecf5a3792e11fb114ff80867d4f1716cc79bd18b
SHA512b9f3a176b09dcff0449470a3c03343a817f66992dde9f727e57b95db2d9decc25e6a148da0a2b30815a0a48691aebd855e5672bf40a6a8b16c0668445c8dac3c
-
Filesize
950B
MD5892cad5a019cdd24e04e8cb2ffd5639f
SHA1f2f6af24de896165e74ee211057868ee62e5be47
SHA256ab5348f27dbed4b7ea607273a3ec4220a488c186f79ba538f6e2bfbbff4a1d86
SHA5126cdfe6ff7e44ce7b80d413553b37a7cd635c37227583400ecf6b624a7a69e0e42853ad49713906fd081a02335bd9271976e3534b2dee8a8a6e14352b0c67611c
-
Filesize
9KB
MD57f91015a9b34463eea988337dac26d1f
SHA12b7d7d4da90ee1dadabcde3c2805426452af0be4
SHA256b990f85fa409ea574dec43b2029b73ce12042ae59474779ce24dba8e26a562f9
SHA512a23c63034333927cc1df631d1614a9aa26e387d7f190d54261e102a0119c3460e1aee80bf2238acc7dd12145bd7e4c0a6fe303a25a5d0263b393572f3acc1480
-
Filesize
7KB
MD5bc1f046c706c9c6840754f6c59140102
SHA174310a097db99ab74dd6024530f499e621c141db
SHA256cec8d87f3cba247acdbc2b59274ca5a08a2082da927a5fdbf9f9c9b9c11ecab9
SHA51244a8bf0c335a4be87e3db2fd5d6367035ae3f4fd8ba0128526982d9a50f199b3ba38dc75d1a233bbb952ef5d7d926fe9db2e1cd3d8df61b58d61162f63c0cd69
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
136KB
-
Filesize
8KB
-
Filesize
672KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
656KB
-
Filesize
10.8MB
-
Filesize
33.7MB
-
Filesize
10.8MB
-
Filesize
40KB
-
Filesize
15.6MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
5.6MB