e747f20329cbd4725dff62169f7097d0b81cbb8633b70670f9183064ae490558

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 02:10

Target
UnInstall_Task_KMSServersManager.cmd
Size 2KB
Sample260930-clq4aat19j
SHA256 e747f20329cbd4725dff62169f7097d0b81cbb8633b70670f9183064ae490558
MD5 75efc06e0a28726010692423ad39f6e4
SHA1 75990073d32ba11f2b1b8878c7d12c17297b21a7
SHA512 1ebf88b6d58b5b09836b7e725d7d9b193c01384ccaa51a2368ac4bee62308b3a6e19e888a502ba65d6bbb7ceb03b6901fd5affd8410e8901d0d0ff7bedf03127
TLSH
T1FB411316215642561070B377AA113D67BB8D81FF2B78D39833A2187D32DF112D6E93D9
MD5 SHA1 SHA512 TLSH

Score

6^/10

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
5040	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

pid	Process
1172	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1172	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 3396	5040	cmd.exe	88
PID 5040 wrote to memory of 5656	5040	cmd.exe	89
PID 5040 wrote to memory of 5020	5040	cmd.exe	90
PID 5040 wrote to memory of 4352	5040	cmd.exe	91
PID 5040 wrote to memory of 1172	5040	cmd.exe	93
PID 5040 wrote to memory of 1692	5040	cmd.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\UnInstall_Task_KMSServersManager.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3396
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" query "HKU\S-1-5-19"
  2⤵
  PID:5656
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /end /tn "KMSServersManager"
  2⤵
  PID:5020
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /delete /tn "KMSServersManager" /f
  2⤵
  PID:4352
- C:\Windows\system32\PING.EXE
  C:\Windows\system32\ping.exe -n 4 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1172
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del /f /q "C:\ProgramData\KMSServersManager\*"
  2⤵
  PID:1692