General
- Target kmws.pdf
- Size 1KB
- Sample260906-wwqeaacf45
- SHA256 3d1361588e302524c5c741c76175c99695aaf70c0b740bbeb9406423f5fa434b
- MD5 54a9ae95b61979eb12b712adcbed64e6
- SHA1 29c5649a684aa820fb197e92ab7922b2a8c39056
- SHA512 cd7c86c7190b7bc917f93fb0fcb2e1713b9922985ba7820656717b8597a64eead2ac741faf38f716964bbc34c488723736540834d5deebd533ad5d16844ddb12
- TLSH T1BE21106BCC3EE5638DF2E16145CB1929EEB20F1A10B18C10791ECD844F30B81A6AD4ED
- MD5 SHA1 SHA512 TLSH
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
kmws.vbs
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
kmws.vbs
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target kmws.pdf
- Size 1KB
- SHA256 3d1361588e302524c5c741c76175c99695aaf70c0b740bbeb9406423f5fa434b
- MD5 54a9ae95b61979eb12b712adcbed64e6
- SHA1 29c5649a684aa820fb197e92ab7922b2a8c39056
- SHA512 cd7c86c7190b7bc917f93fb0fcb2e1713b9922985ba7820656717b8597a64eead2ac741faf38f716964bbc34c488723736540834d5deebd533ad5d16844ddb12
- TLSH T1BE21106BCC3EE5638DF2E16145CB1929EEB20F1A10B18C10791ECD844F30B81A6AD4ED
- MD5 SHA1 SHA512 TLSH
Score10/10-
UAC bypass
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes a VBScript file via the Windows Script Host.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1