1ab7b5aa280179b9f9550489c61512cbfd23219d31bbcbc9955340573323fd2e

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 05:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SS Tool [Extract]/LastActivityViewer/LastActivityView.exe
Size

122KB
MD5

f94427f289819c831207cb83db695700
SHA1

0a4cd2ea25a367a0df9b51334381596ea01afe14
SHA256

c5b25c15362003468656f9e7b11434e4743c4a0eb1a1ef61b0e9d9d42a8aab69
SHA512

a556ba69d41bd49c95d78100b387f4f8af66f388f2a92df815c23854be3d3dd8b4a5801eb75b8c6d4b9fd3d6d2757591c45fcafcc5bb9c11ce39e3ac082882c2
SSDEEP

1536:WUkw0dXNQ9FMXY2fO6OqYMLbz5+a4sk0wtSJazjc2shDW1v7aH5iqbiQ:UTHQ9FMXrfO6ObM9V4MwtQQL1v7I5bX

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

LastActivityView.exe

pid process

1740 LastActivityView.exe

pid	process
1740	LastActivityView.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

LastActivityView.exe

description	pid	process
Token: SeBackupPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeBackupPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeBackupPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe
Token: SeSecurityPrivilege	1740	LastActivityView.exe

C:\Users\Admin\AppData\Local\Temp\SS Tool [Extract]\LastActivityViewer\LastActivityView.exe
"C:\Users\Admin\AppData\Local\Temp\SS Tool [Extract]\LastActivityViewer\LastActivityView.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1740

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads