ffb0aa5af7b463161b622c3e07a0ffc9eae9c276b0b8c405746f4a1e450be07c

Analysis

max time kernel
148s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Install_Task_KMSServersManager.cmd
Size 2KB
Sample260930-clq4aat19j
SHA256 ffb0aa5af7b463161b622c3e07a0ffc9eae9c276b0b8c405746f4a1e450be07c
MD5 78ea96b349c55050f0aee8581bb4b3eb
SHA1 fb5dd1af205bba01f0416f6fe7f9a35d9f319812
SHA512 b9a5b1247379ded2864d64369cc21d3f08cf1a4f399420fd463fa1fadfb22a7d5e1d700d17bdc16e0130474ef09f156edcad5bb835a5652820ce0bbc2eacc8bd
TLSH
T133514346216682870075B377AB013D67BF8D81BF2B68D39833A5147D32DF10593E97D9
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
796	vlmcs.exe
1224	vlmcs.exe

Loads dropped DLL 5 IoCs

pid	Process
796	vlmcs.exe
796	vlmcs.exe
796	vlmcs.exe
1224	vlmcs.exe
1224	vlmcs.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4312	cmd.exe
4428	cmd.exe
4712	cmd.exe
300	cmd.exe
1788	cmd.exe
1972	cmd.exe
3516	cmd.exe
2164	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	vlmcs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	vlmcs.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vlmcs.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5460	PING.EXE

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host	reg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings\Enabled = "1"	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5460	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1232	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1552	WMIC.exe
1552	WMIC.exe
1552	WMIC.exe
1552	WMIC.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	1552	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1552	WMIC.exe
Token: SeSecurityPrivilege	1552	WMIC.exe
Token: SeTakeOwnershipPrivilege	1552	WMIC.exe
Token: SeLoadDriverPrivilege	1552	WMIC.exe
Token: SeSystemtimePrivilege	1552	WMIC.exe
Token: SeBackupPrivilege	1552	WMIC.exe
Token: SeRestorePrivilege	1552	WMIC.exe
Token: SeShutdownPrivilege	1552	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1552	WMIC.exe
Token: SeUndockPrivilege	1552	WMIC.exe
Token: SeManageVolumePrivilege	1552	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	1552	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1552	WMIC.exe
Token: SeSecurityPrivilege	1552	WMIC.exe
Token: SeTakeOwnershipPrivilege	1552	WMIC.exe
Token: SeLoadDriverPrivilege	1552	WMIC.exe
Token: SeSystemtimePrivilege	1552	WMIC.exe
Token: SeBackupPrivilege	1552	WMIC.exe
Token: SeRestorePrivilege	1552	WMIC.exe
Token: SeShutdownPrivilege	1552	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1552	WMIC.exe
Token: SeUndockPrivilege	1552	WMIC.exe
Token: SeManageVolumePrivilege	1552	WMIC.exe
Token: SeRestorePrivilege	796	vlmcs.exe
Token: SeBackupPrivilege	796	vlmcs.exe
Token: SeDebugPrivilege	796	vlmcs.exe
Token: SeRestorePrivilege	1224	vlmcs.exe
Token: SeBackupPrivilege	1224	vlmcs.exe
Token: SeDebugPrivilege	1224	vlmcs.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4908	4712	cmd.exe	92
PID 4712 wrote to memory of 2228	4712	cmd.exe	93
PID 4712 wrote to memory of 4612	4712	cmd.exe	94
PID 4712 wrote to memory of 4396	4712	cmd.exe	95
PID 4712 wrote to memory of 1232	4712	cmd.exe	96
PID 4712 wrote to memory of 4288	4712	cmd.exe	97
PID 4712 wrote to memory of 1788	4712	cmd.exe	100
PID 300 wrote to memory of 4564	300	cmd.exe	101
PID 300 wrote to memory of 1972	300	cmd.exe	102
PID 300 wrote to memory of 3516	300	cmd.exe	103
PID 300 wrote to memory of 2164	300	cmd.exe	104
PID 300 wrote to memory of 4312	300	cmd.exe	105
PID 4312 wrote to memory of 1552	4312	cmd.exe	106
PID 300 wrote to memory of 5112	300	cmd.exe	108
PID 300 wrote to memory of 5460	300	cmd.exe	109
PID 300 wrote to memory of 4648	300	cmd.exe	110
PID 300 wrote to memory of 4864	300	cmd.exe	111
PID 300 wrote to memory of 796	300	cmd.exe	112
PID 300 wrote to memory of 1224	300	cmd.exe	114
PID 300 wrote to memory of 5844	300	cmd.exe	115
PID 300 wrote to memory of 3312	300	cmd.exe	116
PID 300 wrote to memory of 5260	300	cmd.exe	117
PID 300 wrote to memory of 3432	300	cmd.exe	118
PID 300 wrote to memory of 2884	300	cmd.exe	119
PID 300 wrote to memory of 1308	300	cmd.exe	120
PID 300 wrote to memory of 5572	300	cmd.exe	121
PID 300 wrote to memory of 5580	300	cmd.exe	122
PID 300 wrote to memory of 3496	300	cmd.exe	123
PID 300 wrote to memory of 4628	300	cmd.exe	124
PID 300 wrote to memory of 4428	300	cmd.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Install_Task_KMSServersManager.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4908
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" query "HKU\S-1-5-19"
  2⤵
  PID:2228
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /end /tn "KMSServersManager"
  2⤵
  PID:4612
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /delete /tn "KMSServersManager" /f
  2⤵
  PID:4396
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /tn "KMSServersManager" /xml "C:\ProgramData\KMSServersManager\KMSServersManager.xml"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1232
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /run /tn "KMSServersManager"
  2⤵
  PID:4288
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c exit /b 0
  2⤵
  - Executes a command shell one-liner
  PID:1788

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\ProgramData\KMSServersManager\KMSServersManager.cmd" /e /l
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:300
- C:\Windows\System32\chcp.com
  chcp 65001
  2⤵
  PID:4564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:1972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b /s /a-d "C:\Program Files\Microsoft Office\ospp.vbs" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:2164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic.exe Path Win32_OperatingSystem Get Caption /Value" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic.exe Path Win32_OperatingSystem Get Caption /Value
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1552
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" query "HKU\S-1-5-19"
  2⤵
  PID:5112
- C:\Windows\system32\PING.EXE
  "C:\Windows\system32\ping.exe" -n 1 google.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5460
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKCU\Software\Microsoft\Windows Script Host\Settings" /v "Enabled" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies data under HKEY_USERS
  PID:4648
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\Software\Microsoft\Windows Script Host\Settings" /v "Enabled" /t REG_DWORD /d "1" /f
  2⤵
  PID:4864
- C:\ProgramData\KMSServersManager\vlmcs.exe
  "C:\ProgramData\KMSServersManager\vlmcs.exe" -l 1 -p 192.168.100.2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:796
- C:\ProgramData\KMSServersManager\vlmcs.exe
  "C:\ProgramData\KMSServersManager\vlmcs.exe" -l 1 -p vlm.freemyip.com:43615
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1224
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55C92734-D682-4D71-983E-D6EC3F16059F" /f
  2⤵
  PID:5844
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0FF1CE15-A989-479D-AF46-F275C6370663" /f
  2⤵
  PID:3312
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "KeyManagementServiceName" /d "vlm.freemyip.com" /t "REG_SZ"
  2⤵
  PID:5260
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "KeyManagementServicePort" /d "43615" /t "REG_SZ"
  2⤵
  PID:3432
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "UserOperations" /d "1" /t "REG_DWORD"
  2⤵
  PID:2884
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55C92734-D682-4D71-983E-D6EC3F16059F" /f /reg:32
  2⤵
  PID:1308
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0FF1CE15-A989-479D-AF46-F275C6370663" /f /reg:32
  2⤵
  PID:5572
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "KeyManagementServiceName" /d "vlm.freemyip.com" /t "REG_SZ" /reg:32
  2⤵
  PID:5580
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "KeyManagementServicePort" /d "43615" /t "REG_SZ" /reg:32
  2⤵
  PID:3496
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "UserOperations" /d "1" /t "REG_DWORD" /reg:32
  2⤵
  PID:4628
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c exit /b 0
  2⤵
  - Executes a command shell one-liner
  PID:4428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cyggcc_s-1.dll

Path C:\ProgramData\KMSServersManager\cyggcc_s-1.dll
Size 108KB
SHA256 0aa9dba17c91e94178aef17953bca88db60e4b27afeceb2a3826a268e4bc0205
MD5 9ac4cda1b5082732d14b725fd28c7df4
SHA1 9e11a8308f6eeedf00be244bacd4e52b713bb151
SHA512 a09f7160fbe7c46751a639c8762ffa737e767ce9c95b1c28d59c07f7dc66f8bf75a716da1fbd4f02cc6282be6afbf4986a865c9a62daaca62d56a70369430d65
SSDEEP 1536:o4iwultju4/8/bIag/5UMInQ0MVnkY0OwXVv2Ve5xsBg:oqmt64/IIag/pTVnc2oHsBg
TLSH
T190B32950FA8B10E5D45779B051A7A73F9E343E160034EEB9FF89E75BE532702B12920A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cygwin1.dll

Path C:\ProgramData\KMSServersManager\cygwin1.dll
Size 3.3MB
SHA256 7203f05765c21579807d425714d29a3022e6e045a5e1925c62fbb6f670baa420
MD5 a51d350f4b983320cd6a9c85009da952
SHA1 3b3d4722081ea9513c318874ac06cda44c0bd3a5
SHA512 d06b26105884b9e671ee338ff907c82c8611366ac0b3c3a0565745dd79c9acb20b8af4c4cdf52fa34cdcca64c650146ecdcfb2edecd1f2d78a04b465fa57552b
SSDEEP 98304:cy8gHq7TRGKZrJj//xJjaeBtfklfMdgYLe1u4CUb8bA/PRbRLhAZ:cy8hDHB+lfM3
TLSH
T13FF57B4CE6CB54F6DD5B5AB0A19BF32F13346B10C275CF97EA4859A2EE23F825502B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlmcs.exe

Path C:\ProgramData\KMSServersManager\vlmcs.exe
Size 53KB
SHA256 21dda576a2f67c10f8c3e396e490cfd59d7b3c4578fe749adee81e4167009b0f
MD5 b25ebd521d647ac7eb4a8ac43f5032d3
SHA1 f6fe635d0dc2dcc0cd7e4852a497403fb6b3a998
SHA512 72458ca3a1261ec12c256833ab120acc3979fe21f2bb36a9ad71c9776df9504be000327b1c4fa909d8b0e756f419d26712d13cd75d9a9c0457f913c26b51c394
SSDEEP 768:noAN+L2/NAk4Mrem9R+LZbHSsc+G/WRGHU3Kd1nVvd4yxBHooooooooooooooooZ:7NAw65ysNG/WRGftaPW
TLSH
T179334A8AB7D3E0B1E47B01F0049F9B3FD776B11461A2C712FA5D84549FC2663629BAC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/796-3-0x0000000061000000-0x00000000614F0000-memory.dmp

Download

memory/796-5-0x0000000061000000-0x00000000614F0000-memory.dmp

Download

memory/796-6-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/796-7-0x000000006FC40000-0x000000006FC62000-memory.dmp

Download

memory/796-13-0x000000006FC40000-0x000000006FC62000-memory.dmp

Download

memory/796-15-0x0000000061000000-0x00000000614F0000-memory.dmp

Download

memory/1224-19-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1224-21-0x000000006FC40000-0x000000006FC62000-memory.dmp

Download

memory/1224-20-0x0000000061000000-0x00000000614F0000-memory.dmp

Download