733f90847769a6c68371bf1c8eaa2a9afee9674a2f4e1d2ee477f8bb648c8ca6

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KMSAuto.exe
Size 22.8MB
Sample260702-eerscabw6z
SHA256 733f90847769a6c68371bf1c8eaa2a9afee9674a2f4e1d2ee477f8bb648c8ca6
MD5 203a9f49b827b389d7dec4770c6242e4
SHA1 1b1126df2ba82c7363dbf3629486755e4062248b
SHA512 2b288a96a76e725684309a6a89e41d63eb7805548e3d2e9347af17eed4a9cf3651c29ba5327c739a62ed0ce628f86ffa3b42de38c979939abc3141bb650e18b5
SSDEEP 393216:IGuhD/4VIfoCkhfO/zFXGW/F/P9wXiXzThbcey08epz:IGupsaRkdObGXYztbceyAz
TLSH
T1EE37CF11FBC240B1F5A3527085AAD33B8A377A114632CDDFF78C69497B33691993A329
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/files/0x000d00000001c594-27.dat	Nirsoft

Modifies Windows Firewall 2 TTPs 8 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5580	netsh.exe
5020	netsh.exe
1424	netsh.exe
6104	netsh.exe
5048	netsh.exe
1264	netsh.exe
1268	netsh.exe
1792	netsh.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\KMSEmulator\ImagePath = "\"C:\\Windows\\KMS\\bin\\KMSSS.exe\" -Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -PO16 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort -Log -IP"	KMSAuto.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 11 IoCs

pid	Process
6108	MSActBackup.exe
3368	pdk.dat
4828	OInstallLite.exe
3240	bin.dat
2788	pdk.dll
2940	OInstallLite.exe
5412	KMSSS.exe
5264	OInstallLite.exe
4300	OInstallLite.exe
1880	OInstallLite.exe
4848	OInstallLite.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\KMS\bin\KMSSS.exe	KMSAuto.exe
File opened for modification	C:\Windows\KMS\bin\KMSSS.log	KMSSS.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3636	sc.exe
5792	sc.exe
1212	sc.exe
1748	sc.exe
4896	sc.exe
4724	sc.exe
4288	sc.exe
4796	sc.exe
5748	sc.exe
1432	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OInstallLite.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OInstallLite.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSActBackup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pdk.dat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OInstallLite.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.dat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pdk.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OInstallLite.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KMSSS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OInstallLite.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KMSAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	KMSAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OInstallLite.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1012	WMIC.exe
1012	WMIC.exe
1012	WMIC.exe
1012	WMIC.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1012	WMIC.exe
Token: SeSecurityPrivilege	1012	WMIC.exe
Token: SeTakeOwnershipPrivilege	1012	WMIC.exe
Token: SeLoadDriverPrivilege	1012	WMIC.exe
Token: SeSystemProfilePrivilege	1012	WMIC.exe
Token: SeSystemtimePrivilege	1012	WMIC.exe
Token: SeProfSingleProcessPrivilege	1012	WMIC.exe
Token: SeIncBasePriorityPrivilege	1012	WMIC.exe
Token: SeCreatePagefilePrivilege	1012	WMIC.exe
Token: SeBackupPrivilege	1012	WMIC.exe
Token: SeRestorePrivilege	1012	WMIC.exe
Token: SeShutdownPrivilege	1012	WMIC.exe
Token: SeDebugPrivilege	1012	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1012	WMIC.exe
Token: SeRemoteShutdownPrivilege	1012	WMIC.exe
Token: SeUndockPrivilege	1012	WMIC.exe
Token: SeManageVolumePrivilege	1012	WMIC.exe
Token: 33	1012	WMIC.exe
Token: 34	1012	WMIC.exe
Token: 35	1012	WMIC.exe
Token: 36	1012	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1012	WMIC.exe
Token: SeSecurityPrivilege	1012	WMIC.exe
Token: SeTakeOwnershipPrivilege	1012	WMIC.exe
Token: SeLoadDriverPrivilege	1012	WMIC.exe
Token: SeSystemProfilePrivilege	1012	WMIC.exe
Token: SeSystemtimePrivilege	1012	WMIC.exe
Token: SeProfSingleProcessPrivilege	1012	WMIC.exe
Token: SeIncBasePriorityPrivilege	1012	WMIC.exe
Token: SeCreatePagefilePrivilege	1012	WMIC.exe
Token: SeBackupPrivilege	1012	WMIC.exe
Token: SeRestorePrivilege	1012	WMIC.exe
Token: SeShutdownPrivilege	1012	WMIC.exe
Token: SeDebugPrivilege	1012	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1012	WMIC.exe
Token: SeRemoteShutdownPrivilege	1012	WMIC.exe
Token: SeUndockPrivilege	1012	WMIC.exe
Token: SeManageVolumePrivilege	1012	WMIC.exe
Token: 33	1012	WMIC.exe
Token: 34	1012	WMIC.exe
Token: 35	1012	WMIC.exe
Token: 36	1012	WMIC.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1164	KMSAuto.exe
1164	KMSAuto.exe
1164	KMSAuto.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 3568	1164	KMSAuto.exe	88
PID 1164 wrote to memory of 4156	1164	KMSAuto.exe	90
PID 1164 wrote to memory of 1216	1164	KMSAuto.exe	92
PID 1164 wrote to memory of 5748	1164	KMSAuto.exe	94
PID 1164 wrote to memory of 1432	1164	KMSAuto.exe	96
PID 1164 wrote to memory of 2540	1164	KMSAuto.exe	98
PID 1164 wrote to memory of 5584	1164	KMSAuto.exe	100
PID 1164 wrote to memory of 1748	1164	KMSAuto.exe	102
PID 1164 wrote to memory of 4896	1164	KMSAuto.exe	104
PID 1164 wrote to memory of 2916	1164	KMSAuto.exe	107
PID 2916 wrote to memory of 3636	2916	cmd.exe	110
PID 1164 wrote to memory of 6108	1164	KMSAuto.exe	109
PID 6108 wrote to memory of 5836	6108	MSActBackup.exe	111
PID 5836 wrote to memory of 3368	5836	cmd.exe	113
PID 1164 wrote to memory of 4828	1164	KMSAuto.exe	114
PID 6108 wrote to memory of 432	6108	MSActBackup.exe	115
PID 432 wrote to memory of 3240	432	cmd.exe	117
PID 6108 wrote to memory of 5648	6108	MSActBackup.exe	118
PID 5648 wrote to memory of 204	5648	cmd.exe	120
PID 1164 wrote to memory of 5028	1164	KMSAuto.exe	121
PID 1164 wrote to memory of 2112	1164	KMSAuto.exe	123
PID 2112 wrote to memory of 4724	2112	cmd.exe	125
PID 1164 wrote to memory of 1444	1164	KMSAuto.exe	126
PID 1444 wrote to memory of 1424	1444	cmd.exe	129
PID 6108 wrote to memory of 1284	6108	MSActBackup.exe	130
PID 1284 wrote to memory of 2788	1284	cmd.exe	132
PID 1164 wrote to memory of 2348	1164	KMSAuto.exe	133
PID 2348 wrote to memory of 6104	2348	cmd.exe	135
PID 1164 wrote to memory of 3584	1164	KMSAuto.exe	136
PID 3584 wrote to memory of 1012	3584	cmd.exe	138
PID 1164 wrote to memory of 1556	1164	KMSAuto.exe	140
PID 1556 wrote to memory of 5048	1556	cmd.exe	142
PID 1164 wrote to memory of 5112	1164	KMSAuto.exe	143
PID 5112 wrote to memory of 1264	5112	cmd.exe	145
PID 1164 wrote to memory of 2152	1164	KMSAuto.exe	146
PID 1164 wrote to memory of 2940	1164	KMSAuto.exe	148
PID 1164 wrote to memory of 5908	1164	KMSAuto.exe	149
PID 1164 wrote to memory of 5848	1164	KMSAuto.exe	151
PID 5848 wrote to memory of 1268	5848	cmd.exe	153
PID 1164 wrote to memory of 2636	1164	KMSAuto.exe	154
PID 2636 wrote to memory of 1792	2636	cmd.exe	156
PID 1164 wrote to memory of 5060	1164	KMSAuto.exe	157
PID 5060 wrote to memory of 4288	5060	cmd.exe	159
PID 1164 wrote to memory of 4420	1164	KMSAuto.exe	160
PID 4420 wrote to memory of 5792	4420	cmd.exe	162
PID 1164 wrote to memory of 4452	1164	KMSAuto.exe	164
PID 1164 wrote to memory of 5952	1164	KMSAuto.exe	166
PID 4452 wrote to memory of 5580	4452	cmd.exe	168
PID 1164 wrote to memory of 5264	1164	KMSAuto.exe	169
PID 1164 wrote to memory of 4928	1164	KMSAuto.exe	170
PID 1164 wrote to memory of 5720	1164	KMSAuto.exe	172
PID 5720 wrote to memory of 5020	5720	cmd.exe	174
PID 1164 wrote to memory of 3948	1164	KMSAuto.exe	175
PID 3948 wrote to memory of 4796	3948	cmd.exe	177
PID 1164 wrote to memory of 3804	1164	KMSAuto.exe	178
PID 3804 wrote to memory of 1212	3804	cmd.exe	180
PID 1164 wrote to memory of 4300	1164	KMSAuto.exe	181
PID 1164 wrote to memory of 1544	1164	KMSAuto.exe	182
PID 1164 wrote to memory of 1880	1164	KMSAuto.exe	184
PID 1164 wrote to memory of 4264	1164	KMSAuto.exe	185
PID 1164 wrote to memory of 4848	1164	KMSAuto.exe	187
PID 1164 wrote to memory of 3308	1164	KMSAuto.exe	188

C:\Users\Admin\AppData\Local\Temp\KMSAuto.exe
"C:\Users\Admin\AppData\Local\Temp\KMSAuto.exe"
1⤵
- Sets service image path in registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c copy C:\Windows\system32\Tasks\KMSAuto "C:\Users\Admin\AppData\Local\Temp\KMSAuto.tmp" /Y
  2⤵
  PID:3568
- C:\Windows\system32\reg.exe
  "C:\Windows\Sysnative\reg.exe" query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /v DisableAntiSpyware
  2⤵
  PID:4156
- C:\Windows\system32\reg.exe
  "C:\Windows\Sysnative\reg.exe" query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
  2⤵
  PID:1216
- C:\Windows\system32\sc.exe
  "C:\Windows\Sysnative\sc.exe" query SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:5748
- C:\Windows\system32\sc.exe
  "C:\Windows\Sysnative\sc.exe" query WinDefend
  2⤵
  - Launches sc.exe
  PID:1432
- C:\Windows\system32\reg.exe
  "C:\Windows\Sysnative\reg.exe" query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /v DisableAntiSpyware
  2⤵
  PID:2540
- C:\Windows\system32\reg.exe
  "C:\Windows\Sysnative\reg.exe" query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware
  2⤵
  PID:5584
- C:\Windows\system32\sc.exe
  "C:\Windows\Sysnative\sc.exe" query SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:1748
- C:\Windows\system32\sc.exe
  "C:\Windows\Sysnative\sc.exe" query WinDefend
  2⤵
  - Launches sc.exe
  PID:4896
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c sc.exe stop KMSEmulator
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\system32\sc.exe
    sc.exe stop KMSEmulator
    3⤵
    - Launches sc.exe
    PID:3636
- C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe
  "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6108
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c pdk.dat -y -pkmsauto
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\pdk.dat
      pdk.dat -y -pkmsauto
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3368
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c bin.dat -y -pkmsauto
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Users\Admin\AppData\Local\Temp\bin.dat
      bin.dat -y -pkmsauto
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3240
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c cscript.exe MSActBackup.vbs //NoLogo
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5648
  - - C:\Windows\system32\cscript.exe
      cscript.exe MSActBackup.vbs //NoLogo
      4⤵
      PID:204
- - C:\Windows\system32\cmd.exe
    "C:\Windows\Sysnative\cmd.exe" /c pdk.dll /nosavereg /IEKeys 0 /WindowsKeys 1 /OfficeKeys 1 /sort 3 /ExtractEdition 1 /stext
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1284
  - - C:\Users\Admin\AppData\Local\Temp\PDK\pdk.dll
      pdk.dll /nosavereg /IEKeys 0 /WindowsKeys 1 /OfficeKeys 1 /sort 3 /ExtractEdition 1 /stext
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2788
- C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe
  "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=100
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4828
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q
  2⤵
  PID:5028
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c sc.exe delete KMSEmulator
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\system32\sc.exe
    sc.exe delete KMSEmulator
    3⤵
    - Launches sc.exe
    PID:4724
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1424
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:6104
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\KMS"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\KMS"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1012
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5048
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1264
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe" /F /Q
  2⤵
  PID:2152
- C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe
  "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=100
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2940
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q
  2⤵
  PID:5908
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5848
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1268
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS2 dir=out action=allow protocol=TCP localport=1688
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS2 dir=out action=allow protocol=TCP localport=1688
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1792
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c sc.exe create KMSEmulator binpath= temp.exe type= own start= auto
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\system32\sc.exe
    sc.exe create KMSEmulator binpath= temp.exe type= own start= auto
    3⤵
    - Launches sc.exe
    PID:4288
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c sc.exe start KMSEmulator
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\system32\sc.exe
    sc.exe start KMSEmulator
    3⤵
    - Launches sc.exe
    PID:5792
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5580
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe" /F /Q
  2⤵
  PID:5952
- C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe
  "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=100
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5264
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q
  2⤵
  PID:4928
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5720
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5020
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c sc.exe create KMSEmulator binpath= temp.exe type= own start= auto
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Windows\system32\sc.exe
    sc.exe create KMSEmulator binpath= temp.exe type= own start= auto
    3⤵
    - Launches sc.exe
    PID:4796
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c sc.exe start KMSEmulator
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\system32\sc.exe
    sc.exe start KMSEmulator
    3⤵
    - Launches sc.exe
    PID:1212
- C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe
  "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=100
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4300
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q
  2⤵
  PID:1544
- C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe
  "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=100
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1880
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q
  2⤵
  PID:4264
- C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe
  "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /x=100 /y=100
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4848
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe" /F /Q
  2⤵
  PID:3308

C:\Windows\KMS\bin\KMSSS.exe
"C:\Windows\KMS\bin\KMSSS.exe" -Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -PO16 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort -Log -IP
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

MSActBackUp.ini

Path C:\Users\Admin\AppData\Local\Temp\MSActBackUp.ini
Size 29B
SHA256 9226c1e7270875fbe1a767271aad96e7447086d2b8dbdfb2bac78432e6173629
MD5 d4e5c484aa6662fa1949c2e6d140e38d
SHA1 8fee8d4743d6e43179f12995a11a26a3cc82bd9f
SHA512 e87b2903cf405810f1f77d11b188708c504a0cccd2617d5a27d2567262392534f1c8c50fe29f186cd53748b9046ba9371b2ab0e049afd648a74a6df731e1d159
MD5 SHA1 SHA512

Submit Download

MSActBackUpPath.ini

Path C:\Users\Admin\AppData\Local\Temp\MSActBackUpPath.ini
Size 36B
SHA256 ad9e97b9f2190ba89ce6f4cc70f1c7b4a45d2603dac2c2cd81d0b30dac2c456f
MD5 1c2349d78149035ec324ef221af89a7f
SHA1 7a5fe3bccf80995db71879d39cebbb30e4758417
SHA512 aadc21c0a490f21d1fbc61c7bc1ec5b58671590e8377bbdf69f94d2b2157c4ef3dbdc84ce31cf82cc74e87ca5b8b44a40699248e118895c042c2a324dd9393c1
MD5 SHA1 SHA512

Submit Download

MSActBackup.exe

Path C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe
Size 1.1MB
SHA256 190b51fde585baac00b59f026acf36e501a18db726f850e1dcf192220b946bb0
MD5 bf5cb5abd4e5ba52d2bcc3af6c31db13
SHA1 2ff3d4b8fd1c7e0d40e8c4a3aa30fdd86176644f
SHA512 17f4ed70bdeef84dca517a8d39f1d48afb06bf6084d8ac4d46e780fb217272ad2fcc95b0e2ed094f8f358ce2146e9d7e3dfa902cdc0d6deeea3b802db3170668
SSDEEP 12288:T+S6RCgFDPPKR6UJr8WzA3qzJlwqku8FgIKXNvogIKXNvx+KDGgIKXNvdl:T+TRlFDPe+qzJlw7bCNwCNECNVl
TLSH
T11B45AE107BEAC0F2D5934530CCED6BF666756F088B2298C353C0BF19B9316D1AA36769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OInstallLite.exe

Path C:\Users\Admin\AppData\Local\Temp\OInstallLite.exe
Size 10.9MB
SHA256 9d45100d655589c0bb65c533cdd1b0bf1f82c5fa5d469efd6c7bc53211559795
MD5 a112555870a633dac6f0b317bd1d29da
SHA1 eb3dd265da458199bffe12cdc920fdb0d85e072c
SHA512 69c763779ff651382120a303f5ed89f6f2e9595ad4617950a79996c2cf9ad1cfc15c8a6230fbc969e6cc80eccdf02673f9b85187c90524979b96dc659b855ec8
SSDEEP 196608:yT4TbP7+AkZGvkhfO/7QyOU7XGW/F/P9w9xiXGqXCdUjdL:2IfoCkhfO/zFXGW/F/P9wXiXzTh
TLSH
T1DEB67C11EFC300B0F663927185AAD33BC7377A114432DEAFF64C9949BB33A51596A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdk.dll

Path C:\Users\Admin\AppData\Local\Temp\PDK\pdk.dll
Size 93KB
SHA256 814320cb353bcbd7f5df3fdb702487b14d1d1784e3af0f78c31496742a5f97c0
MD5 572c3a9213b1716851e7e3c971106b01
SHA1 f19056f326542459fdfe9465862e57c703409733
SHA512 ba39502b605be78aabfe54d695138202c835f834a3a9949ac3acb91ec64fbd89cc1e10becdfe96bfed84bfb71a2ae39dbadf439b4c86cab837190dccaeb9dd57
SSDEEP 1536:Oksz71hIrxMChN8lIDIT0PuuNZAX1b7k/5iECnKKbtNo2G4env4OUbiA/:871hixMCzBD91oX1b7k/U9LTG4env4tX
TLSH
T1F8936B43B7E04431F6E309702AF69B369EF57D715938C90F57545A8A2CB0780EE2A39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bin.dat

Path C:\Users\Admin\AppData\Local\Temp\bin.dat
Size 174KB
SHA256 635f4b5106767cc3b82e4d5fff081a028fbba08d0ff92c96f1163a34eab2086c
MD5 7758b09b145db821d9bfe5d322bf9576
SHA1 e0bc1c38095b72aaeb5ff7dd1622e8501c60f9cb
SHA512 780d479d0583d26e095a3f072396e665440961b65a7087304297d0b755cd990e7e5709cda8320e56d4b9bc6cee6c0abc498e68c546a34d0ea1d637748dd0b339
SSDEEP 3072:Ns2SFNy2gFHADJBehDWPKVj7J31JPUAAAAA+/MbNpdeuZBX/lYOgs:C/cgD+APKVjtbNCuZl/lD
TLSH
T139047C213AE5C1F7D28211308EDCABB6B1EA97480F1509C323D49B1D5F7AAE5D339A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSActBackup.vbs

Path C:\Users\Admin\AppData\Local\Temp\bin\MSActBackup.vbs
Size 34KB
SHA256 41df74896f1ab540efa72675b3fecb974af25abcee7b8bb28669d84811de3aa2
MD5 1474147d65a01143da2e7c4169801a6c
SHA1 85159efc968439e49befb85652029e7a582a3e1c
SHA512 b8d204fd4257d6e52905c0a5be1dd9d1c245c6868380c18a2ef6b12975e06af8c51438e04b516f7f7619cd9efa9d6885a0b9c6bef823767b288ce201296e8add
SSDEEP 384:2Grc7E0/hmpr7kcTcbzQ9eHF6YLSQR1vvY9WWNKe4VmE8vpgMDJRoILdHSZGbsHb:Tc7E0/spL9eHZfmGmEQv5OMaQ0mnoP7
TLSH
T140F2B79BFFCE91250A81C0A26D750953CDFDC272A2255DE5FF54882A22D1A4EC3BD3C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdk.dat

Path C:\Users\Admin\AppData\Local\Temp\pdk.dat
Size 211KB
SHA256 090f6e5e4a23d3ea6d0fc42d377135dfb5babedff9028c1bb254be7c323b7e11
MD5 75997577f7a961cafeba684f61dde343
SHA1 624fb0a6480323ebdebe6021bd53f5c7a394cc27
SHA512 4d7c1405f431ea04d503aad487aac721bfc43c191c4359c4daaf4a4a5c985a40c4ac3295fa09ac342ba4bc981ae19a78d0a75e076cbc0a9fec9a0911387272ce
SSDEEP 3072:Ns2SFNy2gFHADJBehDWPKVj7J31JPUAAAAA+/MbNpdeuZBX/lY8Z+H2vvr/7inxa:C/cgD+APKVjtbNCuZl/l/+Hqr/j
TLSH
T1DE249D213AE5C1F7C29215308EDCABB6B0FA97480F1508C723C49B1D5F76AE6D339A59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KMSSS.exe

Path C:\Windows\KMS\bin\KMSSS.exe
Size 35KB
SHA256 3506a4a739e12bd87fa706e8c098f238ef8fbd6167d9502d12ef8fccfd1acad7
MD5 fb2db5630b355c54db5133e0da1bd229
SHA1 e8b3ee78f6591d4915eb8aa64691e8b3786491a1
SHA512 5edbde297abe2527c76d29af109f9851d7f327bb31774c365c46a1715bd6609ac52ed5dd325ce6cf1187b46207ebd2cded8a2b874649780107a21e3b9c3fe60c
SSDEEP 384:Ywpny0JWtByh3n95GXNFCLoKnIi2quSTfqcEcXTdof0mhBjpLfh/oCqkg4XZmblC:Yw8ntq3S+8hsnUrekDDqfjGkI1T
TLSH
T16FF217C39AE26AB0F0B242F4445B9F07DA77623006E34655FBDE8091AED1943AF1E5C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KMSSS.log

Path C:\Windows\KMS\bin\KMSSS.log
Size 773B
SHA256 f5339de37611c665fd8ec0330e78bdedb62a785edd48035d1c85a9c688d8f396
MD5 93f5423f38fbc50e85ec26c371e548b2
SHA1 d72510004b83025973a61427744b10a9b6c8666d
SHA512 6c7dc7d42f5a0d43c888c9ad6251fb0c1950a52308f0d8cecd67b8ef6670d6d1589d2c253a795a2d5b22f07dd7c8e4ecd069515e7cd3ffac32823102a0996449
TLSH
T1AE014C005EDB7A954A63C98B04824D03D3A1E0234F5E390533DF60DB1BF4B69B3DC508
MD5 SHA1 SHA512 TLSH

Submit Download