Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 02:52
Behavioral task
behavioral1
Sample
KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAuto++.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAuto++.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/OInstallLite.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/OInstallLite.exe
- Size 6.1MB
- Sample261102-dc5qraev7t
- SHA256 8fce30699b9de40656b887dc483aadfe1bba8e025f079fbb96e88ae3f228825b
- MD5 8605742e929696f5aac1dd37194d8323
- SHA1 8be480d208875a08582c9b4e11bf3ad66ff991c2
- SHA512 69baac6b46bad32cf78a03f2c004e3fd5701dc32224f4dde508205662c988ef5c7fb08cb72488cb4b9018b97695fd382acd92136b7b36266d8b8421027b185f1
- SSDEEP 196608:5bHW796hKqQjgiXuhqprEnIziE0+RO0f+SBoz4H+ty:xrhegiehqprEnIuEfjf+i7e
- TLSH T13B5633F58911A07BF84A55BD98396481244E7C0A1C43FC787E57EEF4BB35AC2A49238F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation setup.exe - Executes dropped EXE 2 IoCs
pid Process 2352 files.dat 1392 setup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral3/memory/1112-0-0x0000000000400000-0x000000000128E000-memory.dmp upx behavioral3/memory/1112-18-0x0000000000400000-0x000000000128E000-memory.dmp upx behavioral3/memory/1112-32-0x0000000000400000-0x000000000128E000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3440 cmd.exe 4052 cmd.exe 1512 cmd.exe 5092 cmd.exe 1140 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OInstallLite.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.dat Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OUTLOOK.EXE Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OUTLOOK.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OUTLOOK.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OUTLOOK.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001" OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" OUTLOOK.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4412 OUTLOOK.EXE - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1040 WMIC.exe Token: SeSecurityPrivilege 1040 WMIC.exe Token: SeTakeOwnershipPrivilege 1040 WMIC.exe Token: SeLoadDriverPrivilege 1040 WMIC.exe Token: SeSystemProfilePrivilege 1040 WMIC.exe Token: SeSystemtimePrivilege 1040 WMIC.exe Token: SeProfSingleProcessPrivilege 1040 WMIC.exe Token: SeIncBasePriorityPrivilege 1040 WMIC.exe Token: SeCreatePagefilePrivilege 1040 WMIC.exe Token: SeBackupPrivilege 1040 WMIC.exe Token: SeRestorePrivilege 1040 WMIC.exe Token: SeShutdownPrivilege 1040 WMIC.exe Token: SeDebugPrivilege 1040 WMIC.exe Token: SeSystemEnvironmentPrivilege 1040 WMIC.exe Token: SeRemoteShutdownPrivilege 1040 WMIC.exe Token: SeUndockPrivilege 1040 WMIC.exe Token: SeManageVolumePrivilege 1040 WMIC.exe Token: 33 1040 WMIC.exe Token: 34 1040 WMIC.exe Token: 35 1040 WMIC.exe Token: 36 1040 WMIC.exe Token: SeIncreaseQuotaPrivilege 1040 WMIC.exe Token: SeSecurityPrivilege 1040 WMIC.exe Token: SeTakeOwnershipPrivilege 1040 WMIC.exe Token: SeLoadDriverPrivilege 1040 WMIC.exe Token: SeSystemProfilePrivilege 1040 WMIC.exe Token: SeSystemtimePrivilege 1040 WMIC.exe Token: SeProfSingleProcessPrivilege 1040 WMIC.exe Token: SeIncBasePriorityPrivilege 1040 WMIC.exe Token: SeCreatePagefilePrivilege 1040 WMIC.exe Token: SeBackupPrivilege 1040 WMIC.exe Token: SeRestorePrivilege 1040 WMIC.exe Token: SeShutdownPrivilege 1040 WMIC.exe Token: SeDebugPrivilege 1040 WMIC.exe Token: SeSystemEnvironmentPrivilege 1040 WMIC.exe Token: SeRemoteShutdownPrivilege 1040 WMIC.exe Token: SeUndockPrivilege 1040 WMIC.exe Token: SeManageVolumePrivilege 1040 WMIC.exe Token: 33 1040 WMIC.exe Token: 34 1040 WMIC.exe Token: 35 1040 WMIC.exe Token: 36 1040 WMIC.exe Token: SeIncreaseQuotaPrivilege 4232 WMIC.exe Token: SeSecurityPrivilege 4232 WMIC.exe Token: SeTakeOwnershipPrivilege 4232 WMIC.exe Token: SeLoadDriverPrivilege 4232 WMIC.exe Token: SeSystemProfilePrivilege 4232 WMIC.exe Token: SeSystemtimePrivilege 4232 WMIC.exe Token: SeProfSingleProcessPrivilege 4232 WMIC.exe Token: SeIncBasePriorityPrivilege 4232 WMIC.exe Token: SeCreatePagefilePrivilege 4232 WMIC.exe Token: SeBackupPrivilege 4232 WMIC.exe Token: SeRestorePrivilege 4232 WMIC.exe Token: SeShutdownPrivilege 4232 WMIC.exe Token: SeDebugPrivilege 4232 WMIC.exe Token: SeSystemEnvironmentPrivilege 4232 WMIC.exe Token: SeRemoteShutdownPrivilege 4232 WMIC.exe Token: SeUndockPrivilege 4232 WMIC.exe Token: SeManageVolumePrivilege 4232 WMIC.exe Token: 33 4232 WMIC.exe Token: 34 4232 WMIC.exe Token: 35 4232 WMIC.exe Token: 36 4232 WMIC.exe Token: SeIncreaseQuotaPrivilege 4232 WMIC.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE - Suspicious use of SetWindowsHookEx 24 IoCs
pid Process 1392 setup.exe 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE 4412 OUTLOOK.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1112 wrote to memory of 1512 1112 OInstallLite.exe 83 PID 1512 wrote to memory of 1040 1512 cmd.exe 85 PID 1112 wrote to memory of 5092 1112 OInstallLite.exe 87 PID 5092 wrote to memory of 4232 5092 cmd.exe 89 PID 1112 wrote to memory of 1140 1112 OInstallLite.exe 90 PID 1112 wrote to memory of 3440 1112 OInstallLite.exe 92 PID 3440 wrote to memory of 2352 3440 cmd.exe 94 PID 1112 wrote to memory of 4052 1112 OInstallLite.exe 100 PID 1112 wrote to memory of 4412 1112 OInstallLite.exe 102 PID 4052 wrote to memory of 1392 4052 cmd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\OInstallLite.exe"C:\Users\Admin\AppData\Local\Temp\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\OInstallLite.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\OInstallLite.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\OInstallLite.exe"3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1040
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\files"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\files"3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4232
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /D /c copy C:\Windows\system32\Tasks\OInstall "C:\Windows\Temp\OInstall.tmp" /Y2⤵
- Executes a command shell one-liner
PID:1140
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /D /c files.dat -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\files\files.datfiles.dat -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2352
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /D /c C:\Users\Admin\AppData\Local\Temp\KMSAUT~1.COM\KMSAUT~1.COM\files\Setup.exe /configure Configure.xml2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\KMSAUT~1.COM\KMSAUT~1.COM\files\setup.exeC:\Users\Admin\AppData\Local\Temp\KMSAUT~1.COM\KMSAUT~1.COM\files\Setup.exe /configure Configure.xml3⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1392
-
-
-
C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4412
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\KMSAUT~1.COM\KMSAUT~1.COM\files\Configure.xml
- Size 502B
- SHA256 5dd6a2cbaf3fe54e623ae8ca79cf3b4bd15871c2ea68a3ce669a854238fd1223
- MD5 057b592b8166e85054f04a76633be4b9
- SHA1 bccbf3660857aacd72fe7925800804ee10f728c2
- SHA512 41bd363e55d4e1532d961b39fa1771a6537aed57dca95a3befe5d006bf79d0ec1d1ead376f721b9c8a49fa0c86a457583690f5158af31fe4aa6735aafd4969c3
- TLSH T13AF08290EA9C2D856731513991CA6B85FD6622634D212D08B18FA64B8BFB838334701F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\KMSAUT~1.COM\KMSAUT~1.COM\files\setup.exe
- Size 4.9MB
- SHA256 4574924964e7d584111a4c7acdb61ef19799527e7d5e102beb29f118de9dcede
- MD5 0ddfe5b55d1048f04b30953773b4c83a
- SHA1 5b51462f4c48e809dce8ff3080d5299e3fcace88
- SHA512 46d9e3766f93c09ae0c4f8e9a93e317a5f77eebd824d6bd31747b6ca8b8da31214f470346bdf6ce076cddc23ceafd39f763c451b926d53c8babcb5f7b92cd13a
- SSDEEP 98304:TVME/j6ItxMf+5uFXyZr/Hv5xaFRwawbANkAY3swY2hrcd:TpmzVy9/P5xaFfWwd
- TLSH T190365A2AE7D44436F1F61B309D786749567DB9722D32C8CF32541A0D6ABCAD2A83073B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\KMSAutoPlusPlus.1.5.4_www.Downloadha.com_\files\files.dat
- Size 707KB
- SHA256 7a1c82e264258470d14ca345ea1a9b6fc34fa19b393a92077a01be5f1ad08f47
- MD5 55d21b2c272a5d6b9f54fa9ed82bf9eb
- SHA1 32464cba823cd9b7e94e4fa1a32a8f2344b0f33b
- SHA512 1b68d0c61367717529be4a3aa347bb69d3e21de7a89b10e8b0aa54d40af988cc0cc8e63298ba595a93c3372aca3770ace1eee2780a59238d0948499dbb4be725
- SSDEEP 12288:3XikbkgaISKVHNJhk2X4hGeHJ3ZWpZaw+ovKE88agUZ+Z00KvxHbeQiHhYfNx9nj:3Xi6kgaINVHLhk2XeH2xPHXUZf0IeQs8
- TLSH T16AF402123AF1C13BE1420532CEC9ABF6A1F2E2580F21885773D51B2D3EBD985D635B69
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\OFFICE~1\v32_16.0.20326.20232.cab
- Size 11KB
- SHA256 b9d2f3b72f7d3a3ac9844369e96305e3387f50bf67570f50a06c01ac9747c047
- MD5 4af86bff5d7136ab2a32a275f4c32bf5
- SHA1 191d0822031f2a906665b38e13128ccc28ab550a
- SHA512 f09501bbeee9f75786c393b8fa702b2075f774b69f0fd67416db5893689f7a7af2557e63accd07dded7155ee85f67460c01d1d358ac87b022d2ac87f0a7914cd
- SSDEEP 192:JCx3sYYcu5ca8LxyQxh4FYqwNGItX87EthuFwleX01k9z3A0tEcYg+fM:ksrlcaGAEh4FYVNGItXtUwleR9zhtEcX
- TLSH T1D6425BD29A6C9083ED96BDA09368EEC77D3CC3C71E40E4A62595F55819C33C9DB2903D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\OfficeC2RF5CBC0BF-D119-4DB8-BD8E-9995D1449D08\VersionDescriptor.xml
- Size 25KB
- SHA256 1d243b2184dea4ccfc91ae445c59ebeebd75a3072efa05cb79205baccd26e2d1
- MD5 42de909c8d3d947bd6cb1c13bb6f37c9
- SHA1 9bdd492224ad2c5adf5b8ccdf19975746c798975
- SHA512 01403bfb691d4465e1651aa32059bdcbeb31636d1da1ba1f58240c2d3a22cd3d7bba78b3981c63d0df7efa13ea3bcc010fb11da1c66c7dff4dcdfb6cbb8528a2
- SSDEEP 96:LBjDt5O8qwEB+yY/VqJFWRGB/Aylkmo9g9s5UmiVSItzt3XNIR4ja9a9DMeJVnOX:l/rZ73
- TLSH T15DC2456BB8D03D1D413477A7E96336E2EF62826396050458F10D738B3FB285DB3AB619
- MD5 SHA1 SHA512 SSDEEP TLSH