Analysis
-
max time kernel
150s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15-07-2024 08:26
Static task
static1
Behavioral task
behavioral1
Sample
ActivationInstaller.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ActivationInstaller.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
ActivationInstaller.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral4
Sample
ActivationInstaller.exe
Resource
win11-20240709-en
General
-
Target
ActivationInstaller.exe
-
Size
81.3MB
-
MD5
957ba128368e4fa0302f26bcf8761d39
-
SHA1
d392831805ce8ac2a7b08bf10450cae38cef26e6
-
SHA256
d1666afed152ebffa4ee4708ae54b11324ae063804a370c712391afd5acbbb33
-
SHA512
878fc9bd5a40b9cb1e99adda89b477d018f9acb1aa061cd270175d98e1dee6bcf890d56e01a6ec43ca44700b16ac073fa95e7edca392ed144d0a6cf90c9452f0
-
SSDEEP
786432:FmiKbaiLD0QmiKbaiLD0QmiKbaiLD0QmiKbaiLD0QmiKbaiLD0QmiKbaiLD0QmiK:ssssssssss
Malware Config
Signatures
-
pid Process 2212 powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4584 powershell.exe 4584 powershell.exe 2212 powershell.exe 2212 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4584 powershell.exe Token: SeDebugPrivilege 2380 ActivationInstaller.exe Token: SeDebugPrivilege 2212 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2380 wrote to memory of 4584 2380 ActivationInstaller.exe 84 PID 2380 wrote to memory of 4584 2380 ActivationInstaller.exe 84 PID 2380 wrote to memory of 4584 2380 ActivationInstaller.exe 84 PID 2380 wrote to memory of 2212 2380 ActivationInstaller.exe 86 PID 2380 wrote to memory of 2212 2380 ActivationInstaller.exe 86 PID 2380 wrote to memory of 2212 2380 ActivationInstaller.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\ActivationInstaller.exe"C:\Users\Admin\AppData\Local\Temp\ActivationInstaller.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4584
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Start-Process 'C:\Users\Admin\AppData\Roaming\Z4P14FPR.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2212
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5a6ea7bfcd3aac150c0caef765cb52281
SHA1037dc22c46a0eb0b9ad4c74088129e387cffe96b
SHA256f019af2e5e74cdf13c963910500f9436c66b6f2901f5056d72f82310f20113b9
SHA512c8d2d373b48a26cf6eec1f5cfc05819011a3fc49d863820ad07b6442dd6d5f64e27022a9e4c381eb58bf7f6b19f8e77d508734ff803073ec2fb32da9081b6f23
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD583216732016d62f34d7d3ca7404666d1
SHA17d3161195380efaa712b03bf2a15422c8f3cbdcd
SHA256ba7351ea66a8b26ce734309001a24420bfce37d7bf7063092020b1c0c661ee1f
SHA512fbf47dcb079376c9358a0409cb4d749c0e50123e20373eae110d85b65dac2acfdcacd40edb1fecf7e7902d11592599db1366e1ccd4ee7ff1bdfe44ac77d04048