Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-08-2024 22:58

General

  • Target

    ReActiveMe.exe

  • Size

    149KB

  • MD5

    9e4e14cf1ab81480a83d489901f4d0ec

  • SHA1

    f6f628a311d07060743187a29f9f21ff615f0f32

  • SHA256

    70a4e7c6e862b6b7c95b711fbfaae271af7c36f1bcf2c3994c658359da84d8bd

  • SHA512

    495841a0b43efa44973c0b73c6c61b87ddc8a012bb7ef3ef51fd5fef57bf9ca2df69a99cdbac6fb7374bd96ccf36381d53f60ccfe84f907df72213427eda16cb

  • SSDEEP

    3072:KBrklLwN9Fr0VFd/dGYD+uL/yHdgrKgsiTCYPbdJdfyRoToo8IcPfNzSKnc:tLwN9F60dgrKgfCYhTt8XN

Score
10/10

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ReActiveMe.exe
    "C:\Users\Admin\AppData\Local\Temp\ReActiveMe.exe"
    1⤵
    • UAC bypass
    • Disables RegEdit via registry modification
    • Checks whether UAC is enabled
    • System policy modification
    PID:3604

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3604-0-0x00007FFB12B85000-0x00007FFB12B86000-memory.dmp

    Filesize

    4KB

  • memory/3604-1-0x000000001B7B0000-0x000000001B856000-memory.dmp

    Filesize

    664KB

  • memory/3604-2-0x00007FFB128D0000-0x00007FFB13271000-memory.dmp

    Filesize

    9.6MB

  • memory/3604-3-0x00007FFB128D0000-0x00007FFB13271000-memory.dmp

    Filesize

    9.6MB

  • memory/3604-4-0x000000001BD30000-0x000000001C1FE000-memory.dmp

    Filesize

    4.8MB

  • memory/3604-5-0x000000001C2F0000-0x000000001C38C000-memory.dmp

    Filesize

    624KB

  • memory/3604-6-0x0000000000F80000-0x0000000000F88000-memory.dmp

    Filesize

    32KB

  • memory/3604-7-0x000000001C450000-0x000000001C49C000-memory.dmp

    Filesize

    304KB

  • memory/3604-8-0x00007FFB128D0000-0x00007FFB13271000-memory.dmp

    Filesize

    9.6MB

  • memory/3604-10-0x00007FFB128D0000-0x00007FFB13271000-memory.dmp

    Filesize

    9.6MB