Overview

overview

10

Static

static

10

OfficeActivator.exe

windows7-x64

OfficeActivator.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    OfficeActivator.exe

  • Size

    87KB

  • Sample

    241108-xq3m4awrfw

  • MD5

    1b4e57be75e855e54e84f55874782d4b

  • SHA1

    f5f17bae63faad537233bb38647940bda7340b2c

  • SHA256

    8441f92e8460a7b2ed37ee96affe547a65589b2e8e980a18a6b08b786b48465d

  • SHA512

    076245019b439583d4a45e46e6c836a2724270aba0a6e1b04e20c4157bdb32533045ee118c22a013e6f7127f1d34eb8b82738156dd152dae7c4ef9da1cf39da9

  • SSDEEP

    1536:LcW4lAJGGnzjoih/NDh/NDuk+XkGAK/hztXcag+PlbBfkWIyvZrw281r5XsmCZEq:4WNGszjoih/NDh/NDuk+XkGAK/hztXcE

Score
10/10
thanosdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwaretrojan

Malware Config

Targets

    • Target

      OfficeActivator.exe

    • Size

      87KB

    • MD5

      1b4e57be75e855e54e84f55874782d4b

    • SHA1

      f5f17bae63faad537233bb38647940bda7340b2c

    • SHA256

      8441f92e8460a7b2ed37ee96affe547a65589b2e8e980a18a6b08b786b48465d

    • SHA512

      076245019b439583d4a45e46e6c836a2724270aba0a6e1b04e20c4157bdb32533045ee118c22a013e6f7127f1d34eb8b82738156dd152dae7c4ef9da1cf39da9

    • SSDEEP

      1536:LcW4lAJGGnzjoih/NDh/NDuk+XkGAK/hztXcag+PlbBfkWIyvZrw281r5XsmCZEq:4WNGszjoih/NDh/NDuk+XkGAK/hztXcE

    Score
    10/10
    defense_evasionevasionpersistenceransomwarediscoveryexecutionimpacttrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Disables service(s)

      evasionexecution

    • Modifies WinLogon for persistence

      persistence

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (60) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Impair Defenses: Safe Mode Boot

      defense_evasion

    • Windows security modification

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Modifies WinLogon

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1
T1569

Service Execution

1
T1569.002

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

2
T1547

Winlogon Helper DLL

2
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Winlogon Helper DLL

2
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Defense Evasion

Direct Volume Access

1
T1006

Impair Defenses

3
T1562

Disable or Modify Tools

2
T1562.001

Safe Mode Boot

1
T1562.009

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

5
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

Remote System Discovery

1
T1018

System Information Discovery

3
T1082

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Inhibit System Recovery

3
T1490

Service Stop

1
T1489

Tasks