ad9879857a02474a6b392a87376b8e8432068f26677416a92057581cf052c89e

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KMSServersManager.cmd
Size 13KB
Sample260930-clq4aat19j
SHA256 ad9879857a02474a6b392a87376b8e8432068f26677416a92057581cf052c89e
MD5 fbdfc905c71a57f06c2b97b17d943229
SHA1 6de22867edc18beecc70b484ac7caae26f547da3
SHA512 65368e30a05525507f0bd602db1185d68a3c9df7ca7c73dae8fa626d5eb9d3767c7e1c92410c8c75cb24e8d80aa2b548fce828f7e5513e2288dbb14ee4979648
SSDEEP 192:wyxVcF3JBkW3bOZnZ8FYPJSDlXrCse77J4mFwQClajohL41hin40Cgi/U0+cNX/8:3IOZRxdYqWWin45/UMXnYoqoAz
TLSH
T1025295442C4982A710B8F3B26E0154477BDF41FF2A76CBE832915499B7DE62583BE3E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs

execution

Visual Basic

T1059.005

pid	Process
3188	cscript.exe
1060	cscript.exe
1120	cscript.exe
60	cscript.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
872	cmd.exe
4340	cmd.exe
1176	cmd.exe
4632	cmd.exe
2564	cmd.exe
5100	cmd.exe
4220	cmd.exe
2988	cmd.exe
3512	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vlmcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sed.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4604	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4604	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3204	WMIC.exe
Token: SeSecurityPrivilege	3204	WMIC.exe
Token: SeTakeOwnershipPrivilege	3204	WMIC.exe
Token: SeLoadDriverPrivilege	3204	WMIC.exe
Token: SeSystemProfilePrivilege	3204	WMIC.exe
Token: SeSystemtimePrivilege	3204	WMIC.exe
Token: SeProfSingleProcessPrivilege	3204	WMIC.exe
Token: SeIncBasePriorityPrivilege	3204	WMIC.exe
Token: SeCreatePagefilePrivilege	3204	WMIC.exe
Token: SeBackupPrivilege	3204	WMIC.exe
Token: SeRestorePrivilege	3204	WMIC.exe
Token: SeShutdownPrivilege	3204	WMIC.exe
Token: SeDebugPrivilege	3204	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3204	WMIC.exe
Token: SeRemoteShutdownPrivilege	3204	WMIC.exe
Token: SeUndockPrivilege	3204	WMIC.exe
Token: SeManageVolumePrivilege	3204	WMIC.exe
Token: 33	3204	WMIC.exe
Token: 34	3204	WMIC.exe
Token: 35	3204	WMIC.exe
Token: 36	3204	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3204	WMIC.exe
Token: SeSecurityPrivilege	3204	WMIC.exe
Token: SeTakeOwnershipPrivilege	3204	WMIC.exe
Token: SeLoadDriverPrivilege	3204	WMIC.exe
Token: SeSystemProfilePrivilege	3204	WMIC.exe
Token: SeSystemtimePrivilege	3204	WMIC.exe
Token: SeProfSingleProcessPrivilege	3204	WMIC.exe
Token: SeIncBasePriorityPrivilege	3204	WMIC.exe
Token: SeCreatePagefilePrivilege	3204	WMIC.exe
Token: SeBackupPrivilege	3204	WMIC.exe
Token: SeRestorePrivilege	3204	WMIC.exe
Token: SeShutdownPrivilege	3204	WMIC.exe
Token: SeDebugPrivilege	3204	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3204	WMIC.exe
Token: SeRemoteShutdownPrivilege	3204	WMIC.exe
Token: SeUndockPrivilege	3204	WMIC.exe
Token: SeManageVolumePrivilege	3204	WMIC.exe
Token: 33	3204	WMIC.exe
Token: 34	3204	WMIC.exe
Token: 35	3204	WMIC.exe
Token: 36	3204	WMIC.exe
Token: SeRestorePrivilege	3972	vlmcs.exe
Token: SeBackupPrivilege	3972	vlmcs.exe
Token: SeDebugPrivilege	3972	vlmcs.exe
Token: SeRestorePrivilege	436	vlmcs.exe
Token: SeBackupPrivilege	436	vlmcs.exe
Token: SeDebugPrivilege	436	vlmcs.exe
Token: SeIncreaseQuotaPrivilege	4956	WMIC.exe
Token: SeSecurityPrivilege	4956	WMIC.exe
Token: SeTakeOwnershipPrivilege	4956	WMIC.exe
Token: SeLoadDriverPrivilege	4956	WMIC.exe
Token: SeSystemProfilePrivilege	4956	WMIC.exe
Token: SeSystemtimePrivilege	4956	WMIC.exe
Token: SeProfSingleProcessPrivilege	4956	WMIC.exe
Token: SeIncBasePriorityPrivilege	4956	WMIC.exe
Token: SeCreatePagefilePrivilege	4956	WMIC.exe
Token: SeBackupPrivilege	4956	WMIC.exe
Token: SeRestorePrivilege	4956	WMIC.exe
Token: SeShutdownPrivilege	4956	WMIC.exe
Token: SeDebugPrivilege	4956	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4956	WMIC.exe
Token: SeRemoteShutdownPrivilege	4956	WMIC.exe
Token: SeUndockPrivilege	4956	WMIC.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 1776	4340	cmd.exe	91
PID 4340 wrote to memory of 2564	4340	cmd.exe	92
PID 4340 wrote to memory of 5100	4340	cmd.exe	93
PID 4340 wrote to memory of 4220	4340	cmd.exe	99
PID 4340 wrote to memory of 2988	4340	cmd.exe	100
PID 2988 wrote to memory of 3204	2988	cmd.exe	101
PID 4340 wrote to memory of 2088	4340	cmd.exe	102
PID 4340 wrote to memory of 4604	4340	cmd.exe	103
PID 4340 wrote to memory of 3600	4340	cmd.exe	104
PID 4340 wrote to memory of 2428	4340	cmd.exe	105
PID 4340 wrote to memory of 3972	4340	cmd.exe	106
PID 4340 wrote to memory of 436	4340	cmd.exe	110
PID 4340 wrote to memory of 4844	4340	cmd.exe	111
PID 4340 wrote to memory of 688	4340	cmd.exe	112
PID 4340 wrote to memory of 5044	4340	cmd.exe	113
PID 4340 wrote to memory of 3976	4340	cmd.exe	114
PID 4340 wrote to memory of 4576	4340	cmd.exe	115
PID 4340 wrote to memory of 2416	4340	cmd.exe	116
PID 4340 wrote to memory of 4684	4340	cmd.exe	117
PID 4340 wrote to memory of 4848	4340	cmd.exe	118
PID 4340 wrote to memory of 3080	4340	cmd.exe	119
PID 4340 wrote to memory of 2860	4340	cmd.exe	120
PID 4340 wrote to memory of 1176	4340	cmd.exe	121
PID 1176 wrote to memory of 4956	1176	cmd.exe	122
PID 4340 wrote to memory of 1060	4340	cmd.exe	124
PID 4340 wrote to memory of 3172	4340	cmd.exe	125
PID 4340 wrote to memory of 1120	4340	cmd.exe	126
PID 4340 wrote to memory of 4816	4340	cmd.exe	127
PID 4340 wrote to memory of 4336	4340	cmd.exe	128
PID 4340 wrote to memory of 3512	4340	cmd.exe	129
PID 3512 wrote to memory of 5072	3512	cmd.exe	130
PID 4340 wrote to memory of 60	4340	cmd.exe	131
PID 4340 wrote to memory of 1920	4340	cmd.exe	132
PID 4340 wrote to memory of 3188	4340	cmd.exe	134
PID 4340 wrote to memory of 4008	4340	cmd.exe	135
PID 4340 wrote to memory of 3760	4340	cmd.exe	136
PID 4340 wrote to memory of 872	4340	cmd.exe	137
PID 872 wrote to memory of 1168	872	cmd.exe	138
PID 4340 wrote to memory of 4632	4340	cmd.exe	140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\KMSServersManager.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:2564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b /s /a-d "C:\Program Files\Microsoft Office\ospp.vbs" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:4220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic.exe Path Win32_OperatingSystem Get Caption /Value" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic.exe Path Win32_OperatingSystem Get Caption /Value
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:3204
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" query "HKU\S-1-5-19"
  2⤵
  PID:2088
- C:\Windows\system32\PING.EXE
  "C:\Windows\system32\ping.exe" -n 1 google.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4604
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKCU\Software\Microsoft\Windows Script Host\Settings" /v "Enabled" /t REG_DWORD /d "1" /f
  2⤵
  PID:3600
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\Software\Microsoft\Windows Script Host\Settings" /v "Enabled" /t REG_DWORD /d "1" /f
  2⤵
  PID:2428
- C:\Users\Admin\AppData\Local\Temp\vlmcs.exe
  "C:\Users\Admin\AppData\Local\Temp\vlmcs.exe" -l 1 -p 192.168.100.2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3972
- C:\Users\Admin\AppData\Local\Temp\vlmcs.exe
  "C:\Users\Admin\AppData\Local\Temp\vlmcs.exe" -l 1 -p vlm.freemyip.com:43615
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:436
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55C92734-D682-4D71-983E-D6EC3F16059F" /f
  2⤵
  PID:4844
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0FF1CE15-A989-479D-AF46-F275C6370663" /f
  2⤵
  PID:688
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "KeyManagementServiceName" /d "vlm.freemyip.com" /t "REG_SZ"
  2⤵
  PID:5044
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "KeyManagementServicePort" /d "43615" /t "REG_SZ"
  2⤵
  PID:3976
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "UserOperations" /d "1" /t "REG_DWORD"
  2⤵
  PID:4576
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55C92734-D682-4D71-983E-D6EC3F16059F" /f /reg:32
  2⤵
  PID:2416
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0FF1CE15-A989-479D-AF46-F275C6370663" /f /reg:32
  2⤵
  PID:4684
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "KeyManagementServiceName" /d "vlm.freemyip.com" /t "REG_SZ" /reg:32
  2⤵
  PID:4848
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "KeyManagementServicePort" /d "43615" /t "REG_SZ" /reg:32
  2⤵
  PID:3080
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "UserOperations" /d "1" /t "REG_DWORD" /reg:32
  2⤵
  PID:2860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Windows\system32\wbem\wmic.exe path SoftwareLicensingProduct where (Name LIKE 'Windows%' and PartialProductKey IS NOT NULL) get Description,GracePeriodRemaining,ID,LicenseFamily,LicenseStatus,Name,PartialProductKey /VALUE" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic.exe path SoftwareLicensingProduct where (Name LIKE 'Windows%' and PartialProductKey IS NOT NULL) get Description,GracePeriodRemaining,ID,LicenseFamily,LicenseStatus,Name,PartialProductKey /VALUE
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:4956
- C:\Windows\system32\cscript.exe
  "C:\Windows\system32\cscript.exe" //NOLOGO "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /dlv 2de67392-b7a7-462a-b1ca-108dd189f588
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:1060
- C:\Users\Admin\AppData\Local\Temp\sed.exe
  "C:\Users\Admin\AppData\Local\Temp\sed.exe" "s/Windows(R) Operating System, /Windows(R), /; s/Windows Operating System - Windows(R) 7, /Windows(R) 7, /; /Activation ID:/d; /Installation ID:/d; /Application ID:/d; /time:/d; /count:/d; /URL:/d; /PID:/d; /(CMID):/d; /version:/d; /client information/d; /activation information:/d; /^$/d; s/^/ /"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3172
- C:\Windows\system32\cscript.exe
  "C:\Windows\system32\cscript.exe" //NOLOGO "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /xpr 2de67392-b7a7-462a-b1ca-108dd189f588
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:1120
- C:\Users\Admin\AppData\Local\Temp\sed.exe
  "C:\Users\Admin\AppData\Local\Temp\sed.exe" "/^$/d; s/^/ /"
  2⤵
  PID:4816
- C:\Users\Admin\AppData\Local\Temp\sed.exe
  "C:\Users\Admin\AppData\Local\Temp\sed.exe" "1d"
  2⤵
  PID:4336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Windows\system32\wbem\wmic.exe path SoftwareLicensingProduct where (Name LIKE 'Office%' and PartialProductKey IS NOT NULL) get ID /VALUE" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic.exe path SoftwareLicensingProduct where (Name LIKE 'Office%' and PartialProductKey IS NOT NULL) get ID /VALUE
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:5072
- C:\Windows\system32\cscript.exe
  "C:\Windows\system32\cscript.exe" //NOLOGO "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /dlv 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:60
- C:\Users\Admin\AppData\Local\Temp\sed.exe
  "C:\Users\Admin\AppData\Local\Temp\sed.exe" "/Activation ID:/d; /Installation ID:/d; /Application ID:/d; /time:/d; /count:/d; /URL:/d; /PID:/d; /(CMID):/d; /version:/d; /client information/d; /activation information:/d; /^$/d; s/^/ /"
  2⤵
  PID:1920
- C:\Windows\system32\cscript.exe
  "C:\Windows\system32\cscript.exe" //NOLOGO "C:\Users\Admin\AppData\Local\Temp\slmgr.vbs" /xpr 85dd8b5f-eaa4-4af3-a628-cce9e77c9a03
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:3188
- C:\Users\Admin\AppData\Local\Temp\sed.exe
  "C:\Users\Admin\AppData\Local\Temp\sed.exe" "/^$/d; s/^/ /"
  2⤵
  PID:4008
- C:\Users\Admin\AppData\Local\Temp\sed.exe
  "C:\Users\Admin\AppData\Local\Temp\sed.exe" "1d"
  2⤵
  PID:3760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Windows\system32\wbem\wmic.exe path OfficeSoftwareProtectionProduct where (Name LIKE 'Office%' and PartialProductKey IS NOT NULL) get ID /VALUE" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic.exe path OfficeSoftwareProtectionProduct where (Name LIKE 'Office%' and PartialProductKey IS NOT NULL) get ID /VALUE
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:1168
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c exit /b 0
  2⤵
  - Executes a command shell one-liner
  PID:4632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

slmgr.vbs

Path C:\Users\Admin\AppData\Local\Temp\slmgr.vbs
Size 139KB
SHA256 95fc646d222d324db46f603a7f675c329fe59a567ed27fdaed2a572a19206816
MD5 3903bcab32a4a853dfa54962112d4d02
SHA1 ba6433fba48797cd43463441358004ac81b76a8b
SHA512 db27b16ec8f8139c44c433d51350fbda6c8f8113e2e8178ff53298b4dace5ef93d65d7cc422f5a2d544d053471c36392da4acd2b7da8af38bb42344db70dbe0a
SSDEEP 1536:CY4NiWnudQV24qf4t0OeJBIGtCnCQf147Xt1wbsSXiMvQiih:CY4h4QAlf4WIICCG14791wXyM4iih
TLSH
T1E9D37283E64750B864B702B3ED1B526EFF60109B60655800BF8E488D5F7679DC3B678E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-12-0x0000000061000000-0x00000000614F0000-memory.dmp

Download

memory/436-13-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/436-15-0x000000006FC40000-0x000000006FC62000-memory.dmp

Download

memory/436-14-0x0000000061000000-0x00000000614F0000-memory.dmp

Download

memory/3972-2-0x0000000061000000-0x00000000614F0000-memory.dmp

Download

memory/3972-3-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3972-5-0x000000006FC40000-0x000000006FC62000-memory.dmp

Download

memory/3972-4-0x0000000061000000-0x00000000614F0000-memory.dmp

Download

memory/3972-10-0x0000000061000000-0x00000000614F0000-memory.dmp

Download

memory/3972-11-0x000000006FC40000-0x000000006FC62000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads