General
- Target KMSAuto++.exe
- Size 22.8MB
- Sample260702-ec9kdabw6x
- SHA256 733f90847769a6c68371bf1c8eaa2a9afee9674a2f4e1d2ee477f8bb648c8ca6
Malware Config
Targets
-
- Target KMSAuto++.exe
- Size 22.8MB
- SHA256 733f90847769a6c68371bf1c8eaa2a9afee9674a2f4e1d2ee477f8bb648c8ca6
Score8/10-
Drops file in Drivers directory
-
Event Triggered Execution: Image File Execution Options Injection
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Modifies Windows Firewall
-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
-
Creates new service(s)
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Stops running service(s)
-
Indicator Removal: Clear Persistence
remove IFEO.
-
Drops file in System32 directory
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
2Disable or Modify System Firewall
1Indicator Removal
1Clear Persistence
1Modify Registry
2Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1