c085209c5b01d2a516a40e18cefdf5b4bdf5131f3a7f66bf91762cc151169a60 | Triage

Sharing

General

Target

KMSAuto Lite x64 1.8.6.exe
Size

6.3MB
Sample

241017-tzwpcsvaqc
MD5

7b3563b8dae4dc736c16716eb88a3a37
SHA1

639455f16ad599cdaef71f906cea414ab73bb68b
SHA256

c085209c5b01d2a516a40e18cefdf5b4bdf5131f3a7f66bf91762cc151169a60
SHA512

b36a1d8698b8aaf21ec58212afd2b7ff41d3c6a4e2cb9e5f75cf84e6e58d37cb5b8c742f0f4d8ed487c8815d1db9f965dabf3ca83095df933d0baa78058f3ef0
SSDEEP

98304:vUfwPRIkF+DywzlCbj/TSYDExAdmcROSdT7RX1:vUfaRTFzwzehoAwI7h1

Score

8^/10

defense_evasion discovery evasion execution persistence privilege_escalation

Malware Config

Targets

- Target
  
  KMSAuto Lite x64 1.8.6.exe
- Size
  
  6.3MB
- MD5
  
  7b3563b8dae4dc736c16716eb88a3a37
- SHA1
  
  639455f16ad599cdaef71f906cea414ab73bb68b
- SHA256
  
  c085209c5b01d2a516a40e18cefdf5b4bdf5131f3a7f66bf91762cc151169a60
- SHA512
  
  b36a1d8698b8aaf21ec58212afd2b7ff41d3c6a4e2cb9e5f75cf84e6e58d37cb5b8c742f0f4d8ed487c8815d1db9f965dabf3ca83095df933d0baa78058f3ef0
- SSDEEP
  
  98304:vUfwPRIkF+DywzlCbj/TSYDExAdmcROSdT7RX1:vUfaRTFzwzehoAwI7h1
Score

8^/10

defense_evasion discovery evasion execution persistence privilege_escalation
- Creates new service(s)
  persistence execution
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Modifies Windows Firewall
  evasion
- Sets service image path in registry
  persistence
- Stops running service(s)
  evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Image File Execution Options Injection

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Image File Execution Options Injection

Netsh Helper DLL

Defense Evasion

File and Directory Permissions Modification

Impair Defenses

Disable or Modify System Firewall

Indicator Removal

Clear Persistence

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalation