b839e6f4a6d6facd4194c8ca856a9876d31c355c176daa2a7b3917c4b7aa9f4a

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KMSAuto x64.exe
Size 5.0MB
Sample261022-tb268sdv5x
SHA256 b839e6f4a6d6facd4194c8ca856a9876d31c355c176daa2a7b3917c4b7aa9f4a
MD5 17cbc60522bb2a9e4dc245836a1da52b
SHA1 3932e9571e250025201170ae22000c369cb2e5e0
SHA512 45fac02b05d3f4d66c11a10e2ef6486b22293747b51dbce9bb7e597c09aab247a93c95fd71c04c369f7f636cd1d11fb670bb0d41c87f28acfe3068ab51eb4cbe
SSDEEP 98304:aojpJWpPS0r5LIbGVrVDFlP7Z8E68VA4DBfT8QKfw6aFhTUzDzvh3/RVJeNnmk0g:bar5UKV5NJ8slFUzvpZSyCt5cjED083l
TLSH
T1B83633374C8652E1F4812C70AA7EBDD015197A272E4535712F06DD88A97FEC3DAEA30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation upx

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 8 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4488	netsh.exe
1208	netsh.exe
5628	netsh.exe
5188	netsh.exe
4860	netsh.exe
4676	netsh.exe
1800	netsh.exe
5476	netsh.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\KMSEmulator\ImagePath = "\"C:\\Windows\\KMS\\bin\\KMSSS.exe\" -Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -PO16 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort -Log -IP"	KMSAuto x64.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4612	signtool.exe
2624	MSActBackup.exe
4292	KMSSS.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3824-0-0x0000000140000000-0x0000000140680000-memory.dmp	upx
behavioral2/files/0x00030000000170c6-9.dat	upx
behavioral2/memory/2624-11-0x0000000000400000-0x0000000000592000-memory.dmp	upx
behavioral2/memory/2624-13-0x0000000000400000-0x0000000000592000-memory.dmp	upx
behavioral2/memory/3824-14-0x0000000140000000-0x0000000140680000-memory.dmp	upx
behavioral2/memory/3824-52-0x0000000140000000-0x0000000140680000-memory.dmp	upx
behavioral2/memory/3824-53-0x0000000140000000-0x0000000140680000-memory.dmp	upx
behavioral2/memory/3824-54-0x0000000140000000-0x0000000140680000-memory.dmp	upx
behavioral2/memory/3824-55-0x0000000140000000-0x0000000140680000-memory.dmp	upx
behavioral2/memory/3824-56-0x0000000140000000-0x0000000140680000-memory.dmp	upx
behavioral2/memory/3824-57-0x0000000140000000-0x0000000140680000-memory.dmp	upx
behavioral2/memory/3824-60-0x0000000140000000-0x0000000140680000-memory.dmp	upx
behavioral2/memory/3824-61-0x0000000140000000-0x0000000140680000-memory.dmp	upx
behavioral2/memory/3824-62-0x0000000140000000-0x0000000140680000-memory.dmp	upx
behavioral2/memory/3824-63-0x0000000140000000-0x0000000140680000-memory.dmp	upx
behavioral2/memory/3824-64-0x0000000140000000-0x0000000140680000-memory.dmp	upx
behavioral2/memory/3824-65-0x0000000140000000-0x0000000140680000-memory.dmp	upx
behavioral2/memory/3824-66-0x0000000140000000-0x0000000140680000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\KMS\bin\KMSSS.exe	KMSAuto x64.exe
File opened for modification	C:\Windows\KMS\bin\KMSSS.log	KMSSS.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2828	sc.exe
4848	sc.exe
1980	sc.exe
2700	sc.exe
860	sc.exe
3976	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 20 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3224	cmd.exe
5340	cmd.exe
4744	cmd.exe
3384	cmd.exe
1976	cmd.exe
2992	cmd.exe
2096	cmd.exe
896	cmd.exe
4336	cmd.exe
4940	cmd.exe
6028	cmd.exe
4088	cmd.exe
5384	cmd.exe
4800	cmd.exe
4432	cmd.exe
3240	cmd.exe
1816	cmd.exe
5452	cmd.exe
1764	cmd.exe
2856	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 15 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSActBackup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	KMSSS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSActBackup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	KMSAuto x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	signtool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSActBackup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KMSSS.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
6080	WMIC.exe
6080	WMIC.exe
6080	WMIC.exe
6080	WMIC.exe
2380	wmic.exe
2380	wmic.exe
2380	wmic.exe
2380	wmic.exe
5616	WMIC.exe
5616	WMIC.exe
5616	WMIC.exe
5616	WMIC.exe
2864	WMIC.exe
2864	WMIC.exe
2864	WMIC.exe
2864	WMIC.exe
1964	WMIC.exe
1964	WMIC.exe
1964	WMIC.exe
1964	WMIC.exe
2608	WMIC.exe
2608	WMIC.exe
2608	WMIC.exe
2608	WMIC.exe
3824	KMSAuto x64.exe
3824	KMSAuto x64.exe
3824	KMSAuto x64.exe
3824	KMSAuto x64.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	6080	WMIC.exe
Token: SeSecurityPrivilege	6080	WMIC.exe
Token: SeTakeOwnershipPrivilege	6080	WMIC.exe
Token: SeLoadDriverPrivilege	6080	WMIC.exe
Token: SeSystemProfilePrivilege	6080	WMIC.exe
Token: SeSystemtimePrivilege	6080	WMIC.exe
Token: SeProfSingleProcessPrivilege	6080	WMIC.exe
Token: SeIncBasePriorityPrivilege	6080	WMIC.exe
Token: SeCreatePagefilePrivilege	6080	WMIC.exe
Token: SeBackupPrivilege	6080	WMIC.exe
Token: SeRestorePrivilege	6080	WMIC.exe
Token: SeShutdownPrivilege	6080	WMIC.exe
Token: SeDebugPrivilege	6080	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6080	WMIC.exe
Token: SeRemoteShutdownPrivilege	6080	WMIC.exe
Token: SeUndockPrivilege	6080	WMIC.exe
Token: SeManageVolumePrivilege	6080	WMIC.exe
Token: 33	6080	WMIC.exe
Token: 34	6080	WMIC.exe
Token: 35	6080	WMIC.exe
Token: 36	6080	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6080	WMIC.exe
Token: SeSecurityPrivilege	6080	WMIC.exe
Token: SeTakeOwnershipPrivilege	6080	WMIC.exe
Token: SeLoadDriverPrivilege	6080	WMIC.exe
Token: SeSystemProfilePrivilege	6080	WMIC.exe
Token: SeSystemtimePrivilege	6080	WMIC.exe
Token: SeProfSingleProcessPrivilege	6080	WMIC.exe
Token: SeIncBasePriorityPrivilege	6080	WMIC.exe
Token: SeCreatePagefilePrivilege	6080	WMIC.exe
Token: SeBackupPrivilege	6080	WMIC.exe
Token: SeRestorePrivilege	6080	WMIC.exe
Token: SeShutdownPrivilege	6080	WMIC.exe
Token: SeDebugPrivilege	6080	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6080	WMIC.exe
Token: SeRemoteShutdownPrivilege	6080	WMIC.exe
Token: SeUndockPrivilege	6080	WMIC.exe
Token: SeManageVolumePrivilege	6080	WMIC.exe
Token: 33	6080	WMIC.exe
Token: 34	6080	WMIC.exe
Token: 35	6080	WMIC.exe
Token: 36	6080	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2380	wmic.exe
Token: SeSecurityPrivilege	2380	wmic.exe
Token: SeTakeOwnershipPrivilege	2380	wmic.exe
Token: SeLoadDriverPrivilege	2380	wmic.exe
Token: SeSystemProfilePrivilege	2380	wmic.exe
Token: SeSystemtimePrivilege	2380	wmic.exe
Token: SeProfSingleProcessPrivilege	2380	wmic.exe
Token: SeIncBasePriorityPrivilege	2380	wmic.exe
Token: SeCreatePagefilePrivilege	2380	wmic.exe
Token: SeBackupPrivilege	2380	wmic.exe
Token: SeRestorePrivilege	2380	wmic.exe
Token: SeShutdownPrivilege	2380	wmic.exe
Token: SeDebugPrivilege	2380	wmic.exe
Token: SeSystemEnvironmentPrivilege	2380	wmic.exe
Token: SeRemoteShutdownPrivilege	2380	wmic.exe
Token: SeUndockPrivilege	2380	wmic.exe
Token: SeManageVolumePrivilege	2380	wmic.exe
Token: 33	2380	wmic.exe
Token: 34	2380	wmic.exe
Token: 35	2380	wmic.exe
Token: 36	2380	wmic.exe
Token: SeIncreaseQuotaPrivilege	2380	wmic.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3824	KMSAuto x64.exe
3824	KMSAuto x64.exe
3824	KMSAuto x64.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 3240	3824	KMSAuto x64.exe	89
PID 3824 wrote to memory of 3384	3824	KMSAuto x64.exe	90
PID 3384 wrote to memory of 6080	3384	cmd.exe	93
PID 3824 wrote to memory of 4612	3824	KMSAuto x64.exe	94
PID 3824 wrote to memory of 2380	3824	KMSAuto x64.exe	97
PID 3824 wrote to memory of 1976	3824	KMSAuto x64.exe	100
PID 1976 wrote to memory of 5616	1976	cmd.exe	102
PID 3824 wrote to memory of 2992	3824	KMSAuto x64.exe	103
PID 2992 wrote to memory of 2864	2992	cmd.exe	105
PID 3824 wrote to memory of 2096	3824	KMSAuto x64.exe	106
PID 2096 wrote to memory of 1964	2096	cmd.exe	108
PID 3824 wrote to memory of 896	3824	KMSAuto x64.exe	109
PID 896 wrote to memory of 2700	896	cmd.exe	111
PID 3824 wrote to memory of 2624	3824	KMSAuto x64.exe	112
PID 3824 wrote to memory of 4336	3824	KMSAuto x64.exe	113
PID 4336 wrote to memory of 860	4336	cmd.exe	115
PID 3824 wrote to memory of 4940	3824	KMSAuto x64.exe	116
PID 4940 wrote to memory of 4860	4940	cmd.exe	118
PID 3824 wrote to memory of 1816	3824	KMSAuto x64.exe	119
PID 1816 wrote to memory of 4676	1816	cmd.exe	121
PID 3824 wrote to memory of 5452	3824	KMSAuto x64.exe	122
PID 5452 wrote to memory of 2608	5452	cmd.exe	124
PID 3824 wrote to memory of 6028	3824	KMSAuto x64.exe	125
PID 6028 wrote to memory of 1800	6028	cmd.exe	127
PID 3824 wrote to memory of 2856	3824	KMSAuto x64.exe	128
PID 2856 wrote to memory of 5476	2856	cmd.exe	130
PID 3824 wrote to memory of 4088	3824	KMSAuto x64.exe	132
PID 4088 wrote to memory of 4488	4088	cmd.exe	134
PID 3824 wrote to memory of 5384	3824	KMSAuto x64.exe	135
PID 5384 wrote to memory of 1208	5384	cmd.exe	137
PID 3824 wrote to memory of 3224	3824	KMSAuto x64.exe	138
PID 3224 wrote to memory of 3976	3224	cmd.exe	140
PID 3824 wrote to memory of 4800	3824	KMSAuto x64.exe	141
PID 4800 wrote to memory of 2828	4800	cmd.exe	143
PID 3824 wrote to memory of 4432	3824	KMSAuto x64.exe	145
PID 4432 wrote to memory of 5628	4432	cmd.exe	147
PID 3824 wrote to memory of 1764	3824	KMSAuto x64.exe	148
PID 1764 wrote to memory of 5188	1764	cmd.exe	150
PID 3824 wrote to memory of 5340	3824	KMSAuto x64.exe	151
PID 5340 wrote to memory of 4848	5340	cmd.exe	153
PID 3824 wrote to memory of 4744	3824	KMSAuto x64.exe	154
PID 4744 wrote to memory of 1980	4744	cmd.exe	156

C:\Users\Admin\AppData\Local\Temp\KMSAuto x64.exe
"C:\Users\Admin\AppData\Local\Temp\KMSAuto x64.exe"
1⤵
- Sets service image path in registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy C:\Windows\system32\Tasks\KMSAuto "C:\Users\Admin\AppData\Local\Temp\KMSAuto.tmp" /Y
  2⤵
  - Executes a command shell one-liner
  PID:3240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\KMSAuto x64.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\KMSAuto x64.exe"
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6080
- C:\Users\Admin\AppData\Local\Temp\signtool.exe
  "C:\Users\Admin\AppData\Local\Temp\signtool.exe" verify /v /ph /sha1 648384a4dee53d4c1c87e10d67cc99307ccc9c98 "C:\Users\Admin\AppData\Local\Temp\KMSAuto x64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4612
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path Win32_NetworkAdapter get ServiceName /value /FORMAT:List
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\KMSAuto_Files"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\KMSAuto_Files"
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:5616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\System32\SppExtComObjPatcher.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\System32\SppExtComObjPatcher.exe"
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\System32\SppExtComObjHook.dll"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\System32\SppExtComObjHook.dll"
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc.exe stop KMSEmulator
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Windows\system32\sc.exe
    sc.exe stop KMSEmulator
    3⤵
    - Launches sc.exe
    PID:2700
- C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe
  "C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc.exe delete KMSEmulator
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\system32\sc.exe
    sc.exe delete KMSEmulator
    3⤵
    - Launches sc.exe
    PID:860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4676
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\KMS"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5452
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Windows\KMS"
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6028
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS2 dir=out action=allow protocol=TCP localport=1688
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5384
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS2 dir=out action=allow protocol=TCP localport=1688
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc.exe create KMSEmulator binpath= temp.exe type= own start= auto
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\system32\sc.exe
    sc.exe create KMSEmulator binpath= temp.exe type= own start= auto
    3⤵
    - Launches sc.exe
    PID:3976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc.exe start KMSEmulator
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\system32\sc.exe
    sc.exe start KMSEmulator
    3⤵
    - Launches sc.exe
    PID:2828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc.exe create KMSEmulator binpath= temp.exe type= own start= auto
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5340
- - C:\Windows\system32\sc.exe
    sc.exe create KMSEmulator binpath= temp.exe type= own start= auto
    3⤵
    - Launches sc.exe
    PID:4848
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc.exe start KMSEmulator
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\system32\sc.exe
    sc.exe start KMSEmulator
    3⤵
    - Launches sc.exe
    PID:1980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5764

C:\Windows\KMS\bin\KMSSS.exe
"C:\Windows\KMS\bin\KMSSS.exe" -Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -PO16 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort -Log -IP
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

MSActBackup.exe

Path C:\Users\Admin\AppData\Local\Temp\MSActBackup.exe
Size 606KB
SHA256 c6fb36ed2fab7cc2e1da55ac27342dc5438b358333eae15f662239a1d3a3324d
MD5 2246bcdf9c6f77e6f5a8ba98c16666a6
SHA1 dc05882dfea474d3705dd25d0456988274ce4302
SHA512 a8ccd4a51d1242658766348aeb2ae36157bebf0b5febf54caa140e1ace8da9ddcb3a9d9ea6b9a96200fb1682a13b9a9cde66d6ab562647fad2d033b7fdbf117f
SSDEEP 12288:P93bWrrt23AAc5HAguaco6+JuQaZn1pTrndsyiIAIieYvxzMx6L:PdbWrB23NcNE+J4n1pTyfI7+
TLSH
T1D5D4F12A4E6BC0C9D430D878ED6A9BF227951D6CCA077073A2D2FF7A7431911357B60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

signtool.exe

Path C:\Users\Admin\AppData\Local\Temp\signtool.exe
Size 323KB
SHA256 962a92821f54a1e706aa989973130fdc1072c7bd8b9e6d11ea1050b46eb9d313
MD5 05624e6d27eaef0db0673ae627bd6027
SHA1 b155c76bf59992a8d75d0e3a59dc94f24aff2591
SHA512 233304669aefeec9ad5d19bd2dd5bb19ea35ce31da0b3aabe5ab859259608a58725fac5993637c9635e5912138d3eb477773351f0ee81cc3ce756d713163cf31
SSDEEP 6144:rGBPAy1RetfND/lq7v+OFMOrEGFWw7o44unfU0AEITfpkeUe0iZXOD:rGBYy1R+fND9qxAmD/5fbOTfvZE
TLSH
T1E7640722A7E84535F9F33A31197C6224167BFC619F3182CF6288069E9A72BD1DD30767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KMSSS.exe

Path C:\Windows\KMS\bin\KMSSS.exe
Size 33KB
SHA256 fd7499214abaa13bf56d006ab7de78eb8d6adf17926c24ace024d067049bc81d
MD5 01a80aad5dabed1c1580f7e00213cf9d
SHA1 174f9e420ab6c21e59ff7a0e42b8ebb3d742f0ec
SHA512 f254dfc103f79093bbae02d03d5906aafab7a94fa946373037407c270e67f0eb7972f8524cf2d98129bf6af2b8ba50f4ba0fb2b31d9d7b4dcb45d79e689d325b
SSDEEP 384:ZwpXyDvPidEhiXOOB9deeQmKnIicEcXTdof0mhBjpLfh/oCqkg4XZmblE7llJmYN:Zwsbi4i9QebPsnUrukDDd828fRRT
TLSH
T137F207C355F656A1F0F242F5441A9F03DA77B2300AF74A94EB9E80917E91543BF2A9C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KMSSS.log

Path C:\Windows\KMS\bin\KMSSS.log
Size 773B
SHA256 2d2f642b751e45ee9a6311e1c7799cc1c5e4ce9f544723c92c27e5bea63f4f70
MD5 c16761999d6d4c4f214ea93153c491af
SHA1 471e0e29a41c10fd0ef60a33dde8e3c8b08b2469
SHA512 ae78fadd2fa6d4616836463292b43afe9e291d2fed374be30f0cac64fc93f63462a7f1e60bf3a2c98db5915393b0939221762cdcf4b9d46095fc4e0946263fbb
TLSH
T1F6014C005E5FF1964663C98B00460D03D7B5E0234A5A394933DEA0E62BF5B5573CC908
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2624-11-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/2624-13-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/3824-54-0x0000000140000000-0x0000000140680000-memory.dmp

Download

memory/3824-57-0x0000000140000000-0x0000000140680000-memory.dmp

Download

memory/3824-52-0x0000000140000000-0x0000000140680000-memory.dmp

Download

memory/3824-53-0x0000000140000000-0x0000000140680000-memory.dmp

Download

memory/3824-0-0x0000000140000000-0x0000000140680000-memory.dmp

Download

memory/3824-55-0x0000000140000000-0x0000000140680000-memory.dmp

Download

memory/3824-56-0x0000000140000000-0x0000000140680000-memory.dmp

Download

memory/3824-14-0x0000000140000000-0x0000000140680000-memory.dmp

Download

memory/3824-60-0x0000000140000000-0x0000000140680000-memory.dmp

Download

memory/3824-61-0x0000000140000000-0x0000000140680000-memory.dmp

Download

memory/3824-62-0x0000000140000000-0x0000000140680000-memory.dmp

Download

memory/3824-63-0x0000000140000000-0x0000000140680000-memory.dmp

Download

memory/3824-64-0x0000000140000000-0x0000000140680000-memory.dmp

Download

memory/3824-65-0x0000000140000000-0x0000000140680000-memory.dmp

Download

memory/3824-66-0x0000000140000000-0x0000000140680000-memory.dmp

Download