Resubmissions

15-07-2024 08:26

240715-kbwj1sxbnj 5

14-07-2024 18:49

240714-xgrjgavflh 10

Analysis

  • max time kernel
    146s
  • max time network
    156s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240709-en
  • resource tags

    arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15-07-2024 08:26

General

  • Target

    ActivationInstaller.exe

  • Size

    81.3MB

  • MD5

    957ba128368e4fa0302f26bcf8761d39

  • SHA1

    d392831805ce8ac2a7b08bf10450cae38cef26e6

  • SHA256

    d1666afed152ebffa4ee4708ae54b11324ae063804a370c712391afd5acbbb33

  • SHA512

    878fc9bd5a40b9cb1e99adda89b477d018f9acb1aa061cd270175d98e1dee6bcf890d56e01a6ec43ca44700b16ac073fa95e7edca392ed144d0a6cf90c9452f0

  • SSDEEP

    786432:FmiKbaiLD0QmiKbaiLD0QmiKbaiLD0QmiKbaiLD0QmiKbaiLD0QmiKbaiLD0QmiK:ssssssssss

Score
5/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Start PowerShell.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ActivationInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\ActivationInstaller.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:812
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4088
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Start-Process 'C:\Users\Admin\AppData\Roaming\22E45C8K.exe'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4192

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    fc2145b918cbccfc6b5914811f5e73cf

    SHA1

    d1e000f5b04c21d9d56f375cf059c12e3bed95f6

    SHA256

    038c3bb5d0eb6be91e89990cbc8a6582867959e52ee9efc8a5fcb0a863210cda

    SHA512

    38d79c9ab989032f666f988bfcd112a04a95321eb2610201013c3d6b0744dfa36e051136e9914a5a39e350e15a031b828818dd66b3f76adae59bfb3db4fc6fb4

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fexrfx5e.4wn.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\22E45C8K.exe

    Filesize

    4KB

    MD5

    cfbd5f1f0c062eed7ad58ab7e5644a33

    SHA1

    a19b1fe56a7352ccfe71441d2e54cd54f9f3237d

    SHA256

    7aaedcce3f05a91cd542ac7d48990ab890c3602c2345f5405f165f765d3b0778

    SHA512

    4f5fa484928f62aced79b1034e6665dd7dd94ce84350589c7fd8bf82a525937ec1e0f80e410cc4f600c2a807f07ee30f3a060dfded9bee99322fc4b967347ea0

  • memory/812-1-0x0000000000C60000-0x0000000000C6A000-memory.dmp

    Filesize

    40KB

  • memory/812-53-0x0000000074D60000-0x0000000075511000-memory.dmp

    Filesize

    7.7MB

  • memory/812-49-0x0000000074D60000-0x0000000075511000-memory.dmp

    Filesize

    7.7MB

  • memory/812-0-0x0000000074D6E000-0x0000000074D6F000-memory.dmp

    Filesize

    4KB

  • memory/4088-18-0x0000000005670000-0x00000000059C7000-memory.dmp

    Filesize

    3.3MB

  • memory/4088-41-0x0000000007180000-0x0000000007191000-memory.dmp

    Filesize

    68KB

  • memory/4088-14-0x0000000004EC0000-0x0000000004F26000-memory.dmp

    Filesize

    408KB

  • memory/4088-7-0x0000000004DB0000-0x0000000004DD2000-memory.dmp

    Filesize

    136KB

  • memory/4088-6-0x0000000074D60000-0x0000000075511000-memory.dmp

    Filesize

    7.7MB

  • memory/4088-19-0x0000000005B60000-0x0000000005B7E000-memory.dmp

    Filesize

    120KB

  • memory/4088-20-0x0000000005C10000-0x0000000005C5C000-memory.dmp

    Filesize

    304KB

  • memory/4088-21-0x0000000006B60000-0x0000000006BA6000-memory.dmp

    Filesize

    280KB

  • memory/4088-22-0x0000000007510000-0x0000000007B8A000-memory.dmp

    Filesize

    6.5MB

  • memory/4088-23-0x0000000006EC0000-0x0000000006EDA000-memory.dmp

    Filesize

    104KB

  • memory/4088-25-0x0000000070EA0000-0x0000000070EEC000-memory.dmp

    Filesize

    304KB

  • memory/4088-26-0x00000000710D0000-0x0000000071427000-memory.dmp

    Filesize

    3.3MB

  • memory/4088-24-0x0000000006FF0000-0x0000000007024000-memory.dmp

    Filesize

    208KB

  • memory/4088-37-0x0000000007050000-0x00000000070F4000-memory.dmp

    Filesize

    656KB

  • memory/4088-36-0x0000000074D60000-0x0000000075511000-memory.dmp

    Filesize

    7.7MB

  • memory/4088-35-0x0000000007030000-0x000000000704E000-memory.dmp

    Filesize

    120KB

  • memory/4088-38-0x0000000074D60000-0x0000000075511000-memory.dmp

    Filesize

    7.7MB

  • memory/4088-39-0x0000000007150000-0x000000000715A000-memory.dmp

    Filesize

    40KB

  • memory/4088-40-0x0000000007210000-0x00000000072A6000-memory.dmp

    Filesize

    600KB

  • memory/4088-13-0x0000000004E50000-0x0000000004EB6000-memory.dmp

    Filesize

    408KB

  • memory/4088-42-0x00000000071D0000-0x00000000071DE000-memory.dmp

    Filesize

    56KB

  • memory/4088-43-0x00000000071E0000-0x00000000071F5000-memory.dmp

    Filesize

    84KB

  • memory/4088-44-0x00000000072D0000-0x00000000072EA000-memory.dmp

    Filesize

    104KB

  • memory/4088-45-0x00000000072B0000-0x00000000072B8000-memory.dmp

    Filesize

    32KB

  • memory/4088-48-0x0000000074D60000-0x0000000075511000-memory.dmp

    Filesize

    7.7MB

  • memory/4088-5-0x0000000074D60000-0x0000000075511000-memory.dmp

    Filesize

    7.7MB

  • memory/4088-4-0x0000000005040000-0x000000000566A000-memory.dmp

    Filesize

    6.2MB

  • memory/4088-3-0x0000000074D60000-0x0000000075511000-memory.dmp

    Filesize

    7.7MB

  • memory/4088-2-0x0000000002320000-0x0000000002356000-memory.dmp

    Filesize

    216KB

  • memory/4192-55-0x0000000074D60000-0x0000000075511000-memory.dmp

    Filesize

    7.7MB

  • memory/4192-56-0x0000000074D60000-0x0000000075511000-memory.dmp

    Filesize

    7.7MB

  • memory/4192-65-0x0000000005600000-0x0000000005957000-memory.dmp

    Filesize

    3.3MB

  • memory/4192-66-0x0000000005F60000-0x0000000005FAC000-memory.dmp

    Filesize

    304KB

  • memory/4192-67-0x0000000005ED0000-0x0000000005EF2000-memory.dmp

    Filesize

    136KB

  • memory/4192-68-0x0000000007060000-0x0000000007606000-memory.dmp

    Filesize

    5.6MB

  • memory/4192-54-0x0000000074D60000-0x0000000075511000-memory.dmp

    Filesize

    7.7MB

  • memory/4192-71-0x0000000074D60000-0x0000000075511000-memory.dmp

    Filesize

    7.7MB