Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
22/03/2025, 06:18
General
-
Target
fc3b729bc6897f8c971ac81084f74f2ea976b7854afae826afefb1a34629bbf7.exe
-
Size
17.1MB
-
MD5
fa0e322603aaf81e5fa0a87eb1c09709
-
SHA1
06c4419a8d992ca2c5e0b082cb7b8884aedc7135
-
SHA256
fc3b729bc6897f8c971ac81084f74f2ea976b7854afae826afefb1a34629bbf7
-
SHA512
258082e619cb8ea13f97de4438eb2bbd98ab04bb744e7b3ae40eaa311feceba80d9110ec9f42c1867bc7d3c2d7baf296fac1b03cf9d38db17c4a83d753cc62c1
-
SSDEEP
393216:8YGbY6iHonlQCe88BGAOvDPuyyjIIn98BP7ZrsBSrOi83t:87Y2CCeSupnQsBFt
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc3b729bc6897f8c971ac81084f74f2ea976b7854afae826afefb1a34629bbf7.exe"C:\Users\Admin\AppData\Local\Temp\fc3b729bc6897f8c971ac81084f74f2ea976b7854afae826afefb1a34629bbf7.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /tn KMSAuto-AActtive-API /tr "C:\ProgramData\KMSAuto\AActtive.exe" /st 06:46 /du 23:59 /sc daily /ri 1 /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\ProgramData\KMSAuto\AActtive.exe"C:\ProgramData\KMSAuto\AActtive.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3E3.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 63⤵
- Delays execution with timeout.exe
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17.7MB
MD5f7af83ca864995e9e8e78be5612b3bf7
SHA128cf1ae7dcc5763db1cd4b42be7e53d724d8bf45
SHA256357503a706755c7ec7009c9a1ca754efc39edcfb54010cd6f0949347dca5a5a1
SHA51246130a47c30e3cc1231720677f4fb0956ad9fc84eac83547bbf349388f480e7025bc1ba4c04809bd9b43506a9498f6f7956ba3e1f8eaa373b265180de9df989c
-
Filesize
215B
MD54dde33b0bc1b92a783b1c87ec79efd10
SHA10037421be0d539e0b84970430a69384eb790f116
SHA256debb670977fb7a6de7ed67bec6ef4c8d4740a5bf0216037c1d5fe9ab5853b60a
SHA51286a273a78c3d83bf96dabcc87eb4668a213f46e4cdf7e288f2731e37e30bc0cdbf56451ee604efbbf02f44ee90b2206d772731c022c421159534c9a2849478e9
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
264KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
1.0MB