0621080ebec2a6eadf2d0fb40279d4ebaadc617b31634d754c66e08aa30d6702

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 05:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mKMSAct.exe
Size 2.0MB
Sample260724-fw2vbaee66
SHA256 0621080ebec2a6eadf2d0fb40279d4ebaadc617b31634d754c66e08aa30d6702
MD5 ba804e62f9c39f87b9f0e009614e55ba
SHA1 528fbb0e7ed33fe9ba7f1225866986190b3951ae
SHA512 6e0c74ad7ba34703c0d1b5ebc7dd0f43a60b136a3454783ee75f40627cc42cc93c788f6b0fac97f86ec0748cfda722fb260d05b0ef430d92fc6b77be8f21a23e
SSDEEP 49152:IWWW1/PNXzVqOQessR+EJvHq7HZCjfiizMmP9twV/1VN3px8Hm:xT1/15trpfvHqNCDiifXW1X3pV
TLSH
T1FAA533F5E88D50FCDA975AB58FE1A034D271A95492C21DC7B6E8E8231CC37C0F84976A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution upx

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1088	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
5308	reg64.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1572	cscript.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3952-0-0x0000000000400000-0x0000000000A95000-memory.dmp	upx
behavioral2/memory/3952-103-0x0000000000400000-0x0000000000A95000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1064	cmd.exe
5192	cmd.exe
828	cmd.exe
1836	cmd.exe
2892	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mKMSAct.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5644	WMIC.exe
5644	WMIC.exe
5644	WMIC.exe
5644	WMIC.exe
760	WMIC.exe
760	WMIC.exe
760	WMIC.exe
760	WMIC.exe
2968	WMIC.exe
2968	WMIC.exe
2968	WMIC.exe
2968	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5644	WMIC.exe
Token: SeSecurityPrivilege	5644	WMIC.exe
Token: SeTakeOwnershipPrivilege	5644	WMIC.exe
Token: SeLoadDriverPrivilege	5644	WMIC.exe
Token: SeSystemProfilePrivilege	5644	WMIC.exe
Token: SeSystemtimePrivilege	5644	WMIC.exe
Token: SeProfSingleProcessPrivilege	5644	WMIC.exe
Token: SeIncBasePriorityPrivilege	5644	WMIC.exe
Token: SeCreatePagefilePrivilege	5644	WMIC.exe
Token: SeBackupPrivilege	5644	WMIC.exe
Token: SeRestorePrivilege	5644	WMIC.exe
Token: SeShutdownPrivilege	5644	WMIC.exe
Token: SeDebugPrivilege	5644	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5644	WMIC.exe
Token: SeRemoteShutdownPrivilege	5644	WMIC.exe
Token: SeUndockPrivilege	5644	WMIC.exe
Token: SeManageVolumePrivilege	5644	WMIC.exe
Token: 33	5644	WMIC.exe
Token: 34	5644	WMIC.exe
Token: 35	5644	WMIC.exe
Token: 36	5644	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5644	WMIC.exe
Token: SeSecurityPrivilege	5644	WMIC.exe
Token: SeTakeOwnershipPrivilege	5644	WMIC.exe
Token: SeLoadDriverPrivilege	5644	WMIC.exe
Token: SeSystemProfilePrivilege	5644	WMIC.exe
Token: SeSystemtimePrivilege	5644	WMIC.exe
Token: SeProfSingleProcessPrivilege	5644	WMIC.exe
Token: SeIncBasePriorityPrivilege	5644	WMIC.exe
Token: SeCreatePagefilePrivilege	5644	WMIC.exe
Token: SeBackupPrivilege	5644	WMIC.exe
Token: SeRestorePrivilege	5644	WMIC.exe
Token: SeShutdownPrivilege	5644	WMIC.exe
Token: SeDebugPrivilege	5644	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5644	WMIC.exe
Token: SeRemoteShutdownPrivilege	5644	WMIC.exe
Token: SeUndockPrivilege	5644	WMIC.exe
Token: SeManageVolumePrivilege	5644	WMIC.exe
Token: 33	5644	WMIC.exe
Token: 34	5644	WMIC.exe
Token: 35	5644	WMIC.exe
Token: 36	5644	WMIC.exe
Token: SeIncreaseQuotaPrivilege	760	WMIC.exe
Token: SeSecurityPrivilege	760	WMIC.exe
Token: SeTakeOwnershipPrivilege	760	WMIC.exe
Token: SeLoadDriverPrivilege	760	WMIC.exe
Token: SeSystemProfilePrivilege	760	WMIC.exe
Token: SeSystemtimePrivilege	760	WMIC.exe
Token: SeProfSingleProcessPrivilege	760	WMIC.exe
Token: SeIncBasePriorityPrivilege	760	WMIC.exe
Token: SeCreatePagefilePrivilege	760	WMIC.exe
Token: SeBackupPrivilege	760	WMIC.exe
Token: SeRestorePrivilege	760	WMIC.exe
Token: SeShutdownPrivilege	760	WMIC.exe
Token: SeDebugPrivilege	760	WMIC.exe
Token: SeSystemEnvironmentPrivilege	760	WMIC.exe
Token: SeRemoteShutdownPrivilege	760	WMIC.exe
Token: SeUndockPrivilege	760	WMIC.exe
Token: SeManageVolumePrivilege	760	WMIC.exe
Token: 33	760	WMIC.exe
Token: 34	760	WMIC.exe
Token: 35	760	WMIC.exe
Token: 36	760	WMIC.exe
Token: SeIncreaseQuotaPrivilege	760	WMIC.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 828	3952	mKMSAct.exe	88
PID 828 wrote to memory of 1088	828	cmd.exe	90
PID 828 wrote to memory of 1836	828	cmd.exe	91
PID 1836 wrote to memory of 5644	1836	cmd.exe	92
PID 828 wrote to memory of 2892	828	cmd.exe	94
PID 2892 wrote to memory of 760	2892	cmd.exe	95
PID 828 wrote to memory of 1064	828	cmd.exe	96
PID 1064 wrote to memory of 2968	1064	cmd.exe	97
PID 828 wrote to memory of 5192	828	cmd.exe	98
PID 5192 wrote to memory of 5308	5192	cmd.exe	99
PID 5192 wrote to memory of 2320	5192	cmd.exe	100
PID 828 wrote to memory of 2688	828	cmd.exe	101
PID 828 wrote to memory of 3664	828	cmd.exe	102
PID 828 wrote to memory of 1572	828	cmd.exe	103

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1088	attrib.exe

C:\Users\Admin\AppData\Local\Temp\mKMSAct.exe
"C:\Users\Admin\AppData\Local\Temp\mKMSAct.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A9C3.tmp\run.cmd" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp\A9C3.tmp" +h +s
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic OS Get InstallDate /Value
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1836
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic OS Get InstallDate /Value
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5644
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic CPU get ProcessorId /value
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic CPU get ProcessorId /value
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:760
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic OS Get LocalDateTime /Value
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1064
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic OS Get LocalDateTime /Value
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2968
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg64 QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /V "CurrentVersion" | findstr /i "CurrentVersion"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\A9C3.tmp\reg64.exe
      reg64 QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /V "CurrentVersion"
      4⤵
      Executes dropped EXE
      PID:5308
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /i "CurrentVersion"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2320
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo 6.3 "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2688
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i "5.1 5.2 6.0 6.1"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3664
- - C:\Windows\SysWOW64\cscript.exe
    C:\Windows\system32\cscript.exe //nologo msgbox.vbs "Internal error. Code: 111. Activator can not start. Unsupported OS." "mini-KMS Activator" W OK
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:1572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msgbox.vbs

Path C:\Users\Admin\AppData\Local\Temp\A9C3.tmp\msgbox.vbs
Size 896B
SHA256 ee4a35cccd27e1b70691fd698e7304993e5e12723dbe2b95577f3a2032ce2ddc
MD5 e5676f6fd4405338488b6c7c55f4ed6b
SHA1 ef8b100619c3402d21598e41f51debc759c448c0
SHA512 9c58135e756fb9a40aebddc46a0335c99d989ec2afd09284c2aa785ad967b4dc9e474fca80eedb4089fd733f8c8d00cb3a1138daf738f7b5abc4a73f3d40bc6d
TLSH
T1EF1159D2B82E9D7787A6054640F9FC842EA9CC001CED0C070DA8C163BA11910F9FBBA7
MD5 SHA1 SHA512 TLSH

Submit Download

reg64.exe

Path C:\Users\Admin\AppData\Local\Temp\A9C3.tmp\reg64.exe
Size 120KB
SHA256 0ed6bb6d7f86f5019e18032258dde456d54fa7ad6e65ac027e8e9e34e15d421d
MD5 cafb9dc298410ccb0d43f2838a051f3f
SHA1 fea6b21b48f80c851872c08b56aaae821a82faac
SHA512 fa8926bf3e777473a66ec52564fec8dbcfc82b145ff1bfb4b76afcb01a6c3762d68f7f5b5cad54ff7e497334e364a2781d559268c02d29f8578e7b3497014904
SSDEEP 3072:q/mqQ74qZIs8gqsPBantxH21JD5D9f5KyotAA:Ld3ZIs81sZ4torf5Not
TLSH
T109C3D642B3E900A4F1BB76759EF505229BB778509F36C3CF23584A1A1F63AC49D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run.cmd

Path C:\Users\Admin\AppData\Local\Temp\A9C3.tmp\run.cmd
Size 18KB
SHA256 ac4e7124c41fe82eb1af7a3734298e63175a461d5470db11086024e71b12ac0d
MD5 41fb1150c2eb0be6eae538c3cad97974
SHA1 a50ca71d185c4ee0e11bab09aabd63d6dae40e1e
SHA512 72c322ecc8d4c8bd383baa16d278c3b05f2bed83fe6d8c948c41d88c2ee6a937e75dc820340b9b7f706cf7f2a73d069e81a240ba18d15d966e395e3bfc94c544
SSDEEP 192:ZNIaNd70tHrdmWrPFtSGB7g6kmAEh+DjYSklD:DNh0tLdmsP7fxk34lD
TLSH
T1BD82741C3E168F3BC5F62B5FC103E189771781BF34C4B4A8257A8498B94B53D7AA82B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3952-0-0x0000000000400000-0x0000000000A95000-memory.dmp

Download

memory/3952-103-0x0000000000400000-0x0000000000A95000-memory.dmp

Download