Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
15-07-2024 08:26
Static task
static1
Behavioral task
behavioral1
Sample
ActivationInstaller.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ActivationInstaller.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
ActivationInstaller.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral4
Sample
ActivationInstaller.exe
Resource
win11-20240709-en
General
-
Target
ActivationInstaller.exe
-
Size
81.3MB
-
MD5
957ba128368e4fa0302f26bcf8761d39
-
SHA1
d392831805ce8ac2a7b08bf10450cae38cef26e6
-
SHA256
d1666afed152ebffa4ee4708ae54b11324ae063804a370c712391afd5acbbb33
-
SHA512
878fc9bd5a40b9cb1e99adda89b477d018f9acb1aa061cd270175d98e1dee6bcf890d56e01a6ec43ca44700b16ac073fa95e7edca392ed144d0a6cf90c9452f0
-
SSDEEP
786432:FmiKbaiLD0QmiKbaiLD0QmiKbaiLD0QmiKbaiLD0QmiKbaiLD0QmiKbaiLD0QmiK:ssssssssss
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2268 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2268 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1116 wrote to memory of 2268 1116 ActivationInstaller.exe 31 PID 1116 wrote to memory of 2268 1116 ActivationInstaller.exe 31 PID 1116 wrote to memory of 2268 1116 ActivationInstaller.exe 31 PID 1116 wrote to memory of 2268 1116 ActivationInstaller.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\ActivationInstaller.exe"C:\Users\Admin\AppData\Local\Temp\ActivationInstaller.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2268
-