3611d70fd0636f5858bd4d436e75e4afc9fc8763a034254ad6d5033f4a64ef84

Analysis

max time kernel
1541s
max time network
1586s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2023 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KMS Tools Portable/Add_Defender_Exclusion.cmd
Size

1KB
MD5

38214e2bb08731ec3c69fa4c9ca86ef3
SHA1

e33f8d9852ab41bd9f2a545fb57cc7450c58f234
SHA256

908400a2ca52592d52d62daf9925dae7dc805e64ef613280b00711132ff99c54
SHA512

c675f4e66aca3a81affbad0252da343dd506ebb06069609d5a84a14a590cb6a66d5cea9939396eae6e64a45d00e2862008c587c700373b72cc280c07ef039e24

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2832	powershell.exe
2832	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2832	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 1608	2480	cmd.exe	84
PID 2480 wrote to memory of 1608	2480	cmd.exe	84
PID 2480 wrote to memory of 2832	2480	cmd.exe	85
PID 2480 wrote to memory of 2832	2480	cmd.exe	85
PID 2480 wrote to memory of 4312	2480	cmd.exe	87
PID 2480 wrote to memory of 4312	2480	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\KMS Tools Portable\Add_Defender_Exclusion.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\system32\reg.exe
  reg query "HKU\S-1-5-19\Environment"
  2⤵
  PID:1608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Powershell -nologo -noninteractive -windowStyle hidden -noprofile -command Add-MpPreference -ThreatIDDefaultAction_Ids 2147685180 -ThreatIDDefaultAction_Actions Allow -Force; Add-MpPreference -ThreatIDDefaultAction_Ids 2147735507 -ThreatIDDefaultAction_Actions Allow -Force; Add-MpPreference -ThreatIDDefaultAction_Ids 2147736914 -ThreatIDDefaultAction_Actions Allow -Force; Add-MpPreference -ThreatIDDefaultAction_Ids 2147743522 -ThreatIDDefaultAction_Actions Allow -Force; Add-MpPreference -ThreatIDDefaultAction_Ids 2147734094 -ThreatIDDefaultAction_Actions Allow -Force; Add-MpPreference -ThreatIDDefaultAction_Ids 2147743421 -ThreatIDDefaultAction_Actions Allow -Force; Add-MpPreference -ThreatIDDefaultAction_Ids 2147765679 -ThreatIDDefaultAction_Actions Allow -Force; Add-MpPreference -ThreatIDDefaultAction_Ids 251873 -ThreatIDDefaultAction_Actions Allow -Force; Add-MpPreference -ThreatIDDefaultAction_Ids 213927 -ThreatIDDefaultAction_Actions Allow -Force; Add-MpPreference -ThreatIDDefaultAction_Ids 2147722906 -ThreatIDDefaultAction_Actions Allow -Force; Add-MpPreference -ExclusionPath C:\Windows\KMSAutoS -Force; Add-MpPreference -ExclusionPath C:\Windows\System32\SppExtComObjHook.dll -Force; Add-MpPreference -ExclusionPath C:\Windows\System32\SppExtComObjPatcher.exe -Force; Add-MpPreference -ExclusionPath C:\Windows\AAct_Tools -Force; Add-MpPreference -ExclusionPath C:\Windows\AAct_Tools\AAct_x64.exe -Force; Add-MpPreference -ExclusionPath C:\Windows\AAct_Tools\AAct_files\KMSSS.exe -Force; Add-MpPreference -ExclusionPath C:\Windows\AAct_Tools\AAct_files -Force; Add-MpPreference -ExclusionPath C:\Windows\KMS -Force;
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2832
- C:\Windows\system32\reg.exe
  reg query "HKU\S-1-5-19\Environment"
  2⤵
  PID:4312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ul2dvvvx.x12.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2832-138-0x0000025608D40000-0x0000025608D62000-memory.dmp

Filesize
136KB

Download
memory/2832-143-0x0000025608D70000-0x0000025608D80000-memory.dmp

Filesize
64KB

Download
memory/2832-144-0x0000025608D70000-0x0000025608D80000-memory.dmp

Filesize
64KB

Download
memory/2832-145-0x0000025608D70000-0x0000025608D80000-memory.dmp

Filesize
64KB

Download