Resubmissions

15-07-2024 08:26

240715-kbwj1sxbnj 5

14-07-2024 18:49

240714-xgrjgavflh 10

Analysis

  • max time kernel
    128s
  • max time network
    135s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15-07-2024 08:26

General

  • Target

    ActivationInstaller.exe

  • Size

    81.3MB

  • MD5

    957ba128368e4fa0302f26bcf8761d39

  • SHA1

    d392831805ce8ac2a7b08bf10450cae38cef26e6

  • SHA256

    d1666afed152ebffa4ee4708ae54b11324ae063804a370c712391afd5acbbb33

  • SHA512

    878fc9bd5a40b9cb1e99adda89b477d018f9acb1aa061cd270175d98e1dee6bcf890d56e01a6ec43ca44700b16ac073fa95e7edca392ed144d0a6cf90c9452f0

  • SSDEEP

    786432:FmiKbaiLD0QmiKbaiLD0QmiKbaiLD0QmiKbaiLD0QmiKbaiLD0QmiKbaiLD0QmiK:ssssssssss

Score
5/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Start PowerShell.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ActivationInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\ActivationInstaller.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2772
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3164
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Start-Process 'C:\Users\Admin\AppData\Roaming\8FXIE3BP.exe'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4008

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    393663b501f5957d52ebb27691c155f6

    SHA1

    bb67fdbf7860455fd523d516c787e51ba69f7bcb

    SHA256

    e1f4889095e298d71e7279bc2e0a519102fd20b92efa9ee7b6c505d2f25582ef

    SHA512

    235fee61dbe63f5382dd26908ae9a14232fc52cebdbf4f74c7fc6d29b31f6eedebd2bb3f8c2012cfbf4fafb48985936912681cfe3896d50a640d5c8331491e4c

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d4ic5rdh.uco.ps1

    Filesize

    1B

    MD5

    c4ca4238a0b923820dcc509a6f75849b

    SHA1

    356a192b7913b04c54574d18c28d46e6395428ab

    SHA256

    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

    SHA512

    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

  • C:\Users\Admin\AppData\Roaming\8FXIE3BP.exe

    Filesize

    4KB

    MD5

    c32374da6c6ebe950a259a2eb2ea9398

    SHA1

    4842e725800143ea9d9e2e6123f0082a882f7fa3

    SHA256

    cff96adb2b8d25f078a51866397459e686dbc95b0fdc477fe5eea86ccd09aa1c

    SHA512

    72809956360dbc978a11be219187d4f0e7db79ce3d727da3fddb7537f0fe9ba4b97f97f201815c38500556e0e09fe962b274519db23bfcab9adbefbfc63510ad

  • memory/2772-1-0x0000000000D30000-0x0000000000D3A000-memory.dmp

    Filesize

    40KB

  • memory/2772-311-0x0000000074050000-0x000000007473E000-memory.dmp

    Filesize

    6.9MB

  • memory/2772-305-0x0000000074050000-0x000000007473E000-memory.dmp

    Filesize

    6.9MB

  • memory/2772-0-0x000000007405E000-0x000000007405F000-memory.dmp

    Filesize

    4KB

  • memory/3164-78-0x0000000070D10000-0x0000000070D5B000-memory.dmp

    Filesize

    300KB

  • memory/3164-81-0x0000000009E60000-0x0000000009E7E000-memory.dmp

    Filesize

    120KB

  • memory/3164-12-0x0000000074050000-0x000000007473E000-memory.dmp

    Filesize

    6.9MB

  • memory/3164-11-0x0000000007BA0000-0x0000000007EF0000-memory.dmp

    Filesize

    3.3MB

  • memory/3164-13-0x0000000007AF0000-0x0000000007B0C000-memory.dmp

    Filesize

    112KB

  • memory/3164-14-0x0000000008380000-0x00000000083CB000-memory.dmp

    Filesize

    300KB

  • memory/3164-10-0x0000000007A50000-0x0000000007AB6000-memory.dmp

    Filesize

    408KB

  • memory/3164-33-0x0000000008EF0000-0x0000000008F2C000-memory.dmp

    Filesize

    240KB

  • memory/3164-64-0x0000000008FB0000-0x0000000009026000-memory.dmp

    Filesize

    472KB

  • memory/3164-69-0x000000000A3A0000-0x000000000AA18000-memory.dmp

    Filesize

    6.5MB

  • memory/3164-70-0x0000000009D40000-0x0000000009D5A000-memory.dmp

    Filesize

    104KB

  • memory/3164-8-0x00000000070B0000-0x00000000070D2000-memory.dmp

    Filesize

    136KB

  • memory/3164-77-0x0000000009E80000-0x0000000009EB3000-memory.dmp

    Filesize

    204KB

  • memory/3164-80-0x0000000074050000-0x000000007473E000-memory.dmp

    Filesize

    6.9MB

  • memory/3164-79-0x0000000070D60000-0x00000000710B0000-memory.dmp

    Filesize

    3.3MB

  • memory/3164-9-0x0000000007150000-0x00000000071B6000-memory.dmp

    Filesize

    408KB

  • memory/3164-86-0x0000000009EC0000-0x0000000009F65000-memory.dmp

    Filesize

    660KB

  • memory/3164-87-0x0000000074050000-0x000000007473E000-memory.dmp

    Filesize

    6.9MB

  • memory/3164-88-0x000000000A0A0000-0x000000000A134000-memory.dmp

    Filesize

    592KB

  • memory/3164-281-0x000000000A030000-0x000000000A04A000-memory.dmp

    Filesize

    104KB

  • memory/3164-286-0x000000000A020000-0x000000000A028000-memory.dmp

    Filesize

    32KB

  • memory/3164-304-0x0000000074050000-0x000000007473E000-memory.dmp

    Filesize

    6.9MB

  • memory/3164-7-0x0000000074050000-0x000000007473E000-memory.dmp

    Filesize

    6.9MB

  • memory/3164-5-0x0000000074050000-0x000000007473E000-memory.dmp

    Filesize

    6.9MB

  • memory/3164-6-0x00000000071D0000-0x00000000077F8000-memory.dmp

    Filesize

    6.2MB

  • memory/3164-4-0x0000000004640000-0x0000000004676000-memory.dmp

    Filesize

    216KB

  • memory/4008-313-0x0000000008370000-0x00000000083BB000-memory.dmp

    Filesize

    300KB

  • memory/4008-328-0x00000000094A0000-0x00000000094C2000-memory.dmp

    Filesize

    136KB

  • memory/4008-329-0x0000000009D10000-0x000000000A20E000-memory.dmp

    Filesize

    5.0MB

  • memory/4008-312-0x0000000008020000-0x0000000008370000-memory.dmp

    Filesize

    3.3MB