7ddbec7fac00ec5624f45da5879ebfa97d95b21c7842cbaa1058daa46a47bd41

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c39e5e577360a09a924844399e1953fb.exe
Size

17.7MB
MD5

c39e5e577360a09a924844399e1953fb
SHA1

cfcede39f7afad0df9473c8cd9d328db72dbd90b
SHA256

e8955e77203db68470ff9461e2faf9deed3df0c3fab1b0fd5d4c8a6595f5c72c
SHA512

78b865dbbefafce9a9948a14e2013c3650d028d87e3ed4b2a5d4281687c826b3cd8044274c0e54853f6b48533ac07af3065c6ad34b629c22587f26ad5aee35c7
SSDEEP

393216:8YGbY6iHonlQCe88BYdY3SHFPJXFODKSblmY+:87Y2CCe4dAmFOmSJm9

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	c39e5e577360a09a924844399e1953fb.exe

Executes dropped EXE 1 IoCs

pid	Process
4520	AActtive.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KMSAuto-AActtive-API = "C:\\ProgramData\\KMSAuto\\AActtive.exe"	c39e5e577360a09a924844399e1953fb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5020	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3852	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe
2272	c39e5e577360a09a924844399e1953fb.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2272	c39e5e577360a09a924844399e1953fb.exe
Token: SeDebugPrivilege	2272	c39e5e577360a09a924844399e1953fb.exe
Token: SeDebugPrivilege	4520	AActtive.exe
Token: SeDebugPrivilege	4520	AActtive.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 3852	2272	c39e5e577360a09a924844399e1953fb.exe	94
PID 2272 wrote to memory of 3852	2272	c39e5e577360a09a924844399e1953fb.exe	94
PID 2272 wrote to memory of 4520	2272	c39e5e577360a09a924844399e1953fb.exe	96
PID 2272 wrote to memory of 4520	2272	c39e5e577360a09a924844399e1953fb.exe	96
PID 2272 wrote to memory of 3392	2272	c39e5e577360a09a924844399e1953fb.exe	97
PID 2272 wrote to memory of 3392	2272	c39e5e577360a09a924844399e1953fb.exe	97
PID 3392 wrote to memory of 5020	3392	cmd.exe	99
PID 3392 wrote to memory of 5020	3392	cmd.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c39e5e577360a09a924844399e1953fb.exe
"C:\Users\Admin\AppData\Local\Temp\c39e5e577360a09a924844399e1953fb.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /tn KMSAuto-AActtive-API /tr "C:\ProgramData\KMSAuto\AActtive.exe" /st 06:37 /du 23:59 /sc daily /ri 1 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3852
- C:\ProgramData\KMSAuto\AActtive.exe
  "C:\ProgramData\KMSAuto\AActtive.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA053.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Windows\system32\timeout.exe
    timeout 6
    3⤵
    - Delays execution with timeout.exe
    PID:5020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\KMSAuto\AActtive.exe

Filesize
18.4MB

MD5
bc85770d01b21da949e9019f50b84481

SHA1
3aed7e918f330975dc2dc39e32967edc7961dbcd

SHA256
6ec109ac7f4a781db80d1272ecb987ea76f39d32f6d8a3c07b523a23cf93c888

SHA512
9646c7fd2d97554305c22088ec899081bbf55387419848d6ed8589fcaf3c5f17326533394c0f61feb8e977c39e17142ee700cd85d8b21f8d77c39df54e8d435e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA053.tmp.bat

Filesize
184B

MD5
6bdd18f4e229bff0b21ebf03a11a5b27

SHA1
484851686323784fdb99f9ddc3bf7b530fac325e

SHA256
348912afe6b0e97e39afb9423ec21d1d9a3a040f83de1df7a2836ec439f41b67

SHA512
a1285023bcfb261216b87d990019fa068d974f9951f886fec1b1f4ba338377dc1a6f1844580519debf3abdb90aeec386bdd38139412934baaacd746e857874c8

Download Submit
memory/2272-1-0x0000000000F70000-0x0000000000FB2000-memory.dmp

Filesize
264KB

Download
memory/2272-2-0x0000000001640000-0x000000000164E000-memory.dmp

Filesize
56KB

Download
memory/2272-0-0x00007FFA596F3000-0x00007FFA596F5000-memory.dmp

Filesize
8KB

Download
memory/2272-3-0x00007FFA596F0000-0x00007FFA5A1B1000-memory.dmp

Filesize
10.8MB

Download
memory/2272-4-0x00007FFA596F3000-0x00007FFA596F5000-memory.dmp

Filesize
8KB

Download
memory/2272-5-0x00007FFA596F0000-0x00007FFA5A1B1000-memory.dmp

Filesize
10.8MB

Download
memory/2272-18-0x00007FFA596F0000-0x00007FFA5A1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4520-17-0x00007FFA596F0000-0x00007FFA5A1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4520-19-0x00007FFA596F0000-0x00007FFA5A1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4520-21-0x00007FFA596F0000-0x00007FFA5A1B1000-memory.dmp

Filesize
10.8MB

Download