General
- Target WinActivateWorks.exe
- Size 826KB
- Sample260724-byards1cnb
- SHA256 bd043633db667ad049863c9d3129e152c3dd683f837f063e6c1c41ac14ff1ba1
- MD5 3a21e140e09018cee33bc04f6adde833
- SHA1 f3fc10fd86f2784bd91730a3f63635d20ebd0ba4
- SHA512 e6a6d2aee30ea6be82dcc6b74042ba6d5ae33f3ff16ebfead1547795067ac8917a704e1b2242032447cc3adae07ed23ab49e3c979a2da43ea1cc7829d0f37c45
- SSDEEP 6144:Z+qUN5tN3IufxkU5/8BcEvTGmFOE8THncQx4Oz0ykw7Au:Z+qUNR3IuuhcEvTGGOEmcAXz0ykw7
- TLSH T1BD053A06AD0251A6C1B3F379DE53814EFB26C263837152A976ADC4447F36309A2BEF5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WinActivateWorks.exe
Resource
win10v2004-20260513-en
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
WinActivateWorks.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target WinActivateWorks.exe
- Size 826KB
- SHA256 bd043633db667ad049863c9d3129e152c3dd683f837f063e6c1c41ac14ff1ba1
- MD5 3a21e140e09018cee33bc04f6adde833
- SHA1 f3fc10fd86f2784bd91730a3f63635d20ebd0ba4
- SHA512 e6a6d2aee30ea6be82dcc6b74042ba6d5ae33f3ff16ebfead1547795067ac8917a704e1b2242032447cc3adae07ed23ab49e3c979a2da43ea1cc7829d0f37c45
- SSDEEP 6144:Z+qUN5tN3IufxkU5/8BcEvTGmFOE8THncQx4Oz0ykw7Au:Z+qUNR3IuuhcEvTGGOEmcAXz0ykw7
- TLSH T1BD053A06AD0251A6C1B3F379DE53814EFB26C263837152A976ADC4447F36309A2BEF5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
2Windows Command Shell
1