Analysis
-
max time kernel
59s -
max time network
62s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
22/03/2025, 19:52
General
-
Target
c39e5e577360a09a924844399e1953fb.exe
-
Size
17.7MB
-
MD5
c39e5e577360a09a924844399e1953fb
-
SHA1
cfcede39f7afad0df9473c8cd9d328db72dbd90b
-
SHA256
e8955e77203db68470ff9461e2faf9deed3df0c3fab1b0fd5d4c8a6595f5c72c
-
SHA512
78b865dbbefafce9a9948a14e2013c3650d028d87e3ed4b2a5d4281687c826b3cd8044274c0e54853f6b48533ac07af3065c6ad34b629c22587f26ad5aee35c7
-
SSDEEP
393216:8YGbY6iHonlQCe88BYdY3SHFPJXFODKSblmY+:87Y2CCe4dAmFOmSJm9
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c39e5e577360a09a924844399e1953fb.exe"C:\Users\Admin\AppData\Local\Temp\c39e5e577360a09a924844399e1953fb.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /tn KMSAuto-AActtive-API /tr "C:\ProgramData\KMSAuto\AActtive.exe" /st 19:58 /du 23:59 /sc daily /ri 1 /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\ProgramData\KMSAuto\AActtive.exe"C:\ProgramData\KMSAuto\AActtive.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp81E2.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 63⤵
- Delays execution with timeout.exe
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18.4MB
MD5fb263adf1cc655c2902ebe744c05b781
SHA18d3b2d948ba445a8273ef418006797cc1a06cd6f
SHA2568135a7f275102af46805b206c00e12c069ebb642a8e0c9e27d01de792f86cce4
SHA5127392a989c8c341631d82b0e779a43e4d624d81f2b350a3b0d6576440b1cedfed1ef28a5888d1f65c9435e525067b13ed8cd782638ed0da26a3a7b55ef051020a
-
Filesize
184B
MD51cf37dc4b801d2d3ce202b7f7da557e9
SHA102d651c4507e149c1e1631327521f418ac863620
SHA256c9efa497e64301cab1947ba8b50e65ed8729c57147ef6b4bbc30ec5171058d7b
SHA51201a662420b22fdb5f50c91059c4b5318c62a01ecc6d5a69e9d23695fa4cec4af81eb0d5408730cb0e5f2f2496f33dcca6bac0953195a2a194f86a9c11e73c62c
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
264KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB