Analysis

  • max time kernel
    51s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-06-2024 10:29

General

  • Target

    HEU_KMS_Activator_v41.0.0/HEU_KMS_Activator_41.0.0.exe

  • Size

    4.6MB

  • MD5

    fa79df6039c561f575313df699569ebb

  • SHA1

    5cb7335465260a3cf159c094b4b03f6015acfc31

  • SHA256

    97ea175e7c52b285708da26e606ff311538e03a4f875a59ded57cb8adf2f2c6d

  • SHA512

    76710f37f80e1880f7d201cb1188040d170a905a1c3c5a198b0171925f54e85f31bf43c8bf153da54fcd8268fd28158e36f351188859f56ca755b0c82d65ff42

  • SSDEEP

    98304:D+S9bg/0D8Gq3oWf+am87F/dazGbHvmcoVMRuT7mGfVmH68xeOq8:iMcsD8Gq3oqxJoybeBVLnmKVma8IP8

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Windows directory 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HEU_KMS_Activator_v41.0.0\HEU_KMS_Activator_41.0.0.exe
    "C:\Users\Admin\AppData\Local\Temp\HEU_KMS_Activator_v41.0.0\HEU_KMS_Activator_41.0.0.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4188
    • C:\Windows\_temp_heu168yyds\7Z.EXE
      "C:\Windows\_temp_heu168yyds\7Z.EXE" x "C:\Windows\_temp_heu168yyds\KMSmini.7z" -y -o"C:\Windows\_temp_heu168yyds"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4600
    • C:\Windows\_temp_heu168yyds\x64\kms_x64.exe
      C:\Windows\_temp_heu168yyds\x64\kms_x64.exe
      2⤵
      • Executes dropped EXE
      • NTFS ADS
      PID:412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ScriptTemp.ini

    Filesize

    141B

    MD5

    07519d22697940ba191d3eeb68436ab3

    SHA1

    a2e79391705a6fd849dbdc79d457ec2d2ebf392c

    SHA256

    e8d819f57a235e7a4e03ba7fa2e0d8e0a2b00d5c2456f7dba26f107caa3c8bea

    SHA512

    25e830a135d1cf3a26b3a4d4a3b90db9ca39d5f4ac7efac8fba02cb91663b6a656c76ea34821567f80e3be3bb3f1f960b2bfcba5386baf963d41644a1897886d

  • C:\Users\Admin\AppData\Local\Temp\autA549.tmp

    Filesize

    2.0MB

    MD5

    7c95298d1611c9e4bb4be126003cdc20

    SHA1

    a59c8d542ff8210797247b0d8f0746ed1add66e1

    SHA256

    f4f6f45d26e2b15267c59452b10b7b1d890a3b65e647adeb4c7296d90c34b7df

    SHA512

    5104664b3036d5ee4209112db2f2da833e177a83691ad438fc20c467e80cfcedc784de6aae27401f40fa9bd9a3a6c6935702c0e42e3dc7f6afe64853021bf8be

  • C:\Windows\_temp_heu168yyds\7Z.EXE

    Filesize

    722KB

    MD5

    43141e85e7c36e31b52b22ab94d5e574

    SHA1

    cfd7079a9b268d84b856dc668edbb9ab9ef35312

    SHA256

    ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d

    SHA512

    9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc

  • C:\Windows\_temp_heu168yyds\files.7z

    Filesize

    1.4MB

    MD5

    c7926c9b1dfe047575916f8016f36555

    SHA1

    88f149b25d40e4d124c45bef48a82d69fc5e7e34

    SHA256

    c02c302c2f9861b4120664ad32b74280a5f13dae54735ad858691837aa496888

    SHA512

    68e2efe32be775eff0c6c949ac5f3770be1ac9a5baabd85b73e6e0d987b4b593329d829a6cdd111379637adc81caf1cdc542d43c420c102405c239ee85cf9ec2

  • C:\Windows\_temp_heu168yyds\x64\kms_x64.exe

    Filesize

    1.4MB

    MD5

    4a7d374c8ad8419fa832fd29486024d0

    SHA1

    e8793db9705d7beac3dc3c0394ed58ffd0022708

    SHA256

    69ce16ddba934782fa656a69c28daef291f55d11ff19d78b83bd6736e6d6a8d1

    SHA512

    55464c7f7c5918dee4f882e0f4c40758070c7d474be2cc763d6675cfc497464d11005e6c49f87eb1dc7603c831aec84d034dd0ccb1557b8221910191eb58b7aa

  • memory/412-208-0x00007FF6F3200000-0x00007FF6F351B000-memory.dmp

    Filesize

    3.1MB

  • memory/412-212-0x00007FF6F3200000-0x00007FF6F351B000-memory.dmp

    Filesize

    3.1MB

  • memory/4188-0-0x0000000000B20000-0x0000000001476000-memory.dmp

    Filesize

    9.3MB

  • memory/4188-211-0x0000000000B20000-0x0000000001476000-memory.dmp

    Filesize

    9.3MB

  • memory/4188-213-0x0000000000B20000-0x0000000001476000-memory.dmp

    Filesize

    9.3MB