Resubmissions
01/02/2023, 22:52
230201-2th53sda35 8Analysis
-
max time kernel
232s -
max time network
295s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-es -
resource tags
arch:x64arch:x86image:win10v2004-20221111-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
01/02/2023, 22:52
Static task
static1
Behavioral task
behavioral1
Sample
KMS_VL_ALL_AIO.cmd
Resource
win10-20220812-es
windows10-1703-x64
15 signatures
300 seconds
Behavioral task
behavioral2
Sample
KMS_VL_ALL_AIO.cmd
Resource
win10v2004-20221111-es
windows10-2004-x64
5 signatures
300 seconds
General
-
Target
KMS_VL_ALL_AIO.cmd
-
Size
300KB
-
MD5
c8642fd825543b510b0a5fa118cc5b80
-
SHA1
5f80cdf39a0ee22321a73544a4939faddedd575b
-
SHA256
18f7423d283aa1aa5c2c54b823f99f75fc8d4decaed513db91c1be02ab98fb3d
-
SHA512
7df23e2afa00ae4dd913dd2d8e84a603e30cdccfedd85cd108da674e13b1aefc3b082b3cac95f457a11125c4bb6a11d46a24f2bc933797952dd0c0a1e6e7a363
-
SSDEEP
6144:WiJNJzLuupIW1GnFS0xmfKD5pw9rIjEUqbj8HmAkNp/4:5JNJzVpIRxmyD5pmUjE/j8GAk7/4
Score
4/10
Malware Config
Signatures
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4624 sc.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 2172 reg.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3252 powershell.exe 3252 powershell.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2392 WMIC.exe Token: SeSecurityPrivilege 2392 WMIC.exe Token: SeTakeOwnershipPrivilege 2392 WMIC.exe Token: SeLoadDriverPrivilege 2392 WMIC.exe Token: SeSystemProfilePrivilege 2392 WMIC.exe Token: SeSystemtimePrivilege 2392 WMIC.exe Token: SeProfSingleProcessPrivilege 2392 WMIC.exe Token: SeIncBasePriorityPrivilege 2392 WMIC.exe Token: SeCreatePagefilePrivilege 2392 WMIC.exe Token: SeBackupPrivilege 2392 WMIC.exe Token: SeRestorePrivilege 2392 WMIC.exe Token: SeShutdownPrivilege 2392 WMIC.exe Token: SeDebugPrivilege 2392 WMIC.exe Token: SeSystemEnvironmentPrivilege 2392 WMIC.exe Token: SeRemoteShutdownPrivilege 2392 WMIC.exe Token: SeUndockPrivilege 2392 WMIC.exe Token: SeManageVolumePrivilege 2392 WMIC.exe Token: 33 2392 WMIC.exe Token: 34 2392 WMIC.exe Token: 35 2392 WMIC.exe Token: 36 2392 WMIC.exe Token: SeIncreaseQuotaPrivilege 2392 WMIC.exe Token: SeSecurityPrivilege 2392 WMIC.exe Token: SeTakeOwnershipPrivilege 2392 WMIC.exe Token: SeLoadDriverPrivilege 2392 WMIC.exe Token: SeSystemProfilePrivilege 2392 WMIC.exe Token: SeSystemtimePrivilege 2392 WMIC.exe Token: SeProfSingleProcessPrivilege 2392 WMIC.exe Token: SeIncBasePriorityPrivilege 2392 WMIC.exe Token: SeCreatePagefilePrivilege 2392 WMIC.exe Token: SeBackupPrivilege 2392 WMIC.exe Token: SeRestorePrivilege 2392 WMIC.exe Token: SeShutdownPrivilege 2392 WMIC.exe Token: SeDebugPrivilege 2392 WMIC.exe Token: SeSystemEnvironmentPrivilege 2392 WMIC.exe Token: SeRemoteShutdownPrivilege 2392 WMIC.exe Token: SeUndockPrivilege 2392 WMIC.exe Token: SeManageVolumePrivilege 2392 WMIC.exe Token: 33 2392 WMIC.exe Token: 34 2392 WMIC.exe Token: 35 2392 WMIC.exe Token: 36 2392 WMIC.exe Token: SeDebugPrivilege 3252 powershell.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 2604 wrote to memory of 2172 2604 cmd.exe 83 PID 2604 wrote to memory of 2172 2604 cmd.exe 83 PID 2604 wrote to memory of 2204 2604 cmd.exe 82 PID 2604 wrote to memory of 2204 2604 cmd.exe 82 PID 2604 wrote to memory of 2392 2604 cmd.exe 84 PID 2604 wrote to memory of 2392 2604 cmd.exe 84 PID 2604 wrote to memory of 4472 2604 cmd.exe 85 PID 2604 wrote to memory of 4472 2604 cmd.exe 85 PID 2604 wrote to memory of 3252 2604 cmd.exe 86 PID 2604 wrote to memory of 3252 2604 cmd.exe 86 PID 2604 wrote to memory of 3468 2604 cmd.exe 87 PID 2604 wrote to memory of 3468 2604 cmd.exe 87 PID 2604 wrote to memory of 3676 2604 cmd.exe 88 PID 2604 wrote to memory of 3676 2604 cmd.exe 88 PID 2604 wrote to memory of 4908 2604 cmd.exe 89 PID 2604 wrote to memory of 4908 2604 cmd.exe 89 PID 4908 wrote to memory of 560 4908 cmd.exe 90 PID 4908 wrote to memory of 560 4908 cmd.exe 90 PID 2604 wrote to memory of 4144 2604 cmd.exe 91 PID 2604 wrote to memory of 4144 2604 cmd.exe 91 PID 2604 wrote to memory of 248 2604 cmd.exe 92 PID 2604 wrote to memory of 248 2604 cmd.exe 92 PID 2604 wrote to memory of 1564 2604 cmd.exe 93 PID 2604 wrote to memory of 1564 2604 cmd.exe 93 PID 2604 wrote to memory of 220 2604 cmd.exe 94 PID 2604 wrote to memory of 220 2604 cmd.exe 94 PID 2604 wrote to memory of 208 2604 cmd.exe 95 PID 2604 wrote to memory of 208 2604 cmd.exe 95 PID 2604 wrote to memory of 3928 2604 cmd.exe 96 PID 2604 wrote to memory of 3928 2604 cmd.exe 96 PID 2604 wrote to memory of 3008 2604 cmd.exe 97 PID 2604 wrote to memory of 3008 2604 cmd.exe 97 PID 2604 wrote to memory of 4680 2604 cmd.exe 98 PID 2604 wrote to memory of 4680 2604 cmd.exe 98 PID 2604 wrote to memory of 4624 2604 cmd.exe 99 PID 2604 wrote to memory of 4624 2604 cmd.exe 99 PID 2604 wrote to memory of 4008 2604 cmd.exe 100 PID 2604 wrote to memory of 4008 2604 cmd.exe 100 PID 2604 wrote to memory of 4148 2604 cmd.exe 101 PID 2604 wrote to memory of 4148 2604 cmd.exe 101 PID 2604 wrote to memory of 2068 2604 cmd.exe 102 PID 2604 wrote to memory of 2068 2604 cmd.exe 102 PID 2604 wrote to memory of 3892 2604 cmd.exe 103 PID 2604 wrote to memory of 3892 2604 cmd.exe 103
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\KMS_VL_ALL_AIO.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\System32\find.exefind /i "0x4"2⤵PID:2204
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\WinMgmt /v Start2⤵
- Modifies registry key
PID:2172
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2392
-
-
C:\Windows\System32\find.exefind /i "ComputerSystem"2⤵PID:4472
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -nop -c $ExecutionContext.SessionState.LanguageMode2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3252
-
-
C:\Windows\System32\find.exefind /i "Full"2⤵PID:3468
-
-
C:\Windows\System32\reg.exereg query HKU\S-1-5-192⤵PID:3676
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop2⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\System32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop3⤵PID:560
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ver2⤵PID:4144
-
-
C:\Windows\System32\reg.exereg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled2⤵PID:248
-
-
C:\Windows\System32\find.exefind /i "0x0"2⤵PID:1564
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled2⤵PID:220
-
-
C:\Windows\System32\find.exefind /i "0x0"2⤵PID:208
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV22⤵PID:3928
-
-
C:\Windows\System32\find.exefind /i "0x0"2⤵PID:3008
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c dir /b /ad C:\Windows\System32\spp\tokens\skus2⤵PID:4680
-
-
C:\Windows\System32\sc.exesc query osppsvc2⤵
- Launches sc.exe
PID:4624
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe"2⤵PID:4008
-
-
C:\Windows\System32\mode.commode con cols=80 lines=342⤵PID:4148
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "prompt #$H#$E# & echo on & for %B in (1) do rem"2⤵PID:2068
-
-
C:\Windows\System32\choice.exechoice /c 1234567890EDRSVX /n /m "> Choose a menu option, or press 0 to Exit: "2⤵PID:3892
-