7ddbec7fac00ec5624f45da5879ebfa97d95b21c7842cbaa1058daa46a47bd41

Analysis

max time kernel
59s
max time network
58s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 19:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c39e5e577360a09a924844399e1953fb.exe
Size

17.7MB
MD5

c39e5e577360a09a924844399e1953fb
SHA1

cfcede39f7afad0df9473c8cd9d328db72dbd90b
SHA256

e8955e77203db68470ff9461e2faf9deed3df0c3fab1b0fd5d4c8a6595f5c72c
SHA512

78b865dbbefafce9a9948a14e2013c3650d028d87e3ed4b2a5d4281687c826b3cd8044274c0e54853f6b48533ac07af3065c6ad34b629c22587f26ad5aee35c7
SSDEEP

393216:8YGbY6iHonlQCe88BYdY3SHFPJXFODKSblmY+:87Y2CCe4dAmFOmSJm9

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2524	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2744	AActtive.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KMSAuto-AActtive-API = "C:\\ProgramData\\KMSAuto\\AActtive.exe"	c39e5e577360a09a924844399e1953fb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1384	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe
2660	c39e5e577360a09a924844399e1953fb.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	c39e5e577360a09a924844399e1953fb.exe
Token: SeDebugPrivilege	2660	c39e5e577360a09a924844399e1953fb.exe
Token: SeDebugPrivilege	2744	AActtive.exe
Token: SeDebugPrivilege	2744	AActtive.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2780	2660	c39e5e577360a09a924844399e1953fb.exe	31
PID 2660 wrote to memory of 2780	2660	c39e5e577360a09a924844399e1953fb.exe	31
PID 2660 wrote to memory of 2780	2660	c39e5e577360a09a924844399e1953fb.exe	31
PID 2660 wrote to memory of 2744	2660	c39e5e577360a09a924844399e1953fb.exe	33
PID 2660 wrote to memory of 2744	2660	c39e5e577360a09a924844399e1953fb.exe	33
PID 2660 wrote to memory of 2744	2660	c39e5e577360a09a924844399e1953fb.exe	33
PID 2660 wrote to memory of 2524	2660	c39e5e577360a09a924844399e1953fb.exe	34
PID 2660 wrote to memory of 2524	2660	c39e5e577360a09a924844399e1953fb.exe	34
PID 2660 wrote to memory of 2524	2660	c39e5e577360a09a924844399e1953fb.exe	34
PID 2524 wrote to memory of 1384	2524	cmd.exe	36
PID 2524 wrote to memory of 1384	2524	cmd.exe	36
PID 2524 wrote to memory of 1384	2524	cmd.exe	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c39e5e577360a09a924844399e1953fb.exe
"C:\Users\Admin\AppData\Local\Temp\c39e5e577360a09a924844399e1953fb.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /create /tn KMSAuto-AActtive-API /tr "C:\ProgramData\KMSAuto\AActtive.exe" /st 19:58 /du 23:59 /sc daily /ri 1 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2780
- C:\ProgramData\KMSAuto\AActtive.exe
  "C:\ProgramData\KMSAuto\AActtive.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp2175.tmp.bat""
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\system32\timeout.exe
    timeout 6
    3⤵
    - Delays execution with timeout.exe
    PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\KMSAuto\AActtive.exe

Filesize
18.4MB

MD5
247b46be8d2ef44c1a0c5474b90e1cf6

SHA1
48dcba87b1d2f3daada9d8bca964d7680cd7f60e

SHA256
5e169fd02fdc74c097576fa99c90b38496cfe073ea8e8ffa7c7784f24df6c5d6

SHA512
4c0e1f72f15becbaf79f5c1b800380fa5b72044a3b4f8340176b14ef8c5079b35aa326951e6147e8c6d76550df2b63b3b23e749bdf9b370ddc45608aaf278b06

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2175.tmp.bat

Filesize
184B

MD5
f0df801d6204f6015f85229e39362ba2

SHA1
f1e7a3740756852f9fee585dc105138353e0d319

SHA256
7db647334c3d9bbd3a7c37c65a15fd7f43e92b47b9340b08ff591bb47db8a05c

SHA512
6011d05c807b57da470c787f432608154ef2b4fd25460b1decaa4b46862870e4fcf691caa28fce9ea86d150ea7974c63eeb5447b30b07b4039da1ff246382c8a

Download Submit
memory/2660-3-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

Filesize
9.9MB

Download
memory/2660-0-0x000007FEF5EB3000-0x000007FEF5EB4000-memory.dmp

Filesize
4KB

Download
memory/2660-4-0x000007FEF5EB3000-0x000007FEF5EB4000-memory.dmp

Filesize
4KB

Download
memory/2660-5-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

Filesize
9.9MB

Download
memory/2660-2-0x0000000000900000-0x000000000090E000-memory.dmp

Filesize
56KB

Download
memory/2660-1-0x0000000000920000-0x0000000000962000-memory.dmp

Filesize
264KB

Download
memory/2660-24-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

Filesize
9.9MB

Download
memory/2744-14-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

Filesize
9.9MB

Download
memory/2744-13-0x0000000001030000-0x0000000001072000-memory.dmp

Filesize
264KB

Download
memory/2744-15-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

Filesize
9.9MB

Download
memory/2744-25-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

Filesize
9.9MB

Download
memory/2744-26-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

Filesize
9.9MB

Download