Overview
overview
10Static
static
7KMS Tools ...2).zip
windows7-x64
1KMS Tools ...2).zip
windows10-2004-x64
1KMS Tools ...on.cmd
windows7-x64
1KMS Tools ...on.cmd
windows10-2004-x64
1KMS Tools ...le.chm
windows7-x64
1KMS Tools ...le.chm
windows10-2004-x64
1KMS Tools ...ck.exe
windows7-x64
10KMS Tools ...ck.exe
windows10-2004-x64
10KMS Tools ...++.ini
windows7-x64
1KMS Tools ...++.ini
windows10-2004-x64
1KMS Tools ...a0.exe
windows7-x64
1KMS Tools ...a0.exe
windows10-2004-x64
1KMS Tools ...a1.exe
windows7-x64
7KMS Tools ...a1.exe
windows10-2004-x64
3KMS Tools ...me.txt
windows7-x64
1KMS Tools ...me.txt
windows10-2004-x64
1Analysis
-
max time kernel
1595s -
max time network
1607s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
11-04-2023 17:47
Behavioral task
behavioral1
Sample
KMS Tools Portable (2).zip
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
KMS Tools Portable (2).zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
KMS Tools Portable/Add_Defender_Exclusion.cmd
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
KMS Tools Portable/Add_Defender_Exclusion.cmd
Resource
win10v2004-20230221-en
Behavioral task
behavioral5
Sample
KMS Tools Portable/KMS Tools Portable.chm
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
KMS Tools Portable/KMS Tools Portable.chm
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
KMS Tools Portable/KMS Tools Unpack.exe
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
KMS Tools Portable/KMS Tools Unpack.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
KMS Tools Portable/KMSAuto++.ini
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
KMS Tools Portable/KMSAuto++.ini
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
KMS Tools Portable/data0.exe
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
KMS Tools Portable/data0.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral13
Sample
KMS Tools Portable/data1.exe
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
KMS Tools Portable/data1.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
KMS Tools Portable/readme.txt
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
KMS Tools Portable/readme.txt
Resource
win10v2004-20230221-en
General
-
Target
KMS Tools Portable/KMS Tools Portable.chm
-
Size
645KB
-
MD5
16498d20922a580ad81241d9cf7dcdf0
-
SHA1
dc05b5089e993e85ee8e10b174a15f6bb03e2532
-
SHA256
7fbcbf065ce1626694df8c443c377d0478cf32601fe74b0fd742fbcfb4f94a3f
-
SHA512
5696b2c214311bc1e6f77ff77109d85fd15dbaf04b0ebbca67bcfb3fd054f85ee7c4dfde489dd2ae87a311f39a2fc14d9849ccaf4caeea7c03d88de5973594fa
-
SSDEEP
12288:05sHaRh+WTUuOGNfLecMT1oDe68MCUPAQiAnmApgxGhh/meSiPAF7:05rtTUgtLmordPACnmggonRYt
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main hh.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1640 hh.exe 1640 hh.exe