Overview

overview

10

Static

static

1

KMSAuto++v1.6.4.exe

windows7-x64

10

KMSAuto++v1.6.4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    KMSAuto++v1.6.4.exe

  • Size

    718.9MB

  • Sample

    230206-vjge6sac2x

  • MD5

    ef8cd375fdc780a87dbf601860994ab9

  • SHA1

    b0aac6fb4006091219ba82a5838e810e0e27beba

  • SHA256

    a6856516f42de63846610b121a0585472e252d40ffcaddba201c3b5fa2abb520

  • SHA512

    52db73a1bc0df076f74ed5fcb4d50ca7e46de6b7ee57cb7ee0223c96635dd01e4cafa403079fdeac25a219d402f5fdca608f76c8ed689540cac0d6c11b44c417

  • SSDEEP

    786432:yo0mvb9vOggaeuNz9jMWZZ7vHMH85G1p14NPlT2sp:yavx2ggaL11MccpyPR2

Score
10/10
evasionpersistencetrojanupx

Malware Config

Targets

    • Target

      KMSAuto++v1.6.4.exe

    • Size

      718.9MB

    • MD5

      ef8cd375fdc780a87dbf601860994ab9

    • SHA1

      b0aac6fb4006091219ba82a5838e810e0e27beba

    • SHA256

      a6856516f42de63846610b121a0585472e252d40ffcaddba201c3b5fa2abb520

    • SHA512

      52db73a1bc0df076f74ed5fcb4d50ca7e46de6b7ee57cb7ee0223c96635dd01e4cafa403079fdeac25a219d402f5fdca608f76c8ed689540cac0d6c11b44c417

    • SSDEEP

      786432:yo0mvb9vOggaeuNz9jMWZZ7vHMH85G1p14NPlT2sp:yavx2ggaL11MccpyPR2

    Score
    10/10
    evasionpersistencetrojanupx

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Modifies security service

      evasion

    • Creates new service(s)

      persistence

    • Modifies Windows Firewall

      evasion

    • Sets service image path in registry

      persistence

    • Stops running service(s)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

4
T1031

New Service

1
T1050

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

New Service

1
T1050

Defense Evasion

Modify Registry

5
T1112

Disabling Security Tools

1
T1089

Impair Defenses

1
T1562

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks