General
- Target KMSAuto++.exe
- Size 22.8MB
- Sample260702-efdl4sh13q
- SHA256 733f90847769a6c68371bf1c8eaa2a9afee9674a2f4e1d2ee477f8bb648c8ca6
Malware Config
Targets
-
- Target KMSAuto++.exe
- Size 22.8MB
- SHA256 733f90847769a6c68371bf1c8eaa2a9afee9674a2f4e1d2ee477f8bb648c8ca6
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Event Triggered Execution: Image File Execution Options Injection
-
Modifies Windows Firewall
-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
-
Creates new service(s)
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Stops running service(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
2Disable or Modify System Firewall
1Modify Registry
3