9d7acc4d6c1566bcc909a3f47f90e607a65bc7960a1e380d88d3df628326990f

Analysis

max time kernel
106s
max time network
90s
platform
windows10-2004_x64
resource
win10v2004-20230221-es
resource tags

arch:x64arch:x86image:win10v2004-20230221-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
21/03/2023, 02:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

KMSAuto++ x64.exe
Size

20.6MB
MD5

5076887cdcff4c84195e217da3b4ff5e
SHA1

4b7d9b9bc7709e50e705a9734f3d91ec3ac2e003
SHA256

9d7acc4d6c1566bcc909a3f47f90e607a65bc7960a1e380d88d3df628326990f
SHA512

84c425e25c0ecbfbfcdaded8b2a8694c64dbdb66080891f5bd6baa3b3634a4f05373c26c7862d62302e3c93c096c957319b438e37bebf6826487a84bb861d703
SSDEEP

393216:8JPwet9QQGSu5zMMV5zi1rbEuInDjWOf+804dzlxa0oWAGKvNA2moqk3UbxB5P0o:oPw79zMMV500uIn3TW80c20oJq2moB3A

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3156	signtool.exe
2300	gatherosstate.exe

Loads dropped DLL 2 IoCs

pid	Process
2300	gatherosstate.exe
2300	gatherosstate.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3496-134-0x0000000140000000-0x000000014166F000-memory.dmp	upx
behavioral1/memory/3496-141-0x0000000140000000-0x000000014166F000-memory.dmp	upx
behavioral1/memory/3496-142-0x0000000140000000-0x000000014166F000-memory.dmp	upx
behavioral1/memory/3496-155-0x0000000140000000-0x000000014166F000-memory.dmp	upx
behavioral1/memory/3496-171-0x0000000140000000-0x000000014166F000-memory.dmp	upx
behavioral1/memory/3496-173-0x0000000140000000-0x000000014166F000-memory.dmp	upx
behavioral1/memory/3496-177-0x0000000140000000-0x000000014166F000-memory.dmp	upx
behavioral1/memory/3496-178-0x0000000140000000-0x000000014166F000-memory.dmp	upx
behavioral1/memory/3496-180-0x0000000140000000-0x000000014166F000-memory.dmp	upx

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1356	sc.exe
1028	sc.exe
640	sc.exe
1424	sc.exe
4392	sc.exe
3212	sc.exe

Checks SCSI registry key(s) 3 TTPs 11 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	gatherosstate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	ClipUp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	ClipUp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	ClipUp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	ClipUp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	ClipUp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	gatherosstate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	gatherosstate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	gatherosstate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	gatherosstate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	ClipUp.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	signtool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	signtool.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3496	KMSAuto++ x64.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2832	WMIC.exe
Token: SeSecurityPrivilege	2832	WMIC.exe
Token: SeTakeOwnershipPrivilege	2832	WMIC.exe
Token: SeLoadDriverPrivilege	2832	WMIC.exe
Token: SeSystemProfilePrivilege	2832	WMIC.exe
Token: SeSystemtimePrivilege	2832	WMIC.exe
Token: SeProfSingleProcessPrivilege	2832	WMIC.exe
Token: SeIncBasePriorityPrivilege	2832	WMIC.exe
Token: SeCreatePagefilePrivilege	2832	WMIC.exe
Token: SeBackupPrivilege	2832	WMIC.exe
Token: SeRestorePrivilege	2832	WMIC.exe
Token: SeShutdownPrivilege	2832	WMIC.exe
Token: SeDebugPrivilege	2832	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2832	WMIC.exe
Token: SeRemoteShutdownPrivilege	2832	WMIC.exe
Token: SeUndockPrivilege	2832	WMIC.exe
Token: SeManageVolumePrivilege	2832	WMIC.exe
Token: 33	2832	WMIC.exe
Token: 34	2832	WMIC.exe
Token: 35	2832	WMIC.exe
Token: 36	2832	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2832	WMIC.exe
Token: SeSecurityPrivilege	2832	WMIC.exe
Token: SeTakeOwnershipPrivilege	2832	WMIC.exe
Token: SeLoadDriverPrivilege	2832	WMIC.exe
Token: SeSystemProfilePrivilege	2832	WMIC.exe
Token: SeSystemtimePrivilege	2832	WMIC.exe
Token: SeProfSingleProcessPrivilege	2832	WMIC.exe
Token: SeIncBasePriorityPrivilege	2832	WMIC.exe
Token: SeCreatePagefilePrivilege	2832	WMIC.exe
Token: SeBackupPrivilege	2832	WMIC.exe
Token: SeRestorePrivilege	2832	WMIC.exe
Token: SeShutdownPrivilege	2832	WMIC.exe
Token: SeDebugPrivilege	2832	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2832	WMIC.exe
Token: SeRemoteShutdownPrivilege	2832	WMIC.exe
Token: SeUndockPrivilege	2832	WMIC.exe
Token: SeManageVolumePrivilege	2832	WMIC.exe
Token: 33	2832	WMIC.exe
Token: 34	2832	WMIC.exe
Token: 35	2832	WMIC.exe
Token: 36	2832	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1524	wmic.exe
Token: SeSecurityPrivilege	1524	wmic.exe
Token: SeTakeOwnershipPrivilege	1524	wmic.exe
Token: SeLoadDriverPrivilege	1524	wmic.exe
Token: SeSystemProfilePrivilege	1524	wmic.exe
Token: SeSystemtimePrivilege	1524	wmic.exe
Token: SeProfSingleProcessPrivilege	1524	wmic.exe
Token: SeIncBasePriorityPrivilege	1524	wmic.exe
Token: SeCreatePagefilePrivilege	1524	wmic.exe
Token: SeBackupPrivilege	1524	wmic.exe
Token: SeRestorePrivilege	1524	wmic.exe
Token: SeShutdownPrivilege	1524	wmic.exe
Token: SeDebugPrivilege	1524	wmic.exe
Token: SeSystemEnvironmentPrivilege	1524	wmic.exe
Token: SeRemoteShutdownPrivilege	1524	wmic.exe
Token: SeUndockPrivilege	1524	wmic.exe
Token: SeManageVolumePrivilege	1524	wmic.exe
Token: 33	1524	wmic.exe
Token: 34	1524	wmic.exe
Token: 35	1524	wmic.exe
Token: 36	1524	wmic.exe
Token: SeIncreaseQuotaPrivilege	1524	wmic.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
3496	KMSAuto++ x64.exe
3496	KMSAuto++ x64.exe
3496	KMSAuto++ x64.exe
3496	KMSAuto++ x64.exe
3496	KMSAuto++ x64.exe
3496	KMSAuto++ x64.exe
3496	KMSAuto++ x64.exe
3496	KMSAuto++ x64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 2472	3496	KMSAuto++ x64.exe	89
PID 3496 wrote to memory of 2472	3496	KMSAuto++ x64.exe	89
PID 3496 wrote to memory of 4800	3496	KMSAuto++ x64.exe	86
PID 3496 wrote to memory of 4800	3496	KMSAuto++ x64.exe	86
PID 4800 wrote to memory of 2832	4800	cmd.exe	90
PID 4800 wrote to memory of 2832	4800	cmd.exe	90
PID 3496 wrote to memory of 3156	3496	KMSAuto++ x64.exe	91
PID 3496 wrote to memory of 3156	3496	KMSAuto++ x64.exe	91
PID 3496 wrote to memory of 3156	3496	KMSAuto++ x64.exe	91
PID 3496 wrote to memory of 1524	3496	KMSAuto++ x64.exe	93
PID 3496 wrote to memory of 1524	3496	KMSAuto++ x64.exe	93
PID 3496 wrote to memory of 1676	3496	KMSAuto++ x64.exe	96
PID 3496 wrote to memory of 1676	3496	KMSAuto++ x64.exe	96
PID 1676 wrote to memory of 1028	1676	cmd.exe	98
PID 1676 wrote to memory of 1028	1676	cmd.exe	98
PID 3496 wrote to memory of 2616	3496	KMSAuto++ x64.exe	99
PID 3496 wrote to memory of 2616	3496	KMSAuto++ x64.exe	99
PID 2616 wrote to memory of 1032	2616	cmd.exe	101
PID 2616 wrote to memory of 1032	2616	cmd.exe	101
PID 3496 wrote to memory of 3068	3496	KMSAuto++ x64.exe	102
PID 3496 wrote to memory of 3068	3496	KMSAuto++ x64.exe	102
PID 3068 wrote to memory of 1488	3068	cmd.exe	104
PID 3068 wrote to memory of 1488	3068	cmd.exe	104
PID 3496 wrote to memory of 1264	3496	KMSAuto++ x64.exe	111
PID 3496 wrote to memory of 1264	3496	KMSAuto++ x64.exe	111
PID 1264 wrote to memory of 4988	1264	cmd.exe	113
PID 1264 wrote to memory of 4988	1264	cmd.exe	113
PID 3496 wrote to memory of 2080	3496	KMSAuto++ x64.exe	114
PID 3496 wrote to memory of 2080	3496	KMSAuto++ x64.exe	114
PID 2080 wrote to memory of 1916	2080	cmd.exe	116
PID 2080 wrote to memory of 1916	2080	cmd.exe	116
PID 3496 wrote to memory of 1732	3496	KMSAuto++ x64.exe	117
PID 3496 wrote to memory of 1732	3496	KMSAuto++ x64.exe	117
PID 1732 wrote to memory of 640	1732	cmd.exe	119
PID 1732 wrote to memory of 640	1732	cmd.exe	119
PID 3496 wrote to memory of 3104	3496	KMSAuto++ x64.exe	120
PID 3496 wrote to memory of 3104	3496	KMSAuto++ x64.exe	120
PID 3104 wrote to memory of 1424	3104	cmd.exe	122
PID 3104 wrote to memory of 1424	3104	cmd.exe	122
PID 3496 wrote to memory of 2692	3496	KMSAuto++ x64.exe	123
PID 3496 wrote to memory of 2692	3496	KMSAuto++ x64.exe	123
PID 2692 wrote to memory of 4392	2692	cmd.exe	125
PID 2692 wrote to memory of 4392	2692	cmd.exe	125
PID 3496 wrote to memory of 4004	3496	KMSAuto++ x64.exe	126
PID 3496 wrote to memory of 4004	3496	KMSAuto++ x64.exe	126
PID 4004 wrote to memory of 3212	4004	cmd.exe	128
PID 4004 wrote to memory of 3212	4004	cmd.exe	128
PID 3496 wrote to memory of 4720	3496	KMSAuto++ x64.exe	129
PID 3496 wrote to memory of 4720	3496	KMSAuto++ x64.exe	129
PID 4720 wrote to memory of 1356	4720	cmd.exe	131
PID 4720 wrote to memory of 1356	4720	cmd.exe	131
PID 3496 wrote to memory of 1720	3496	KMSAuto++ x64.exe	132
PID 3496 wrote to memory of 1720	3496	KMSAuto++ x64.exe	132
PID 1720 wrote to memory of 1028	1720	cmd.exe	134
PID 1720 wrote to memory of 1028	1720	cmd.exe	134
PID 3496 wrote to memory of 3364	3496	KMSAuto++ x64.exe	135
PID 3496 wrote to memory of 3364	3496	KMSAuto++ x64.exe	135
PID 3364 wrote to memory of 536	3364	cmd.exe	137
PID 3364 wrote to memory of 536	3364	cmd.exe	137
PID 3496 wrote to memory of 4664	3496	KMSAuto++ x64.exe	138
PID 3496 wrote to memory of 4664	3496	KMSAuto++ x64.exe	138
PID 4664 wrote to memory of 3292	4664	cmd.exe	140
PID 4664 wrote to memory of 3292	4664	cmd.exe	140
PID 3496 wrote to memory of 2412	3496	KMSAuto++ x64.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\KMSAuto++ x64.exe
"C:\Users\Admin\AppData\Local\Temp\KMSAuto++ x64.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\KMSAuto++ x64.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\KMSAuto++ x64.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2832
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy C:\Windows\system32\Tasks\KMSAuto "C:\Users\Admin\AppData\Local\Temp\KMSAuto.tmp" /Y
  2⤵
  PID:2472
- C:\Users\Admin\AppData\Local\Temp\signtool.exe
  "C:\Users\Admin\AppData\Local\Temp\signtool.exe" verify /v /ph /sha1 648384a4dee53d4c1c87e10d67cc99307ccc9c98 "C:\Users\Admin\AppData\Local\Temp\KMSAuto++ x64.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  PID:3156
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path Win32_NetworkAdapter get ServiceName /value /FORMAT:List
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\KMSAuto_Files"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\KMSAuto_Files"
    3⤵
    PID:1028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\System32\SECOPatcher.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\System32\SECOPatcher.dll"
    3⤵
    PID:1032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\dControl.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\dControl.exe"
    3⤵
    PID:1488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cscript //nologo "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /ipk VK7JG-NPHTM-C97JM-9MPGT-3V66T
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Windows\system32\cscript.exe
    cscript //nologo "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /ipk VK7JG-NPHTM-C97JM-9MPGT-3V66T
    3⤵
    PID:4988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cscript //nologo "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /xpr
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\system32\cscript.exe
    cscript //nologo "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /xpr
    3⤵
    PID:1916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\sc.exe qc licensemanager
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\System32\sc.exe
    C:\Windows\System32\sc.exe qc licensemanager
    3⤵
    - Launches sc.exe
    PID:640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\sc.exe qc wuauserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Windows\System32\sc.exe
    C:\Windows\System32\sc.exe qc wuauserv
    3⤵
    - Launches sc.exe
    PID:1424
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\sc.exe qc wlidsvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\System32\sc.exe
    C:\Windows\System32\sc.exe qc wlidsvc
    3⤵
    - Launches sc.exe
    PID:4392
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\sc.exe start licensemanager
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Windows\System32\sc.exe
    C:\Windows\System32\sc.exe start licensemanager
    3⤵
    - Launches sc.exe
    PID:3212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\sc.exe start wuauserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\System32\sc.exe
    C:\Windows\System32\sc.exe start wuauserv
    3⤵
    - Launches sc.exe
    PID:1356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\sc.exe start wlidsvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\System32\sc.exe
    C:\Windows\System32\sc.exe start wlidsvc
    3⤵
    - Launches sc.exe
    PID:1028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\Tokens" /f /v "Channel" /t REG_SZ /d Retail
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\System32\reg.exe
    reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\Tokens" /f /v "Channel" /t REG_SZ /d Retail
    3⤵
    PID:536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\Tokens\Kernel" /f /v "Kernel-ProductInfo" /t REG_DWORD /d 48
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\System32\reg.exe
    reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\Tokens\Kernel" /f /v "Kernel-ProductInfo" /t REG_DWORD /d 48
    3⤵
    PID:3292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\Tokens\Kernel" /f /v "Security-SPP-GenuineLocalStatus" /t REG_DWORD /d 1
  2⤵
  PID:2412
- - C:\Windows\System32\reg.exe
    reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\Tokens\Kernel" /f /v "Security-SPP-GenuineLocalStatus" /t REG_DWORD /d 1
    3⤵
    PID:1548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c gatherosstate.exe
  2⤵
  PID:5064
- - C:\Users\Admin\AppData\Local\Temp\BIN\gatherosstate.exe
    gatherosstate.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks SCSI registry key(s)
    PID:2300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\ClipUp.exe -v -o -altto C:\Users\Admin\AppData\Local\Temp\BIN\
  2⤵
  PID:3976
- - C:\Windows\System32\ClipUp.exe
    C:\Windows\System32\ClipUp.exe -v -o -altto C:\Users\Admin\AppData\Local\Temp\BIN\
    3⤵
    PID:3652
  - - C:\Windows\System32\ClipUp.exe
      C:\Windows\System32\ClipUp.exe -v -o -altto C:\Users\Admin\AppData\Local\Temp\BIN\ -ppl C:\Users\Admin\AppData\Local\Temp\tem1A10.tmp
      4⤵
      Checks SCSI registry key(s)
      PID:1228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cscript //nologo "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /ato
  2⤵
  PID:1908
- - C:\Windows\system32\cscript.exe
    cscript //nologo "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /ato
    3⤵
    PID:4268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKEY_LOCAL_MACHINE\SYSTEM\Tokens" /f
  2⤵
  PID:3224
- - C:\Windows\System32\reg.exe
    reg.exe delete "HKEY_LOCAL_MACHINE\SYSTEM\Tokens" /f
    3⤵
    PID:2328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cscript //nologo "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /xpr
  2⤵
  PID:3212
- - C:\Windows\system32\cscript.exe
    cscript //nologo "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /xpr
    3⤵
    PID:684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /F /Q
  2⤵
  PID:1356

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4b4 0x33c
1⤵
PID:3720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BIN\GenuineTicket.xml

Filesize
1KB

MD5
b5e07f3d9ed0d30ec394936c758bdb9c

SHA1
9997783bc02e95842693c95f567d6498dd38c5af

SHA256
9e907a5f497e5286eab60c4c0ba6c50013cde71d18083f2bc54a7227053780c9

SHA512
6a09466d9cbac145a7cac53ca1bd2c10b6f3c8d86a9db4b985d8b88b1bd33965c7e10deafda74d5229ca4f5d39cbcb7c5f210d0543a14e7ac2c0ff70751b17bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\BIN\SLC.DLL

Filesize
13KB

MD5
31e221d3b930629a14ed2af067f777e3

SHA1
aae9a700c9bb97581f3e15ea133f754cc950b690

SHA256
32073d9d5706476785e3fbcb208b65dff56038c6ca9a8a2b15d2ab1590cc8e04

SHA512
0b6900bc5917908e6ef7ee9d5656b55132c4e2cccfde42eb375a58b81db2712ed0c6344f95b509b74f83bbaf91c0617e3649c597419ab90eedfcf924692f688f

Download Submit
C:\Users\Admin\AppData\Local\Temp\BIN\gatherosstate.exe

Filesize
1.3MB

MD5
b13bc5b62f54607c334a6464d9b85cc8

SHA1
12721c69acbcb515f7adbee08ec42fc61192c187

SHA256
51791625054b01802fd5aaa6c4a929827b369dfef7b2891b5f55e0fa61af0c7d

SHA512
58a9c4e413992b8c225fd622934929382070cbe8c8999bdb93851a1f46a0129d674135eacce2b3f96a19dfbb7333e3b921b5e39b727339c9897de7a02d2ce3bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\BIN\slc.dll

Filesize
13KB

MD5
31e221d3b930629a14ed2af067f777e3

SHA1
aae9a700c9bb97581f3e15ea133f754cc950b690

SHA256
32073d9d5706476785e3fbcb208b65dff56038c6ca9a8a2b15d2ab1590cc8e04

SHA512
0b6900bc5917908e6ef7ee9d5656b55132c4e2cccfde42eb375a58b81db2712ed0c6344f95b509b74f83bbaf91c0617e3649c597419ab90eedfcf924692f688f

Download Submit
C:\Users\Admin\AppData\Local\Temp\BIN\slc.dll

Filesize
13KB

MD5
31e221d3b930629a14ed2af067f777e3

SHA1
aae9a700c9bb97581f3e15ea133f754cc950b690

SHA256
32073d9d5706476785e3fbcb208b65dff56038c6ca9a8a2b15d2ab1590cc8e04

SHA512
0b6900bc5917908e6ef7ee9d5656b55132c4e2cccfde42eb375a58b81db2712ed0c6344f95b509b74f83bbaf91c0617e3649c597419ab90eedfcf924692f688f

Download Submit
C:\Users\Admin\AppData\Local\Temp\signtool.exe

Filesize
323KB

MD5
05624e6d27eaef0db0673ae627bd6027

SHA1
b155c76bf59992a8d75d0e3a59dc94f24aff2591

SHA256
962a92821f54a1e706aa989973130fdc1072c7bd8b9e6d11ea1050b46eb9d313

SHA512
233304669aefeec9ad5d19bd2dd5bb19ea35ce31da0b3aabe5ab859259608a58725fac5993637c9635e5912138d3eb477773351f0ee81cc3ce756d713163cf31

Download Submit
C:\Users\Admin\AppData\Local\Temp\slmgr.vbs

Filesize
139KB

MD5
3903bcab32a4a853dfa54962112d4d02

SHA1
ba6433fba48797cd43463441358004ac81b76a8b

SHA256
95fc646d222d324db46f603a7f675c329fe59a567ed27fdaed2a572a19206816

SHA512
db27b16ec8f8139c44c433d51350fbda6c8f8113e2e8178ff53298b4dace5ef93d65d7cc422f5a2d544d053471c36392da4acd2b7da8af38bb42344db70dbe0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tem1A10.tmp

Filesize
582B

MD5
e2c91142c0e9329879ca0aaff56f5b3a

SHA1
94da96fe12c2a4b8afcbc3c8c5a5567a465a21b8

SHA256
80cb6a1dad4fbe0434c2ca74cb1f6c95ffe7176358bc50d3672c8a19c051641c

SHA512
4011a2545193125d8101045dd1dd8ae04f5d1055e9600d1807f314403b46163125e21466c996f0127241490f7255f38aaa0dec1c1a5c72a138230ef676f9140b

Download Submit
memory/1228-163-0x000001D484E10000-0x000001D484E20000-memory.dmp

Filesize
64KB

Download
memory/1228-168-0x000001D484E10000-0x000001D484E20000-memory.dmp

Filesize
64KB

Download
memory/1228-164-0x000001D484E10000-0x000001D484E20000-memory.dmp

Filesize
64KB

Download
memory/2300-150-0x0000000000930000-0x0000000000940000-memory.dmp

Filesize
64KB

Download
memory/2300-151-0x0000000000930000-0x0000000000940000-memory.dmp

Filesize
64KB

Download
memory/2300-156-0x0000000063780000-0x0000000063799000-memory.dmp

Filesize
100KB

Download
memory/2300-158-0x0000000000930000-0x0000000000940000-memory.dmp

Filesize
64KB

Download
memory/2300-159-0x0000000000930000-0x0000000000940000-memory.dmp

Filesize
64KB

Download
memory/2300-149-0x0000000000930000-0x0000000000940000-memory.dmp

Filesize
64KB

Download
memory/3496-171-0x0000000140000000-0x000000014166F000-memory.dmp

Filesize
22.4MB

Download
memory/3496-134-0x0000000140000000-0x000000014166F000-memory.dmp

Filesize
22.4MB

Download
memory/3496-142-0x0000000140000000-0x000000014166F000-memory.dmp

Filesize
22.4MB

Download
memory/3496-141-0x0000000140000000-0x000000014166F000-memory.dmp

Filesize
22.4MB

Download
memory/3496-155-0x0000000140000000-0x000000014166F000-memory.dmp

Filesize
22.4MB

Download
memory/3496-173-0x0000000140000000-0x000000014166F000-memory.dmp

Filesize
22.4MB

Download
memory/3496-177-0x0000000140000000-0x000000014166F000-memory.dmp

Filesize
22.4MB

Download
memory/3496-178-0x0000000140000000-0x000000014166F000-memory.dmp

Filesize
22.4MB

Download
memory/3496-180-0x0000000140000000-0x000000014166F000-memory.dmp

Filesize
22.4MB

Download
memory/3652-162-0x000001F29F410000-0x000001F29F420000-memory.dmp

Filesize
64KB

Download
memory/3652-161-0x000001F29F410000-0x000001F29F420000-memory.dmp

Filesize
64KB

Download
memory/3652-170-0x000001F29F410000-0x000001F29F420000-memory.dmp

Filesize
64KB

Download