Extracted

• • Target
    KMSAuto++.exe
  • Size 26.0MB
  • SHA256 4140061e52a95ecd9e6c9f55e8a18f7fb1f0605fb26e1d8236eaf0dfda04e866
  • MD5 d02f15eb9d0c8cdb597d5b892a8aba86
  • SHA1 b8344bb2157669389119be005b74c45d5adcbe7e
  • SHA512 47cdd36ef62be7a48d8d80a08fa9cdc3ce2a7176c26818baf1626270633c072a790b41508d179c15f488d831ab439ab0baf47211d1d8a3e16b312a2143fd6328
  • SSDEEP 786432:su2+/t6D6dbsDTOXFTXRkdObGXYztTHMa0:A0ZBkd4zZMz
  • TLSH
    T1DD57BF11EBD200B0F5B39670C9BAD236CB377E154632CD9FB24C598D6B33680997A726
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Stops running service(s)

    defense_evasionexecution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1