30693d020456f4f4b0d2a6c6c13d907787283fcea11f0459e75bf9c55e100350

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAuto++.exe
Size 15.1MB
Sample261102-dc5qraev7t
SHA256 30693d020456f4f4b0d2a6c6c13d907787283fcea11f0459e75bf9c55e100350
MD5 dc363fc9636f9474c44b123afba3e899
SHA1 2c25821a4106f2ae48b7f8c46d0e1344694c6414
SHA512 5780c86a6ed0d6f7a4682ac9b471831a2cd9bfd7b4125c7f094dc8e396d454af759ec07f551c209b7299bff2b33acf36b51ce6db36a1d15369a8e1086de8d40a
SSDEEP 393216:Y2oMfRxxyaqpOeD5lXBMA16PQyp+Ap8KRoM/vR:Y2o2jQaqpOeDfXKA1TypSm5
TLSH
T106F6337B485261E8F4813C705A2EFCE4351978232E4579712D47CAE9887AEC3E7DA70B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4256 set thread context of 4912	4256	KMSAuto++.exe	88

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4256-0-0x0000000000400000-0x00000000014E9000-memory.dmp	upx
behavioral2/memory/4256-6-0x0000000000400000-0x00000000014E9000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KMSAuto++.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4256	KMSAuto++.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 4912	4256	KMSAuto++.exe	88
PID 4256 wrote to memory of 4912	4256	KMSAuto++.exe	88
PID 4256 wrote to memory of 4912	4256	KMSAuto++.exe	88
PID 4256 wrote to memory of 4912	4256	KMSAuto++.exe	88
PID 4256 wrote to memory of 4912	4256	KMSAuto++.exe	88
PID 4256 wrote to memory of 4912	4256	KMSAuto++.exe	88
PID 4256 wrote to memory of 4912	4256	KMSAuto++.exe	88
PID 4256 wrote to memory of 4912	4256	KMSAuto++.exe	88

C:\Users\Admin\AppData\Local\Temp\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\KMSAuto++.exe
"C:\Users\Admin\AppData\Local\Temp\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\KMSAuto++.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Users\Admin\AppData\Local\Temp\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\KMSAuto++.exe
  C:\Users\Admin\AppData\Local\Temp\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\KMSAuto++.exe -U:S -P:E "C:\Users\Admin\AppData\Local\Temp\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\KMSAuto++.exe"
  2⤵
  PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4256-0-0x0000000000400000-0x00000000014E9000-memory.dmp

Download

memory/4256-1-0x00000000014E8000-0x00000000014E9000-memory.dmp

Download

memory/4256-6-0x0000000000400000-0x00000000014E9000-memory.dmp

Download

memory/4912-4-0x0000000000400000-0x000000000046E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads