785de6b80dd55bde5b662bbb26f007c67eca16a3cdb3c1d102bd186aa05c54b2

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mini-KMS_Activator_v1.3_Office2010_VL_RUS.exe
Size 1019KB
Sample260724-ftqz2a11ft
SHA256 785de6b80dd55bde5b662bbb26f007c67eca16a3cdb3c1d102bd186aa05c54b2
MD5 359d5c6a3976c2ac565adb2cc9a85014
SHA1 6a90e812476fff9ee8f2778affd1801747ac3414
SHA512 a39548c12f5713d3e478970a710534e0abaaaa7838df4410c9aa62c44231695d2ed962224fbca8054d6d2efdc9440a88cd8d5ff61dfe5bc281c1084bfcc1dd9e
SSDEEP 24576:VZg6gec7QiqJ62zh/AsWGQKo03OFBBDUceRw1ASxp7QC:meCQ621/LFz3OF32Sxp7l
TLSH
T1102533F87ED9AD13C0DB41B4EC33F44AAE2427E5E7AA9A2F8145E81E3DC549C14419CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000e00000001c5ac-56.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
4828	cscript.exe
4064	autorun.exe

Loads dropped DLL 1 IoCs

pid	Process
4064	autorun.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4828	cscript.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4932-0-0x0000000000400000-0x000000000067C000-memory.dmp	upx
behavioral2/memory/4932-53-0x0000000000400000-0x000000000067C000-memory.dmp	upx
behavioral2/files/0x000e00000001c5ac-56.dat	upx
behavioral2/memory/4064-64-0x0000000010000000-0x000000001007E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4396	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	autorun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mini-KMS_Activator_v1.3_Office2010_VL_RUS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 4396	4932	mini-KMS_Activator_v1.3_Office2010_VL_RUS.exe	88
PID 4396 wrote to memory of 4828	4396	cmd.exe	90
PID 4396 wrote to memory of 4064	4396	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\mini-KMS_Activator_v1.3_Office2010_VL_RUS.exe
"C:\Users\Admin\AppData\Local\Temp\mini-KMS_Activator_v1.3_Office2010_VL_RUS.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A56E.tmp\Run.cmd" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Users\Admin\AppData\Local\Temp\A56E.tmp\cscript.exe
    cscript HS_MESSAGE.vbs "éδ ºá»πßΓ¿½¿ φΓπ »α«úαá¼¼π «Γ ¿¼Ñ¡¿ Çñ¼¿¡¿ßΓαáΓ«αá? " "Activation Tool" Q YESNO 30
    3⤵
    - Executes dropped EXE
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:4828
- - C:\Users\Admin\AppData\Local\Temp\A56E.tmp\autorun.exe
    autorun.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HS_MESSAGE.vbs

Path C:\Users\Admin\AppData\Local\Temp\A56E.tmp\HS_MESSAGE.vbs
Size 796B
SHA256 56a32a3cd84010b6517ed492ae6eadac54e5a903f4a0d21b4db32431416d82a2
MD5 af0559e0301b2f75fa7ce812c5296de8
SHA1 205ddd069a599d20f0e91e17bbf3250eb339cc9e
SHA512 b80b0a1e9f142b16fcd54b24b23b637115454bf637d1abbaf8f9076a33148331e26668dadaa16202fbdbfcdcb152db519a26cee52a01af82149fdf2af2e70db0
TLSH
T1E0016DD3B41E59378BA60A8B94F9FC852E99C8041CED4C470D94C1637A01A10FDFBB97
MD5 SHA1 SHA512 TLSH

Submit Download

Run.cmd

Path C:\Users\Admin\AppData\Local\Temp\A56E.tmp\Run.cmd
Size 1KB
SHA256 4a7d39cc026fab566750ebde535963e14e8c6c817b7a35246fbb2ab945fce69e
MD5 0ce430899748dddb89907b3570491a6c
SHA1 e893853bd798d915f2d054b72c464fccbe21f516
SHA512 fed819d3a63a065f92c8a13c3bc4063a313eb520c7209ca5b9e7dbe19b88627815e266cf0f5e114621916186e1b19092900172dc0834c34799d3e5a19f30d1d7
TLSH
T10121FC0CD968CB3896945707833B41EEF910C2AE1ED8F45576341CEC7099B366C54B9D
MD5 SHA1 SHA512 TLSH

Submit Download

autorun.apm

Path C:\Users\Admin\AppData\Local\Temp\A56E.tmp\autorun.apm
Size 193KB
SHA256 98aedb230f3c48f66ff033abcaa465bb5fea63475c6b7415dd8a75d78ad10fa1
MD5 b037247ee10bae5994293a7e2368d08b
SHA1 657514b83d9af4428b8b8aca14eb78a94137dca2
SHA512 e8f7dccdd01b45a2da18bf62fb271fa345befe8dfd4de7ab1f9d365efee31704f8c98bafd79d297d6c66b71a6f8b858663297a532b15f0cc497f3e1f9c2315f5
SSDEEP 6144:pI76+hkLuBRdboQbiQbBCbtdbXyQb4rZQbI:f+hldboQbiQbB8dbXyQb4rZQbI
TLSH
T14B14C0BBFA65D053DD041632EA8F85C591203C6CDE52F307359A7D6F38FBA262939102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autorun.exe

Path C:\Users\Admin\AppData\Local\Temp\A56E.tmp\autorun.exe
Size 1.4MB
SHA256 869198aa463fd1e6a039aa9eaaa8985197b289ba0051cb0498be3a27fe58e67e
MD5 74fc80e9dfe964e74ee37589ae70568f
SHA1 4e3d35d05eedde3243d3c95643558b5259f4942b
SHA512 74644ed45bf176bb0724ba532887fa99dcb58282baab95ec4734c3d99e077b5626426d6b2ca9f676d34e0705524756eab7b5745f1ca3b4f0a3fa73756e7ecc19
SSDEEP 24576:+nyH50JIUwHdnJj77diUvq/Ph8eMpZTuDYjsRSHhKDCs6taaGdTgGc7/3PmA:+nq9JLg/P6j18Cs6czTDA/+
TLSH
T1B0659D22F2824833D5731B349D67869A9935BE511E38A9C73BF82D0C5F3A6C239352D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cscript.exe

Path C:\Users\Admin\AppData\Local\Temp\A56E.tmp\cscript.exe
Size 149KB
SHA256 12df0b06a9b56dce3efdb85984f84b387b1a5b61c9ebbf5a3bd61a5fbb996f60
MD5 34098403f9d8f71ce2ec749122168e89
SHA1 0aed0994e4b43bc3ecc2106dc1c1d3210c82b7d7
SHA512 e5b27d305b2a1c411bffbbf6c6534a92ce17af807c69344ed31a2fee42639ac5fef97ef4a654c4d6b2b8d42ba808856b857e9b4d8c008a7ba98adbab6c6b9372
SSDEEP 3072:VDJirQRQIdlH4U9WnTUgpEmhU1fABL1thf1ZLVUnDjLsX0Txt4orvBTxEfg:PirQRQIdlJCEAPth1KLI0T9Afg
TLSH
T198E33B1233D3D065D0E215314A7EB3B19B76BD250D29BB0F2384DB6E5E72384EA24F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apmC8E4.tmp

Path C:\Users\Admin\AppData\Local\Temp\apmC8E4.tmp
Size 146KB
SHA256 5d6ff8a11cda6d5b1e6d8a5562594379a082cee18f402a8a0a26b8cabe428954
MD5 3d4839228c7ee77e28832879eeb17340
SHA1 ebe4a6388c8c6831837e232b48b8f4266b7f711e
SHA512 f3c534524eaa4b51ee44a6c1d05a142c0d10d9c1c48db79b60903dd948d5712b367479b82cd85fa8ee094dcd2569c0fd85a36c10c97deab59e49e1f1f4da6c56
SSDEEP 3072:Y2ga+rYNdys0o7HwYcD9QIN+mVrTPZvLgUJ885nP:YLaGYD3RjXcDnNTBLgS5P
TLSH
T1FDE3120800ACCE1BD85D8E79B3143D73E281F96F8DEEE6304058922665BDDF619279BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4064-55-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/4064-54-0x0000000000555000-0x0000000000556000-memory.dmp

Download

memory/4064-64-0x0000000010000000-0x000000001007E000-memory.dmp

Download

memory/4064-66-0x0000000000400000-0x00000000005B1000-memory.dmp

Download

memory/4932-0-0x0000000000400000-0x000000000067C000-memory.dmp

Download

memory/4932-53-0x0000000000400000-0x000000000067C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads