Overview

overview

8

Static

static

3

KMSpico 10...co.exe

windows10-2004-x64

8

KMSpico 10...co.exe

windows11-ltsc_2024-x64

8

KMSpico 10...r2.dll

windows10-2004-x64

1

KMSpico 10...r2.dll

windows11-ltsc_2024-x64

1

KMSpico 10...DI.exe

windows10-2004-x64

8

KMSpico 10...DI.exe

windows11-ltsc_2024-x64

8

KMSpico 10...rk.cmd

windows10-2004-x64

8

KMSpico 10...rk.cmd

windows11-ltsc_2024-x64

8

KMSpico 10.../U.cmd

windows10-2004-x64

1

KMSpico 10.../U.cmd

windows11-ltsc_2024-x64

1

KMSpico 10.../U.cmd

windows10-2004-x64

1

KMSpico 10.../U.cmd

windows11-ltsc_2024-x64

8

KMSpico 10.../U.cmd

windows10-2004-x64

1

KMSpico 10.../U.cmd

windows11-ltsc_2024-x64

1

KMSpico 10...ib.dll

windows10-2004-x64

1

KMSpico 10...ib.dll

windows11-ltsc_2024-x64

1

KMSpico 10...er.cmd

windows10-2004-x64

1

KMSpico 10...er.cmd

windows11-ltsc_2024-x64

8

KMSpico 10....0.exe

windows10-2004-x64

8

KMSpico 10....0.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

8

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

bin/devcon.exe

windows10-2004-x64

1

bin/devcon.exe

windows11-ltsc_2024-x64

8

driver/tap0901.sys

windows10-2004-x64

1

driver/tap0901.sys

windows11-ltsc_2024-x64

1

KMSpico 10...ET.url

windows10-2004-x64

1

KMSpico 10...ET.url

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    kmspico_10.2.0_final.rar
  • Size 3.9MB
  • Sample260703-pjp5esg151
  • SHA256 c86b29f554a8b37b0b835271e4ad32ba91638f86b05a3cbb9b0b5503eae561b8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutioninstallerpersistenceransomwarespywaretrojan

Malware Config

Targets

    • Target
      KMSpico 10.2.0 FINAL + Portable (Office and Windows 10 Activator) [TechTools.NET]/KMSpico Portable/AutoPico.exe
    • Size 728KB
    • SHA256 4a714d98ce40f5f3577c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasionexecutionpersistence
    behavioral1behavioral2
    • Target
      KMSpico 10.2.0 FINAL + Portable (Office and Windows 10 Activator) [TechTools.NET]/KMSpico Portable/DevComponents.DotNetBar2.dll
    • Size 5.2MB
    • SHA256 fa76151a783250014ac8fa55d4c833100a623fcad1d6e2ddadcde259f5709609
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      KMSpico 10.2.0 FINAL + Portable (Office and Windows 10 Activator) [TechTools.NET]/KMSpico Portable/KMSELDI.exe
    • Size 921KB
    • SHA256 50ebfa1dd5b147e40244607d5d5be25709edf2cc66247a78beb920c77ac514cc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    persistencedefense_evasion

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Indicator Removal: Clear Persistence

      remove IFEO.

      defense_evasion
    behavioral5behavioral6
    • Target
      KMSpico 10.2.0 FINAL + Portable (Office and Windows 10 Activator) [TechTools.NET]/KMSpico Portable/RemoveWaterMark.cmd
    • Size 96B
    • SHA256 b991f07494e570a55efa8f93108a277ff110a38a8e4bc9bd47e894e872063ec1
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    defense_evasionexecutionpersistenceadwareransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Creates new service(s)

      persistenceexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Stops running service(s)

      defense_evasionexecution

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Indicator Removal: Clear Persistence

      remove IFEO.

      defense_evasion
    behavioral7behavioral8
    • Target
      KMSpico 10.2.0 FINAL + Portable (Office and Windows 10 Activator) [TechTools.NET]/KMSpico Portable/Uninstall/EnableSmartScreen.cmd
    • Size 72B
    • SHA256 c46a27e951658bb62d27496245a307713413e22762bab12eda98d15f6a796b88
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      KMSpico 10.2.0 FINAL + Portable (Office and Windows 10 Activator) [TechTools.NET]/KMSpico Portable/Uninstall/Remove_ScheduleTask.cmd
    • Size 88B
    • SHA256 8bda0b92e45f9627c20a8c983c11d8fd8e844e632081eca15e66e8f73d3bc551
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    persistenceadwareransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral11behavioral12
    • Target
      KMSpico 10.2.0 FINAL + Portable (Office and Windows 10 Activator) [TechTools.NET]/KMSpico Portable/Uninstall/Restore_Watermark.cmd
    • Size 1KB
    • SHA256 16b4c96db1fa9ba2fdcfb91972d537a7346f1c80daa164bfd9295d45f1c0b520
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      KMSpico 10.2.0 FINAL + Portable (Office and Windows 10 Activator) [TechTools.NET]/KMSpico Portable/Vestris.ResourceLib.dll
    • Size 88KB
    • SHA256 392d73617fd0a55218261572ece2f50301e0cfa29b5ed24c3f692130aa406af3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16
    • Target
      KMSpico 10.2.0 FINAL + Portable (Office and Windows 10 Activator) [TechTools.NET]/KMSpico Portable/driver/UnInstallDriver.cmd
    • Size 114B
    • SHA256 d2613d339ff4fa9e8d49866e62385c7b562c6eae14bd72d1567a8795c3157a21
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral17behavioral18
    • Target
      KMSpico 10.2.0 FINAL + Portable (Office and Windows 10 Activator) [TechTools.NET]/KMSpico Portable/driver/tap-windows-9.21.0.exe
    • Size 220KB
    • SHA256 325222566df55b85eeae5247ec08bbf555bf2bde00d14cb1a8cf323df4a97c03
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoveryspywaretrojanadwarepersistenceransomware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Drops file in Drivers directory

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral19behavioral20
    • Target
      $PLUGINSDIR/InstallOptions.dll
    • Size 14KB
    • SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    discoveryadwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral21behavioral22
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral23behavioral24
    • Target
      bin/devcon.exe
    • Size 80KB
    • SHA256 dd330533dc89aeb9fdef2e2cf5cfecef19efd65d46ff2a503d40fb800d2db23d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    adwarepersistencespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral25behavioral26
    • Target
      driver/tap0901.sys
    • Size 26KB
    • SHA256 b4d7dbddecf5c8e632b1207311bc7899a0e0cd1020a46ecb59955c6b9361cf7a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27behavioral28
    • Target
      KMSpico 10.2.0 FINAL + Portable (Office and Windows 10 Activator) [TechTools.NET]/TechTools.NET.URL
    • Size 209B
    • SHA256 804476c2d5c96145f0b0e06aefab4531573d27b4c3db4b7753f995a18fe56257
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral29behavioral30

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2
T1569

Service Execution

2
T1569.002

Persistence

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Impair Defenses

1
T1562

Indicator Removal

1
T1070

Clear Persistence

1
T1070.009

Modify Registry

3
T1112

Subvert Trust Controls

2
T1553

Install Root Certificate

1
T1553.004

SIP and Trust Provider Hijacking

1
T1553.003

Credential Access

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

4
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1
T1489

Tasks

static1

installer
Score
3/10

behavioral1

defense_evasionexecutionpersistence
Score
8/10

behavioral2

defense_evasionpersistence
Score
8/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

persistence
Score
8/10

behavioral6

defense_evasionpersistence
Score
8/10

behavioral7

defense_evasionexecutionpersistence
Score
8/10

behavioral8

adwaredefense_evasionpersistenceransomwarespyware
Score
8/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

persistence
Score
1/10

behavioral12

adwarepersistenceransomwarespyware
Score
8/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

adwarepersistenceransomwarespyware
Score
8/10

behavioral19

defense_evasiondiscoveryspywaretrojan
Score
8/10

behavioral20

adwarediscoverypersistenceransomwarespyware
Score
8/10

behavioral21

discovery
Score
3/10

behavioral22

adwarediscoverypersistenceransomwarespyware
Score
8/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

Score
1/10

behavioral26

adwarepersistencespyware
Score
8/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10