c3b3c92fbde392fe872dc980dfd9b44e7754af2a36fa4f4c3ce8177f763c275a

Analysis

max time kernel
150s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 10:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KMSAuto.exe
Size 84.2MB
Sample260705-l8e4zaft3k
SHA256 c3b3c92fbde392fe872dc980dfd9b44e7754af2a36fa4f4c3ce8177f763c275a
MD5 cd2d616c9fd17fd1dbf2857006cc643a
SHA1 764ff313855a39d537f599189be3fdb9bf420b37
SHA512 60953dfd6a51dd1f84433ebbfdd2217c8919f920e2a6377de34b2c3d30e59ce7eef2a2a6bf108b248fd98f4a3dbab39eb06db06e5b4ab80f500f96a40e262954
SSDEEP 393216:pA8R+jJqy2uq3xv7KstO9oCFsqdOrjaj+XvfF42a0ZvMZKfRO13bzwXls8vrnqwS:pA8R+jlnCK0lCFsTpTNvHBO
TLSH
T146187D03F2A341D9C06AC17587D6A233F671BC0A5B34A6DB368C4B222F76BE05B39755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5232	powershell.exe
5760	powershell.exe
5820	powershell.exe
5820	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1580	0o3qwa2y8m.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2336	WMIC.exe
5656	wmic.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4440	KMSAuto.exe
4440	KMSAuto.exe
4440	KMSAuto.exe
4440	KMSAuto.exe
4440	KMSAuto.exe
4440	KMSAuto.exe
2336	WMIC.exe
2336	WMIC.exe
2336	WMIC.exe
2336	WMIC.exe
5232	powershell.exe
5232	powershell.exe
5760	powershell.exe
5760	powershell.exe
5820	powershell.exe
5820	powershell.exe
5656	wmic.exe
5656	wmic.exe
5656	wmic.exe
5656	wmic.exe
1580	0o3qwa2y8m.exe
1580	0o3qwa2y8m.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2336	WMIC.exe
Token: SeSecurityPrivilege	2336	WMIC.exe
Token: SeTakeOwnershipPrivilege	2336	WMIC.exe
Token: SeLoadDriverPrivilege	2336	WMIC.exe
Token: SeSystemProfilePrivilege	2336	WMIC.exe
Token: SeSystemtimePrivilege	2336	WMIC.exe
Token: SeProfSingleProcessPrivilege	2336	WMIC.exe
Token: SeIncBasePriorityPrivilege	2336	WMIC.exe
Token: SeCreatePagefilePrivilege	2336	WMIC.exe
Token: SeBackupPrivilege	2336	WMIC.exe
Token: SeRestorePrivilege	2336	WMIC.exe
Token: SeShutdownPrivilege	2336	WMIC.exe
Token: SeDebugPrivilege	2336	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2336	WMIC.exe
Token: SeRemoteShutdownPrivilege	2336	WMIC.exe
Token: SeUndockPrivilege	2336	WMIC.exe
Token: SeManageVolumePrivilege	2336	WMIC.exe
Token: 33	2336	WMIC.exe
Token: 34	2336	WMIC.exe
Token: 35	2336	WMIC.exe
Token: 36	2336	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2336	WMIC.exe
Token: SeSecurityPrivilege	2336	WMIC.exe
Token: SeTakeOwnershipPrivilege	2336	WMIC.exe
Token: SeLoadDriverPrivilege	2336	WMIC.exe
Token: SeSystemProfilePrivilege	2336	WMIC.exe
Token: SeSystemtimePrivilege	2336	WMIC.exe
Token: SeProfSingleProcessPrivilege	2336	WMIC.exe
Token: SeIncBasePriorityPrivilege	2336	WMIC.exe
Token: SeCreatePagefilePrivilege	2336	WMIC.exe
Token: SeBackupPrivilege	2336	WMIC.exe
Token: SeRestorePrivilege	2336	WMIC.exe
Token: SeShutdownPrivilege	2336	WMIC.exe
Token: SeDebugPrivilege	2336	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2336	WMIC.exe
Token: SeRemoteShutdownPrivilege	2336	WMIC.exe
Token: SeUndockPrivilege	2336	WMIC.exe
Token: SeManageVolumePrivilege	2336	WMIC.exe
Token: 33	2336	WMIC.exe
Token: 34	2336	WMIC.exe
Token: 35	2336	WMIC.exe
Token: 36	2336	WMIC.exe
Token: SeDebugPrivilege	5232	powershell.exe
Token: SeIncreaseQuotaPrivilege	5232	powershell.exe
Token: SeSecurityPrivilege	5232	powershell.exe
Token: SeTakeOwnershipPrivilege	5232	powershell.exe
Token: SeLoadDriverPrivilege	5232	powershell.exe
Token: SeSystemProfilePrivilege	5232	powershell.exe
Token: SeSystemtimePrivilege	5232	powershell.exe
Token: SeProfSingleProcessPrivilege	5232	powershell.exe
Token: SeIncBasePriorityPrivilege	5232	powershell.exe
Token: SeCreatePagefilePrivilege	5232	powershell.exe
Token: SeBackupPrivilege	5232	powershell.exe
Token: SeRestorePrivilege	5232	powershell.exe
Token: SeShutdownPrivilege	5232	powershell.exe
Token: SeDebugPrivilege	5232	powershell.exe
Token: SeSystemEnvironmentPrivilege	5232	powershell.exe
Token: SeRemoteShutdownPrivilege	5232	powershell.exe
Token: SeUndockPrivilege	5232	powershell.exe
Token: SeManageVolumePrivilege	5232	powershell.exe
Token: 33	5232	powershell.exe
Token: 34	5232	powershell.exe
Token: 35	5232	powershell.exe
Token: 36	5232	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 5492	4440	KMSAuto.exe	87
PID 5492 wrote to memory of 2336	5492	cmd.exe	89
PID 4440 wrote to memory of 5232	4440	KMSAuto.exe	91
PID 4440 wrote to memory of 3220	4440	KMSAuto.exe	93
PID 3220 wrote to memory of 1828	3220	cmd.exe	95
PID 1828 wrote to memory of 1876	1828	net.exe	96
PID 4440 wrote to memory of 5760	4440	KMSAuto.exe	97
PID 4440 wrote to memory of 5820	4440	KMSAuto.exe	100
PID 4440 wrote to memory of 1580	4440	KMSAuto.exe	102
PID 1580 wrote to memory of 5656	1580	0o3qwa2y8m.exe	103

C:\Users\Admin\AppData\Local\Temp\KMSAuto.exe
"C:\Users\Admin\AppData\Local\Temp\KMSAuto.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5492
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name /format:list
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;$OutputEncoding=[System.Text.Encoding]::UTF8;$names = @();try { $names = @(Get-CimInstance -ClassName Win32_VideoController -ErrorAction Stop | ForEach-Object { $_.Name }) } catch {};if (-not $names -or $names.Count -eq 0) { try { $names = @(Get-WmiObject -Class Win32_VideoController -ErrorAction Stop | ForEach-Object { $_.Name }) } catch {} };if ($names) { $names -join [char]10 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;$OutputEncoding=[System.Text.Encoding]::UTF8;$target = 'C:\Users\Admin\AppData'; try { $list = (Get-MpPreference -ErrorAction Stop).ExclusionPath; if ($null -eq $list) { $false } else { ($list | Where-Object { $_.ToLower() -eq $target.ToLower() }).Count -gt 0 } } catch { $false }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;$OutputEncoding=[System.Text.Encoding]::UTF8;Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData' -ErrorAction Stop"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5820
- C:\Users\Admin\AppData\.ub4ociu9\0o3qwa2y8m.exe
  C:\Users\Admin\AppData\.ub4ociu9\0o3qwa2y8m.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name /format:list
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:5656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0o3qwa2y8m.exe

Path C:\Users\Admin\AppData\.ub4ociu9\0o3qwa2y8m.exe
Size 3.3MB
SHA256 74a24f76bf7a52eb557fa5ed7917067d251dd8301204fbb348c0a88b86fbe29e
MD5 d993f6fce79b08f660cd44eacec4148c
SHA1 8b9779e217d2ec88fbf7ab14ea17f490e4507305
SHA512 8f266a2b9afed571563f4d2a82e257efcfed84d86dc8bc0df17db09ac0fe84fe54fc0be06b34feeaece8c436134332354cf762aa976f6a264670470af9822f10
SSDEEP 49152:R8bFaZhkNkEJLLU+kf3y7yh7A1qAsWgwADWYonRUeUcM:WZITMzgwAqYonRUeUcM
TLSH
T1BBF5084329DB0DE9CED277B861C75335A778FD71CA291F2BAA04D2212D536C4AD2EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ccc29b2db90160f9dbd0e3782dd28e6f3f08d5db6c856e7e36b0081dd4727653
MD5 7fd7874d0ab7298c5dd772674179d241
SHA1 8de9dacd369d535758dd40a2ae2037c649c1523a
SHA512 01fb36056b6a36ffc02cbc6048688523211153fc380ba9142710a561e837285d2ba05b4656884c744546c51dc01a1d6681edcaf122746de59687da30186dfc4f
TLSH
T1DB217633B3DC8614C899003A10DDAC1036B687CB40DECF9B6B85E159A42F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bbd83a2dd1efd41ef63fb452e3b6644efd30bb8d384e9667ed5ca911e2bed322
MD5 75f8a1a96f7601021c62b685498a644f
SHA1 00ec5e00f40d4923cf34f5ef44a7b3ceeefddd89
SHA512 6512f3c218f9fa110eb1fb906759d9ab308e4b24a75eca1cd72a2766eb0e9018cdf5a2925dd007bfc66e9df803c1af4fe2afd506f0a0bec77696e9a71c0a1bc9
TLSH
T170214633B3DD8615C89A413A10CEAD1036B687DB409E8E9B6B85E665A42F699CE61060
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2rxgvghm.xie.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2rxgvghm.xie.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1580-31-0x0000021AD83B0000-0x0000021AD8407000-memory.dmp

Download

memory/1580-37-0x00007FF77B110000-0x00007FF77B2A9000-memory.dmp

Download

memory/1580-38-0x00007FF77B110000-0x00007FF77B2A9000-memory.dmp

Download

memory/5232-9-0x000002ADFA3C0000-0x000002ADFA3EA000-memory.dmp

Download

memory/5232-10-0x000002ADFA3C0000-0x000002ADFA3E4000-memory.dmp

Download

memory/5232-1-0x000002ADFA2E0000-0x000002ADFA302000-memory.dmp

Download

memory/5232-8-0x000002ADFA360000-0x000002ADFA36A000-memory.dmp

Download

memory/5232-7-0x000002ADFA650000-0x000002ADFA702000-memory.dmp

Download

memory/5232-6-0x000002ADFA370000-0x000002ADFA38E000-memory.dmp

Download