7ddbec7fac00ec5624f45da5879ebfa97d95b21c7842cbaa1058daa46a47bd41

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c39e5e577360a09a924844399e1953fb.exe
Size

17.7MB
MD5

c39e5e577360a09a924844399e1953fb
SHA1

cfcede39f7afad0df9473c8cd9d328db72dbd90b
SHA256

e8955e77203db68470ff9461e2faf9deed3df0c3fab1b0fd5d4c8a6595f5c72c
SHA512

78b865dbbefafce9a9948a14e2013c3650d028d87e3ed4b2a5d4281687c826b3cd8044274c0e54853f6b48533ac07af3065c6ad34b629c22587f26ad5aee35c7
SSDEEP

393216:8YGbY6iHonlQCe88BYdY3SHFPJXFODKSblmY+:87Y2CCe4dAmFOmSJm9

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2564	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2524	AActtive.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KMSAuto-AActtive-API = "C:\\ProgramData\\KMSAuto\\AActtive.exe"	c39e5e577360a09a924844399e1953fb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2988	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2824	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe
2840	c39e5e577360a09a924844399e1953fb.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2840	c39e5e577360a09a924844399e1953fb.exe
Token: SeDebugPrivilege	2840	c39e5e577360a09a924844399e1953fb.exe
Token: SeDebugPrivilege	2524	AActtive.exe
Token: SeDebugPrivilege	2524	AActtive.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2824	2840	c39e5e577360a09a924844399e1953fb.exe	28
PID 2840 wrote to memory of 2824	2840	c39e5e577360a09a924844399e1953fb.exe	28
PID 2840 wrote to memory of 2824	2840	c39e5e577360a09a924844399e1953fb.exe	28
PID 2840 wrote to memory of 2524	2840	c39e5e577360a09a924844399e1953fb.exe	30
PID 2840 wrote to memory of 2524	2840	c39e5e577360a09a924844399e1953fb.exe	30
PID 2840 wrote to memory of 2524	2840	c39e5e577360a09a924844399e1953fb.exe	30
PID 2840 wrote to memory of 2564	2840	c39e5e577360a09a924844399e1953fb.exe	31
PID 2840 wrote to memory of 2564	2840	c39e5e577360a09a924844399e1953fb.exe	31
PID 2840 wrote to memory of 2564	2840	c39e5e577360a09a924844399e1953fb.exe	31
PID 2564 wrote to memory of 2988	2564	cmd.exe	33
PID 2564 wrote to memory of 2988	2564	cmd.exe	33
PID 2564 wrote to memory of 2988	2564	cmd.exe	33

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c39e5e577360a09a924844399e1953fb.exe
"C:\Users\Admin\AppData\Local\Temp\c39e5e577360a09a924844399e1953fb.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /create /tn KMSAuto-AActtive-API /tr "C:\ProgramData\KMSAuto\AActtive.exe" /st 06:37 /du 23:59 /sc daily /ri 1 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2824
- C:\ProgramData\KMSAuto\AActtive.exe
  "C:\ProgramData\KMSAuto\AActtive.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2524
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpAF23.tmp.bat""
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\system32\timeout.exe
    timeout 6
    3⤵
    - Delays execution with timeout.exe
    PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\KMSAuto\AActtive.exe

Filesize
18.4MB

MD5
920913e9deadf2fbc5fa183f0e504125

SHA1
972547207cf44e7789aebf935d8a91b048643ae2

SHA256
db02d2780dee263eaed2002e5344ab7cde578869bd0bde9af876832ba61d81ab

SHA512
ea60c2c2b5f0c55d0b9fea7f290b5e381540f26a0e4e7469cf22c204dc374e6eb1c42c94c8bbbb2e6e00ab8bf43c246cb73d32f5e8a64e2f3635a48a0affcc5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpAF23.tmp.bat

Filesize
184B

MD5
8c1177daaa0f9b76b6a7ff57da74bc66

SHA1
51aa67545d15ded18bcfcf3be15fafc152be8a2b

SHA256
ca8987eeaa60e2f73f1cb8de214892e1b636cb17b9dbf58597c7c91b1d1603a8

SHA512
67bc67e82853d2fb73fc08161c886e18c89d69b53b8c8df9c15be886dd4fbe8eeb883f70830a495e5a124615a8d72344cf4e779eeca5939f774a0541a73dd5d9

Download Submit
memory/2524-15-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/2524-13-0x0000000000260000-0x00000000002A2000-memory.dmp

Filesize
264KB

Download
memory/2524-14-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/2524-25-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/2524-26-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/2840-3-0x00000000002C0000-0x00000000002CE000-memory.dmp

Filesize
56KB

Download
memory/2840-4-0x000007FEF55E3000-0x000007FEF55E4000-memory.dmp

Filesize
4KB

Download
memory/2840-5-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/2840-24-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/2840-2-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/2840-0-0x000007FEF55E3000-0x000007FEF55E4000-memory.dmp

Filesize
4KB

Download
memory/2840-1-0x0000000000E20000-0x0000000000E62000-memory.dmp

Filesize
264KB

Download