6650dcf52e02ab0459c72bf9bdbdeaa1c3748be49c4a45d04ebb18fae16baa01

Submit
Reports

Overview

overview

Static

static

All-In-One...76.cmd

windows7-x64

All-In-One...76.cmd

windows10-2004-x64

ReadMe.html

windows7-x64

ReadMe.html

windows10-2004-x64

Separate-F...y.html

windows7-x64

Separate-F...y.html

windows10-2004-x64

Separate-F...bs.cmd

windows7-x64

Separate-F...bs.cmd

windows10-2004-x64

Separate-F...Up.exe

windows10-2004-x64

Separate-F...o.html

windows7-x64

Separate-F...o.html

windows10-2004-x64

Separate-F...te.exe

windows7-x64

Separate-F...te.exe

windows10-2004-x64

Separate-F...lc.dll

windows7-x64

Separate-F...lc.dll

windows10-2004-x64

Separate-F...te.exe

windows10-2004-x64

Separate-F...lc.dll

windows7-x64

Separate-F...lc.dll

windows10-2004-x64

Separate-F...on.cmd

windows7-x64

Separate-F...on.cmd

windows10-2004-x64

Separate-F...on.cmd

windows7-x64

Separate-F...on.cmd

windows10-2004-x64

Separate-F...D.html

windows7-x64

Separate-F...D.html

windows10-2004-x64

Separate-F...8.html

windows7-x64

Separate-F...8.html

windows10-2004-x64

Separate-F...te.cmd

windows7-x64

Separate-F...te.cmd

windows10-2004-x64

Separate-F...o.html

windows7-x64

Separate-F...o.html

windows10-2004-x64

Separate-F...64.exe

windows7-x64

Separate-F...64.exe

windows10-2004-x64

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
25/11/2023, 06:58

Sharing

Copy URL Twitter E-mail

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

All-In-One-Version/MAS_1.5_AIO_CRC32_21D20776.cmd

Resource

win7-20231023-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral2

Sample

All-In-One-Version/MAS_1.5_AIO_CRC32_21D20776.cmd

Resource

win10v2004-20231023-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral3

Sample

ReadMe.html

Resource

win7-20231023-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral4

Sample

ReadMe.html

Resource

win10v2004-20231020-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral5

Sample

Separate-Files-Version/Activators/Activations_Summary.html

Resource

win7-20231023-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral6

Sample

Separate-Files-Version/Activators/Activations_Summary.html

Resource

win10v2004-20231020-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral7

Sample

Separate-Files-Version/Activators/Check-Activation-Status-vbs.cmd

Resource

win7-20231023-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral8

Sample

Separate-Files-Version/Activators/Check-Activation-Status-vbs.cmd

Resource

win10v2004-20231025-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral9

Sample

Separate-Files-Version/Activators/HWID-KMS38_Activation/BIN/ClipUp.exe

Resource

win10v2004-20231020-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

Separate-Files-Version/Activators/HWID-KMS38_Activation/BIN/_Info.html

Resource

win7-20231023-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral11

Sample

Separate-Files-Version/Activators/HWID-KMS38_Activation/BIN/_Info.html

Resource

win10v2004-20231023-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral12

Sample

Separate-Files-Version/Activators/HWID-KMS38_Activation/BIN/arm64_gatherosstate.exe

Resource

win7-20231020-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

Separate-Files-Version/Activators/HWID-KMS38_Activation/BIN/arm64_gatherosstate.exe

Resource

win10v2004-20231020-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

Separate-Files-Version/Activators/HWID-KMS38_Activation/BIN/arm64_slc.dll

Resource

win7-20231023-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

Separate-Files-Version/Activators/HWID-KMS38_Activation/BIN/arm64_slc.dll

Resource

win10v2004-20231020-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

Separate-Files-Version/Activators/HWID-KMS38_Activation/BIN/gatherosstate.exe

Resource

win10v2004-20231023-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral17

Sample

Separate-Files-Version/Activators/HWID-KMS38_Activation/BIN/slc.dll

Resource

win7-20231025-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral18

Sample

Separate-Files-Version/Activators/HWID-KMS38_Activation/BIN/slc.dll

Resource

win10v2004-20231023-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral19

Sample

Separate-Files-Version/Activators/HWID-KMS38_Activation/HWID_Activation.cmd

Resource

win7-20231023-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral20

Sample

Separate-Files-Version/Activators/HWID-KMS38_Activation/HWID_Activation.cmd

Resource

win10v2004-20231023-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral21

Sample

Separate-Files-Version/Activators/HWID-KMS38_Activation/KMS38_Activation.cmd

Resource

win7-20231020-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral22

Sample

Separate-Files-Version/Activators/HWID-KMS38_Activation/KMS38_Activation.cmd

Resource

win10v2004-20231025-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral23

Sample

Separate-Files-Version/Activators/HWID-KMS38_Activation/ReadMe_HWID.html

Resource

win7-20231020-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral24

Sample

Separate-Files-Version/Activators/HWID-KMS38_Activation/ReadMe_HWID.html

Resource

win10v2004-20231023-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral25

Sample

Separate-Files-Version/Activators/HWID-KMS38_Activation/ReadMe_KMS38.html

Resource

win7-20231020-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral26

Sample

Separate-Files-Version/Activators/HWID-KMS38_Activation/ReadMe_KMS38.html

Resource

win10v2004-20231023-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral27

Sample

Separate-Files-Version/Activators/Online_KMS_Activation/Activate.cmd

Resource

win7-20231020-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral28

Sample

Separate-Files-Version/Activators/Online_KMS_Activation/Activate.cmd

Resource

win10v2004-20231023-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral29

Sample

Separate-Files-Version/Activators/Online_KMS_Activation/BIN/_Info.html

Resource

win7-20231020-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral30

Sample

Separate-Files-Version/Activators/Online_KMS_Activation/BIN/_Info.html

Resource

win10v2004-20231023-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral31

Sample

Separate-Files-Version/Activators/Online_KMS_Activation/BIN/cleanosppx64.exe

Resource

win7-20231023-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral32

Sample

Separate-Files-Version/Activators/Online_KMS_Activation/BIN/cleanosppx64.exe

Resource

win10v2004-20231020-en

windows10-2004-x64

0 signatures

150 seconds

Report Analysis Logs

General

Target

Separate-Files-Version/Activators/HWID-KMS38_Activation/BIN/slc.dll
Size

7KB
MD5

f18dd5b638590be87ccd56fe338bed10
SHA1

da1afd97d92dd6026e7095ee7442a2144f78ed0b
SHA256

e7eca8c7476df70ef525ae55a0d8ccc715f22a727165a05fd4c380032cf763a9
SHA512

a3b3bbcdc3a3f83776793fd5b02578d59d38998f19a653467422e61127f063ad317d19857cd21e2723870cd1fdb6b0fe8dd436e07f2b93a7c9b4497f7e986662
SSDEEP

96:S8Jv8CeNzT55WbaCdYx23yPGHNcrwvUshE7y770WeZb:XE6ndYCAEyoRed

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2612	1932	rundll32.exe	28
PID 1932 wrote to memory of 2612	1932	rundll32.exe	28
PID 1932 wrote to memory of 2612	1932	rundll32.exe	28
PID 1932 wrote to memory of 2612	1932	rundll32.exe	28
PID 1932 wrote to memory of 2612	1932	rundll32.exe	28
PID 1932 wrote to memory of 2612	1932	rundll32.exe	28
PID 1932 wrote to memory of 2612	1932	rundll32.exe	28

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Separate-Files-Version\Activators\HWID-KMS38_Activation\BIN\slc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Separate-Files-Version\Activators\HWID-KMS38_Activation\BIN\slc.dll,#1
  2⤵
  PID:2612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2612-0-0x0000000064B40000-0x0000000064B46000-memory.dmp

Filesize
24KB

Download