Overview

overview

7

Static

static

5

HEU_KMS_Ac....0.exe

windows10-2004-x64

7

HEU_KMS_Ac....0.exe

windows11-ltsc_2024-x64

7

HEU_KMS_Ac...��.url

windows10-2004-x64

1

HEU_KMS_Ac...��.url

windows11-ltsc_2024-x64

1

HEU_KMS_Ac...��.cmd

windows10-2004-x64

6

HEU_KMS_Ac...��.cmd

windows11-ltsc_2024-x64

6

HEU_KMS_Ac...��.cmd

windows10-2004-x64

6

HEU_KMS_Ac...��.cmd

windows11-ltsc_2024-x64

6

HEU_KMS_Ac...��.url

windows10-2004-x64

1

HEU_KMS_Ac...��.url

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    cb26ce9b3fcc9824fb72d48340dfff9419edd5caa93bf4cd66024d19d2305788
  • Size 4.4MB
  • Sample260729-ftnvnsgr6w
  • SHA256 cb26ce9b3fcc9824fb72d48340dfff9419edd5caa93bf4cd66024d19d2305788
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionlinkqrupx

Malware Config

Targets

    • Target
      HEU_KMS_Activator_v64.0.0/HEU_KMS_Activator_v64.0.0.exe
    • Size 4.5MB
    • SHA256 6ad72af453a9c4db99a30317e97689e893a110681e84655392865c8a813e8a5c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoveryupx

    • Executes dropped EXE

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2
    • Target
      HEU_KMS_Activator_v64.0.0/J搜索 - 清爽干净的上网入口！.url
    • Size 167B
    • SHA256 3af66fa13899dbff8b6956c2bbdcb60922c33d22199962e8042b2e5c7e270a57
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      HEU_KMS_Activator_v64.0.0/当前目录添加到WD白名单.cmd
    • Size 416B
    • SHA256 f9e65a39bfcb45fa75a3fcce4c421a33ddd726dbf5a300ada0623f1ee3fcded2
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral5behavioral6
    • Target
      HEU_KMS_Activator_v64.0.0/当前目录移除WD白名单.cmd
    • Size 422B
    • SHA256 608896bbc173dda3037eefca287ad6de2b032c14423b01d06135632c54037995
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral7behavioral8
    • Target
      HEU_KMS_Activator_v64.0.0/爱纯净官网.url
    • Size 239B
    • SHA256 88f334cdc26a2adf5c75080973c4ff5d306b3d28c569fb8fd0349d4bd6dcf5a4
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral10behavioral9

MITRE ATT&CK Enterprise v16

Tasks