General
- Target 18b46e3cc797915adea96ea362982b100dc0bedbc094d806c07a9ff6af9f13fe
- Size 4.8MB
- Sample261002-d4tgss1fkc
- SHA256 18b46e3cc797915adea96ea362982b100dc0bedbc094d806c07a9ff6af9f13fe
Score
7/10
Malware Config
Targets
-
- Target KMS/HEU_KMS_Activator_v64.0.0.exe
- Size 4.5MB
- SHA256 6ad72af453a9c4db99a30317e97689e893a110681e84655392865c8a813e8a5c
Score7/10-
Executes dropped EXE
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target KMS/当前目录添加到WD白名单.cmd
- Size 416B
- SHA256 f9e65a39bfcb45fa75a3fcce4c421a33ddd726dbf5a300ada0623f1ee3fcded2
Score6/10-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target KMS/当前目录移除WD白名单.cmd
- Size 422B
- SHA256 608896bbc173dda3037eefca287ad6de2b032c14423b01d06135632c54037995
Score6/10-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1