Overview

overview

8

Static

static

KMSpico-setup.exe

windows10-1703-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    KMSpico-setup.exe

  • Size

    3.1MB

  • Sample

    221230-yrn2rsgd85

  • MD5

    a02164371a50c5ff9fa2870ef6e8cfa3

  • SHA1

    060614723f8375ecaad8b249ff07e3be082d7f25

  • SHA256

    64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a

  • SHA512

    6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326

  • SSDEEP

    98304:CgbTbhBxCLS0Kx/XRCsFlPsKh9ApbeicTkxchy6pA32b7SuzWl:rxBxCLS3xZCsFyBzxcE6pAGbq

Score
8/10
discoverypersistenceupx

Malware Config

Targets

    • Target

      KMSpico-setup.exe

    • Size

      3.1MB

    • MD5

      a02164371a50c5ff9fa2870ef6e8cfa3

    • SHA1

      060614723f8375ecaad8b249ff07e3be082d7f25

    • SHA256

      64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a

    • SHA512

      6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326

    • SSDEEP

      98304:CgbTbhBxCLS0Kx/XRCsFlPsKh9ApbeicTkxchy6pA32b7SuzWl:rxBxCLS3xZCsFyBzxcE6pAGbq

    Score
    8/10
    discoverypersistenceupx

    • Creates new service(s)

      persistence

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks