24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 4a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious HackTool/KMSAuto Sample 69a8ae6352cf… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 69a8ae6352cf…. Malware family: HackTool/KMSAuto. Threat score 100/100. 16/27 AV engines flagged this file. 10 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/69a8ae6352cffd366409df8e566e84315b4bffcf5865a4b8079c446123ba1d26","keywords":["Malicious","HackTool/KMSAuto","malware analysis","sandbox report","threat intelligence","69a8ae6352cffd366409df8e566e84315b4bffcf5865a4b8079c446123ba1d26"],"about":{"@type":"SoftwareApplication","name":"KMSAuto Net 2015 v1.3.8 Portable.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"69a8ae6352cffd366409df8e566e84315b4bffcf5865a4b8079c446123ba1d26","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"HackTool/KMSAuto","antivirusDetections":{"malicious":16,"total":27},"behavioralIndicators":{"malicious":10,"suspicious":29},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T76a,"" created file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" created file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\config\machine.config" "" created file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ngen.log" "" created file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "" created file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\51e2934144ba15628ba5a31be2dae7dc\mscorlib.ni.dll.aux" "" created file "%WINDIR%\system32\rsaenh.dll" "" created file "%WINDIR%\assembly\pubpol15.dat" "" created file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\536f3c2e6e4137a628f2f64e0dfd407e\Microsoft.VisualBasic.ni.dll.aux" "" created file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\e40da7a49f8c3f0108e7c835b342f382\System.ni.dll.aux" "" created file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\b9f7adbc90a2bcbe8eb9e6e8d2bb975b\System.Core.ni.dll.aux" "" created file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\22ae167d586450ad3a9b9a9ee43ebc86\System.Windows.Forms.ni.dll.aux" "" created file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\72269ea7cc6281139e4d155e7c57dc67\System.Drawing.ni.dll.aux"26:T1ada,Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMAC" (Indicator: "HMAC"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp")27:Ta41,KMSAuto Net.exe has big resource with name: "project16" size: "200903" and abnormal entropy:"6.95144673367" KMSAuto Net.exe has big resource with name: "wushowhide" size: "46682" and abnormal entropy:"7.97366723004" KMSAuto Net.exe has big resource with name: "SppP_x86" size: "159840" and abnormal entropy:"6.47572221642" KMSAuto Net.exe has big resource with name: "Inj_dx64" size: "601558" and abnormal entropy:"7.8129054249" KMSAuto Net.exe has big resource with name: "proplus16" size: "201446" and abnormal entropy:"6.95419365051" KMSAuto Net.exe has big resource with name: "readme_ua" size: "127996" and abnormal entropy:"6.77161223263" KMSAuto Net.exe has big resource with name: "KMS_Log_Analyzer" size: "56159" and abnormal entropy:"7.84387192261" KMSAuto Net.exe has big resource with name: "hidecontrol" size: "529819" and abnormal entropy:"7.77063721759" KMSAuto Net.exe has big resource with name: "pdkutils" size: "189469" and abnormal entropy:"6.84688010619" KMSAuto Net.exe has big resource with name: "Inj_dx86" size: "565211" and abnormal entropy:"7.79249984568" KMSAuto Net.exe has big resource with name: "bin_x86" size: "269358" and abnormal entropy:"7.34031637525" KMSAuto Net.exe has big resource with name: "visio" size: "196484" and abnormal entropy:"6.91246536784" KMSAuto Net.exe has big resource with name: "SppP_x64" size: "161103" and abnormal entropy:"6.49409528227" KMSAuto Net.exe has big resource with name: "bin_x64" size: "276257" and abnormal entropy:"7.36453289895" KMSAuto Net.exe has big resource with name: "bin" size: "290469" and abnormal entropy:"7.41339826568" KMSAuto Net.exe has big resource with name: "readme_cn" size: "871553" and abnormal entropy:"7.16766384987" KMSAuto Net.exe has big resource with name: "MSActBackup" size: "1008888" and abnormal entropy:"6.61073551925" KMSAuto Net.exe has big resource with name: "kmsclient" size: "167122" and abnormal entropy:"6.58372275311" KMSAuto Net.exe has big resource with name: "proplus" size: "197132" and abnormal entropy:"6.91749153864" KMSAuto Net.exe has big resource with name: "readme_vi" size: "111750" and abnormal entropy:"6.74503861805" KMSAuto Net.exe has big resource with name: "visio16" size: "200918" and abnormal entropy:"6.95164959997" KMSAuto Net.exe has big resource with name: "readme_ru" size: "127460" and abnormal entropy:"6.41325302516" KMSAuto Net.exe has big resource with name: "readme_kms" size: "2098626" and abnormal entropy:"7.17246823255" KMSAuto Net.exe has big resource with name: "project" size: "196516" and abnormal entropy:"6.91432622526"28:Tc60,"KMSAutoNet.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000005b0170c8ac0170c8ac010000000009500f7700008b760300000006510f7700000000b0f05b013429e775000000000000000000000000000000002048e775080000000000000050138f763429e775000000000800000070c8ac0100000000000000000000000000000000180000006f46d877a3838b73c8015b0194f05b0128f15b0140b18b7393c80e05feffffff94fc13778097ac010000ab010000000000000000c3918a739cf05b010000000064000000240002003051ab010000000002000000000000000097ac017f97ac018097ac012051ab010000ab0194f05b017cf05b01a6eb0f77000000000000000000000000b047e7753c9e288ab4f05b01 (UID: 00000000-00001252) "KMSAutoNet.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001252) "KMSAutoNet.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001252) "KMSAutoNet.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000008801b4af6801d00888012cd05b01feba0f77000000000000000003000000a86cab01b4af680148d05b01650914771300000000000000d06c4a75f0b92676130000005cd05b01ae2e11770300000000000000d06c4a756cd05b01e16c4a75030000000000000094d05b01682028750300000000000000188cab3a70922e7600000000d4d05b01201b2d75ffffffffe4d05b01581028753c102875688cab3a70922e769cb92676f0b92676c4d05b01c0d05b010d0000000d00000050414a767cc883760000000040414a76e0d05b0158d15b01608d2b75c449c44efefffffff0d05b01900f287550414a7600d15b0106253d767cc8837650414a760cd15b01 (UID: 00000000-00001252) "KMSAutoNet.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000d489288ad0e65b01906bb301d0e95b01b0e812775c5e6ffcfeffffff906bb301787f107700bab00100000000906bb3010a000b00b6c7596f000000000000000060a6596f70a6596f906bb301d829b30114000000000000000000000000bab0010000000000e85b01d7080f77906bb301000000008403fe7f00000000f000526f00000000094d0b3dec6112775fd60e7790030000906bb301000000002cbab001180000000000000088e85b0140080000000000000000000000000000010000003d13bd501900000011000000100000007472b20130a1586ffeffffff10cbab017472b2010000000000000000000000006ce85b01 (UID: 00000000-00001252)29:T479,"KMSAutoNet.exe" queries volume information of "C:\KMSAutoNet.exe" at 00000000-00001252-00000C15-3516950468 "KMSAutoNet.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00001252-00000C15-3517380437 "KMSAutoNet.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00001252-00000C15-3517623279 "KMSAutoNet.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00001252-00000C15-3517876804 "KMSAutoNet.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00001252-00000C15-3519863631 "KMSAutoNet.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll" at 00000000-00001252-00000C15-35207251722a:T404,Found string "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName="ptun0901" get Manufacturer >"" (Indicator: " Win32_NetworkAdapter"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName="ptun0901" get InterfaceIndex >"" (Indicator: " Win32_NetworkAdapter"; File: "KMSAuto Net.exe") Found string "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName=\"ptun0901\" get Manufacturer >\"" (Indicator: " Win32_NetworkAdapter"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName=\"tapoas\" get Manufacturer >\"" (Indicator: " Win32_NetworkAdapter"; File: "KMSAuto Net.exe") Found string "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName=\"ptun0901\" get InterfaceIndex >\"" (Indicator: " Win32_NetworkAdapter"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName=\"tapoas\" get InterfaceIndex >\"" (Indicator: " Win32_NetworkAdapter"; File: "KMSAuto Net.exe")2b:T1509,"KMSAutoNet.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\8d55d7cad944a3f21aeb1db491f3d6de\mscorlib.ni.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\10e5a0803d11b8b826dbeb56a1f98239\System.ni.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\53fcc36b6b7c9cc86e5d7484c1f93bd8\System.Core.ni.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\e4e680611f69d26d704e61dd8bfa4ece\System.Configuration.ni.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\638ba173c955ab83f37edbab9b896f44\System.Xml.ni.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00001252)2c:T4714,"KMSAutoNet.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00001252) "KMSAutoNet.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00001252)2d:T6be,"SELECT Name, Description, LicenseStatus FROM" (Source: KMSAuto Net.exe, Indicator: "select name, description, licensestatus from") "SELECT ID, Name, ApplicationId, PartialProductKey, Description, LicenseIsAddon FROM" (Source: KMSAuto Net.exe, Indicator: "select id, name, applicationid, partialproductkey, description, licenseisaddon from") "SELECT ID, ApplicationId, PartialProductKey, LicenseIsAddon, Description, Name, LicenseStatus FROM" (Source: KMSAuto Net.exe, Indicator: "select id, applicationid, partialproductkey, licenseisaddon, description, name, licensestatus from") "SELECT * FROM Win32_BIOs,SerialNumber" (Source: KMSAuto Net.exe, Indicator: "select * from win32_bios,serialnumber") "Select * FROM Win32_ComputerSystemProduct,UUID" (Source: KMSAuto Net.exe, Indicator: "select * from win32_computersystemproduct,uuid") "SELECT Name, Description FROM" (Source: 60002f5-OfficeConvert~CheckOfficeRetail, Indicator: "select name, description from") "SELECT Version FROM SoftwareLicensingService" (Source: 60002fb-OfficeConvert~WmiInstallLic, Indicator: "select version from softwarelicensingservice") "SELECT ID, ApplicationId, Name, Description, PartialProductKey, LicenseIsAddon, KeyManagementServiceMachine, KeyManagementServicePort, KeyManagementServiceProductKeyID, LicenseStatus, LicenseStatusReason, GracePeriodRemaining, VLActivationInterval, VLRenewalInterval FROM" (Source: 6000341-WmIfunctions~ProductProcess, Indicator: "select id, applicationid, name, description, partialproductkey, licenseisaddon, keymanagementservicemachine, keymanagementserviceport, keymanagementserviceproductkeyid, licensestatus, licensestatusreason, graceperiodremaining, vlactivationinterval, vlrenewalinterval from")2e:T225f,Found reference to API (Indicator: "DeleteService"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "CompareString"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "Sleep"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "GetObject"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "MessageBox"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "CharUpperA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "CharNextA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "CharUpperW"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "SetFileApisToOEM"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "GetVersionExA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "SetConsoleMode"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "GetStdHandle"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "GetLastError"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "AreFileApisANSI"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "LocalFree"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "FormatMessageA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "FormatMessageW"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "CloseHandle"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "SetFileTime"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "CreateFileW"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "SetLastError"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "MoveFileA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "MoveFileW"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "DeleteFileA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "DeleteFileW"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "lstrlenA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "GetFullPathNameA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "FindClose"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "CreateFileA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "GetFileSize"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "SetFilePointer"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "ReadFile"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "WriteFile"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "VirtualFree"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "CreateEventA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "SetEvent"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "ResetEvent"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "FindFirstVolumeA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "VerLanguageNameW"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "Process32FirstW"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "WNetAddConnection2A"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "GetComputerNameExA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "GetModuleFileNameExW"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "DeleteVolumeMountPointA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "FindWindowA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "IsWow64Process"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "Process32First"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "VerQueryValueW"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "NetLocalGroupDelMembers"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "FindNextVolumeA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "SetVolumeMountPointA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "NetUserAdd"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "Process32Next"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "NetLocalGroupGetMembers"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "GetVolumePathNamesForVolumeNameA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "CreateProcessWithLogonW"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "NetUserChangePassword"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "NetLocalGroupAddMembers"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "ShowWindow"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "RegDeleteKeyExA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "WNetAddConnectionA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "CommandLineToArgvW"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "WNetCancelConnectionA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "NetJoinDomain"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "Process32NextW"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "GetLongPathNameA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "NetWkstaUserEnum"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "NetUnjoinDomain"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "SetComputerNameExA"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "NetUserEnum"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "NetApiBufferFree"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "NetGetJoinInformation"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "QueryFullProcessImageNameW"; File: "KMSAuto Net.exe") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp")2f:Tb63,Found string "cmd.exe /c copy" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe") Found string "cmd.exe /c md "" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c bin.dat -y -pkmsauto" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c bin_x64.dat -y -pkmsauto" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c bin_x86.dat -y -pkmsauto" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c reg.exe DELETE HKLM\SYSTEM\CurrentControlSet\Services\" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c taskkill /t /f /IM SppExtComObj.Exe" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c SppPatcher_x64.dat -y -pkmsauto" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c SppPatcher_x86.dat -y -pkmsauto" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c copy SppExtComObjPatcher.exe" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c copy SppExtComObjHook.dll" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName="ptun0901" get Manufacturer >"" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe") Found string "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName="ptun0901" get InterfaceIndex >"" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c netsh interface ip set address" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c Tunmirror.exe /u" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c Tunmirror.exe /i" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c certutil -addstore "TrustedPublisher" oas_sert.cer" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c devcon.exe install tapoas.inf tapoas" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c del /F /Q "" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe") Found string "cmd.exe /c pdk.dat -y -pkmsauto" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe") Found string "cmd.exe /c cscript.exe "" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c cscript.exe "c:\Program Files (x86)\Microsoft Office\Office15\ospp.vbs" /setprt:" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c cscript.exe "c:\Program Files\Microsoft Office\Office15\ospp.vbs" /sethst:" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c cscript.exe "c:\Program Files (x86)\Microsoft Office\Office14\ospp.vbs" /setprt:" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c cscript.exe "c:\Program Files\Microsoft Office\Office14\ospp.vbs" /sethst:" (Indicator: "cmd.exe /c"; File: "KMSAuto Net.exe")30:T135b,"SYSTEM\CurrentControlSet\Services\" in Source: KMSAuto Net.exe "cmd.exe /c reg.exe DELETE HKLM\SYSTEM\CurrentControlSet\Services\" in Source: KMSAuto Net.exe "reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "KMS_Emulation" /t REG_DWORD /d 0" in Source: KMSAuto Net.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: KMSAuto Net.exe "HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" in Source: KMSAuto Net.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" in Source: KMSAuto Net.exe "SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" in Source: KMSAuto Net.exe "SYSTEM\CurrentControlSet\services" in Source: KMSAuto Net.exe "Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\." in Source: KMSAuto Net.exe "SAVE HKLM\SYSTEM "" in Source: KMSAuto Net.exe, "SAVE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" "" in Source: KMSAuto Net.exe "HKEY_LOCAL_MACHINE\SOFTWARE\Novell\NetWareWorkstation\CurrentVersion" in Source: KMSAuto Net.exe "HKEY_CLASSES_ROOT\." in Source: KMSAuto Net.exe "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: KMSAuto Net.exe "RESTORE HKLM\SYSTEM\WPA "WPA.HIV"" in Source: KMSAuto Net.exe "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: KMSAuto Net.exe "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: KMSAuto Net.exe "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\." in Source: KMSAuto Net.exe "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: KMSAuto Net.exe "HKEY_CLASSES_ROOT\" in Source: KMSAuto Net.exe "HKEY_CLASSES_ROOT\Applications\" in Source: KMSAuto Net.exe "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI" in Source: KMSAuto Net.exe "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\" in Source: KMSAuto Net.exe "RESTORE HKLM\SYSTEM "" in Source: KMSAuto Net.exe, "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" in Source: KMSAuto Net.exe, "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\" in Source: KMSAuto Net.exe, "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" in Source: KMSAuto Net.exe, "RESTORE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" "" in Source: KMSAuto Net.exe "HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla" in Source: KMSAuto Net.exe "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: KMSAuto Net.exe "SAVE HKLM\SYSTEM\WPA "" in Source: KMSAuto Net.exe, "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\" in Source: KMSAuto Net.exe, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\KMSAutoNet" in Source: 60001b5-Form1~CheckTask, "cmd.exe /c reg.exe DELETE HKLM\\SYSTEM\\CurrentControlSet\\Services\\" in Source: 60001bf-Form1~KmsDelAndDelFolder, "\\System32\\cmd.exe /c reg.exe DELETE HKLM\\SYSTEM\\CurrentControlSet\\Services\\" in Source: 60001bf-Form1~KmsDelAndDelFolder, "reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\SppExtComObj.Exe\" /f /v \"Debugger\" /t REG_SZ /d \"SppExtComObjPatcher.exe\"" in Source: 60001c0-Form1~InstallHook, "reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\SppExtComObj.Exe\" /f /v \"KMS_Emulation\" /t REG_DWORD /d 0" in Source: 60001c0-Form1~InstallHook, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options" in Source: 60001c1-Form1~UnInstallHook, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" in Source: 60001dc-Form1~CheckWindowsVersion, "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform" in Source: 6000338-cctor, "HKEY_USERS\\S-1-5-20\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform" in Source: 6000338-cctor, "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform" in Source: 6000338-cctor, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform" in Source: 6000339-WmIfunctions~SetGlobalKmsParameters, "SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform" in Source: 6000339-WmIfunctions~SetGlobalKmsParameters, "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001252.00000000.288816.03C80000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001252.00000000.288816.03C80000.00000004.mdmp, "Software\Microsoft\.NETFramework" in Source: 00000000-00001252.00000000.288816.03C80000.00000004.mdmp, "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00001252.00000000.288816.03C80000.00000004.mdmp31:T1128,"KMSAutoNet.exe" loaded module "KERNEL32" at base 75ea0000 "KMSAutoNet.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75370000 "KMSAutoNet.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75370000 "KMSAutoNet.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75370000 "KMSAutoNet.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75fe0000 "KMSAutoNet.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75370000 "KMSAutoNet.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75370000 "KMSAutoNet.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75370000 "KMSAutoNet.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 736e0000 "KMSAutoNet.exe" loaded module "ADVAPI32.DLL" at base 75800000 "KMSAutoNet.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 735d0000 "KMSAutoNet.exe" loaded module "SHLWAPI.DLL" at base 75f90000 "KMSAutoNet.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74590000 "KMSAutoNet.exe" loaded module "VERSION.DLL" at base 74da0000 "KMSAutoNet.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 75370000 "KMSAutoNet.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72e10000 "KMSAutoNet.exe" loaded module "USER32.DLL" at base 755f0000 "KMSAutoNet.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 75370000 "KMSAutoNet.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "KMSAutoNet.exe" loaded module "MSCOREE.DLL" at base 738e0000 "KMSAutoNet.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 75ad0000 "KMSAutoNet.exe" loaded module "PSAPI.DLL" at base 75e60000 "KMSAutoNet.exe" loaded module "RPCRT4.DLL" at base 75070000 "KMSAutoNet.exe" loaded module "KERNEL32.DLL" at base 75ea0000 "KMSAutoNet.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\8D55D7CAD944A3F21AEB1DB491F3D6DE\MSCORLIB.NI.DLL" at base 71920000 "KMSAutoNet.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "KMSAutoNet.exe" loaded module "OLE32.DLL" at base 75920000 "KMSAutoNet.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 745b0000 "KMSAutoNet.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "KMSAutoNet.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 75ad0000 "KMSAutoNet.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 718f0000 "KMSAutoNet.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76f50000 "KMSAutoNet.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "KMSAutoNet.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 75370000 "KMSAutoNet.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71840000 "KMSAutoNet.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\10E5A0803D11B8B826DBEB56A1F98239\SYSTEM.NI.DLL" at base 70e20000 "KMSAutoNet.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\53FCC36B6B7C9CC86E5D7484C1F93BD8\SYSTEM.CORE.NI.DLL" at base 70600000 "KMSAutoNet.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\E4E680611F69D26D704E61DD8BFA4ECE\SYSTEM.CONFIGURATION.NI.DLL" at base 704f0000 "KMSAutoNet.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\638BA173C955AB83F37EDBAB9B896F44\SYSTEM.XML.NI.DLL" at base 6fd80000 "KMSAutoNet.exe" loaded module "NTDLL.DLL" at base 770b0000 "KMSAutoNet.exe" loaded module "SHELL32.DLL" at base 76240000 "KMSAutoNet.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "KMSAutoNet.exe" loaded module "BCRYPT.DLL" at base 718c0000 "KMSAutoNet.exe" loaded module "IMM32.DLL" at base 75fe0000 "KMSAutoNet.exe" loaded module "COMCTL32.DLL" at base 6f520000 "KMSAutoNet.exe" loaded module "GDI32.DLL" at base 75e70000 "KMSAutoNet.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "KMSAutoNet.exe" loaded module "UXTHEME.DLL" at base 745b0000 "KMSAutoNet.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 75ea000032:T6be,"SELECT Name, Description, LicenseStatus FROM" (Source: KMSAuto Net.exe, Indicator: "select name, description, licensestatus from") "SELECT ID, Name, ApplicationId, PartialProductKey, Description, LicenseIsAddon FROM" (Source: KMSAuto Net.exe, Indicator: "select id, name, applicationid, partialproductkey, description, licenseisaddon from") "SELECT ID, ApplicationId, PartialProductKey, LicenseIsAddon, Description, Name, LicenseStatus FROM" (Source: KMSAuto Net.exe, Indicator: "select id, applicationid, partialproductkey, licenseisaddon, description, name, licensestatus from") "SELECT * FROM Win32_BIOs,SerialNumber" (Source: KMSAuto Net.exe, Indicator: "select * from win32_bios,serialnumber") "Select * FROM Win32_ComputerSystemProduct,UUID" (Source: KMSAuto Net.exe, Indicator: "select * from win32_computersystemproduct,uuid") "SELECT Name, Description FROM" (Source: 60002f5-OfficeConvert~CheckOfficeRetail, Indicator: "select name, description from") "SELECT Version FROM SoftwareLicensingService" (Source: 60002fb-OfficeConvert~WmiInstallLic, Indicator: "select version from softwarelicensingservice") "SELECT ID, ApplicationId, Name, Description, PartialProductKey, LicenseIsAddon, KeyManagementServiceMachine, KeyManagementServicePort, KeyManagementServiceProductKeyID, LicenseStatus, LicenseStatusReason, GracePeriodRemaining, VLActivationInterval, VLRenewalInterval FROM" (Source: 6000341-WmIfunctions~ProductProcess, Indicator: "select id, applicationid, name, description, partialproductkey, licenseisaddon, keymanagementservicemachine, keymanagementserviceport, keymanagementserviceproductkeyid, licensestatus, licensestatusreason, graceperiodremaining, vlactivationinterval, vlrenewalinterval from")33:T48c,"KMSAuto Net.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"34:Tb42,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00001252-00000C2B-2423363874] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00001252-00000C28-3516418101] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00001252-00000C28-3516538487] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001252-00000C28-3516605824] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\8d55d7cad944a3f21aeb1db491f3d6de\mscorlib.ni.dll" [Source: 00000000-00001252-00000C28-3516890322] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00001252-00000C28-3516951211] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00001252-00000C28-3517027237] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00001252-00000C28-3517393745] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00001252-00000C28-3517593525] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\10e5a0803d11b8b826dbeb56a1f98239\System.ni.dll" [Source: 00000000-00001252-00000C28-3517658629] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\53fcc36b6b7c9cc86e5d7484c1f93bd8\System.Core.ni.dll" [Source: 00000000-00001252-00000C28-3518082244] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\e4e680611f69d26d704e61dd8bfa4ece\System.Configuration.ni.dll" [Source: 00000000-00001252-00000C28-3518128652] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\638ba173c955ab83f37edbab9b896f44\System.Xml.ni.dll" [Source: 00000000-00001252-00000C28-3518174618] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00001252-00000C28-3518931248] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00001252-00000C28-3520743084] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001252-00000C28-3520870753] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001252-00000C28-3520909815] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00001252-00000C28-3520942782]35:T497,"KMSAutoNet.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "KMSAutoNet.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CCG"; Key: ""; Value: "") "KMSAutoNet.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "KMSAutoNet.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "KMSAutoNet.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KMSAUTONET.EXE"; Key: ""; Value: "") "KMSAutoNet.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "KMSAutoNet.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "KMSAutoNet.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "KMSAutoNet.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "KMSAutoNet.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "")36:T9eb,"KMSAutoNet.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "KMSAutoNet.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "KMSAutoNet.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "KMSAutoNet.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "KMSAutoNet.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "KMSAutoNet.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "KMSAutoNet.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "KMSAutoNet.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "KMSAutoNet.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "KMSAutoNet.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "KMSAutoNet.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "KMSAUTONET.EXE"; Value: "") "KMSAutoNet.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "KMSAutoNet.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "KMSAutoNet.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "KMSAutoNet.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "KMSAutoNet.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "KMSAutoNet.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "KMSAutoNet.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "KMSAutoNet.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "")37:T8fb,"KMSAutoNet.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "KMSAutoNet.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "KMSAutoNet.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "KMSAutoNet.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "KMSAutoNet.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "KMSAutoNet.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "KMSAutoNet.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "KMSAutoNet.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "KMSAutoNet.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "KMSAutoNet.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "KMSAutoNet.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "KMSAutoNet.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "KMSAutoNet.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "KMSAutoNet.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "KMSAutoNet.exe" trying to access non-existent file "C:\bcrypt.dll" "KMSAutoNet.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" "KMSAutoNet.exe" trying to access non-existent file "C:\profapi.dll" "KMSAutoNet.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" "KMSAutoNet.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" "KMSAutoNet.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" "KMSAutoNet.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll.DLL"38:T7df,"KMSAutoNet.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "KMSAutoNet.exe" trying to access non-existent file "C:\KMSAutoNet.exe.config" "KMSAutoNet.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "KMSAutoNet.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\KMSAuto Net" "KMSAutoNet.exe" trying to access non-existent file "C:\KMSAutoNet.INI" "KMSAutoNet.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#" "KMSAutoNet.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI" "KMSAutoNet.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms" "KMSAutoNet.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI" "KMSAutoNet.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing" "KMSAutoNet.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI" "KMSAutoNet.exe" trying to access non-existent file "C:\KMSAutoNet.exe.Local\" "KMSAutoNet.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Accessibility" "KMSAutoNet.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.INI" "KMSAutoNet.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runt73a1fc9d#" "KMSAutoNet.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.INI"39:T984,"KMSAutoNet.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00001252) "KMSAutoNet.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001252) "KMSAutoNet.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001252) "KMSAutoNet.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00001252) "KMSAutoNet.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00001252) "KMSAutoNet.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001252) "KMSAutoNet.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00001252) "KMSAutoNet.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\* (UID: 00000000-00001252) "KMSAutoNet.exe" called "FindNextFileW" with parameter 8d55d7cad944a3f21aeb1db491f3d6de (UID: 00000000-00001252) "KMSAutoNet.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\KMSAuto Net\* (UID: 00000000-00001252)3a:T188f,Found string "7zAES" (Indicator: "aes"; File: "KMSAuto Net.exe") Found string "somaes" (Indicator: "aes"; File: "screen_0.png") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001252.00000000.288816.01AB0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001252.00000000.288816.01AB0000.00000004.mdmp, 00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ecdsa"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "System.Security.Cryptography.MD5Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "System.Security.Cryptography.DpapiDataProtector, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp")3b:T5b9,Found string "Data Error in encrypted file. Wrong password?" (Indicator: "password"; File: "KMSAuto Net.exe") Found string "CRC Failed in encrypted file. Wrong password?" (Indicator: "password"; File: "KMSAuto Net.exe") Found string "Can not open encrypted archive. Wrong password?" (Indicator: "password"; File: "KMSAuto Net.exe") Found string "Enter password (will not be echoed):" (Indicator: "password"; File: "KMSAuto Net.exe") Found string "\\system32\\control.exe userpasswords2" (Indicator: "password"; File: "KMSAuto Net.exe") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00001252.00000000.288816.01AB0000.00000004.mdmp, 00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00001252.00000000.288816.01AB0000.00000004.mdmp, 00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00001252.00000000.288816.03C80000.00000004.mdmp")3c:T96f,Found string "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName="ptun0901" get Manufacturer >"" (Indicator: " Win32_NetworkAdapte"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName="ptun0901" get Manufacturer >"" (Indicator: " Win32_NetworkAdapter"; File: "KMSAuto Net.exe") Found string "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName="ptun0901" get InterfaceIndex >"" (Indicator: " Win32_NetworkAdapte"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName="ptun0901" get InterfaceIndex >"" (Indicator: " Win32_NetworkAdapter"; File: "KMSAuto Net.exe") Found string "SELECT * FROM Win32_BIOs,SerialNumber" (Indicator: " Win32_BIOS"; File: "KMSAuto Net.exe") Found string "Select * FROM Win32_ComputerSystemProduct,UUID" (Indicator: " Win32_ComputerSystem"; File: "KMSAuto Net.exe") Found string "Select * FROM Win32_ComputerSystemProduct,UUID" (Indicator: " Win32_ComputerSystemProduct"; File: "KMSAuto Net.exe") Found string "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName=\"ptun0901\" get Manufacturer >\"" (Indicator: " Win32_NetworkAdapte"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName=\"ptun0901\" get Manufacturer >\"" (Indicator: " Win32_NetworkAdapter"; File: "KMSAuto Net.exe") Found string "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName=\"tapoas\" get Manufacturer >\"" (Indicator: " Win32_NetworkAdapte"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName=\"tapoas\" get Manufacturer >\"" (Indicator: " Win32_NetworkAdapter"; File: "KMSAuto Net.exe") Found string "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName=\"ptun0901\" get InterfaceIndex >\"" (Indicator: " Win32_NetworkAdapte"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName=\"ptun0901\" get InterfaceIndex >\"" (Indicator: " Win32_NetworkAdapter"; File: "KMSAuto Net.exe") Found string "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName=\"tapoas\" get InterfaceIndex >\"" (Indicator: " Win32_NetworkAdapte"; File: "KMSAuto Net.exe"), Found string "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName=\"tapoas\" get InterfaceIndex >\"" (Indicator: " Win32_NetworkAdapter"; File: "KMSAuto Net.exe")3d:T6c8,Found string "\bin\driver\oas_sert.cer" (Indicator: "\driver\"; File: "KMSAuto Net.exe") Found string "\bin\driver\tap0901.cer" (Indicator: "\driver\"; File: "KMSAuto Net.exe") Found string "\bin\driver\x64WDV\FakeClient.exe" (Indicator: "\driver\"; File: "KMSAuto Net.exe") Found string "\bin\driver\x86WDV\FakeClient.exe" (Indicator: "\driver\"; File: "KMSAuto Net.exe") Found string "\\bin\\driver\\oas_sert.cer" (Indicator: "\driver\"; File: "KMSAuto Net.exe") Found string "\\bin\\driver\\tap0901.cer" (Indicator: "\driver\"; File: "KMSAuto Net.exe") Found string "\\bin\\driver\\x64WDV\\FakeClient.exe" (Indicator: "\driver\"; File: "KMSAuto Net.exe") Found string "\\bin\\driver\\x86WDV\\FakeClient.exe" (Indicator: "\driver\"; File: "KMSAuto Net.exe") Found string "\\bin\\driver\\x64\\InstallUtil.InstallLog" (Indicator: "\driver\"; File: "KMSAuto Net.exe") Found string "\\bin\\driver\\x86\\InstallUtil.InstallLog" (Indicator: "\driver\"; File: "KMSAuto Net.exe") Found string "\\bin\\driver\\" (Indicator: "\driver\"; File: "KMSAuto Net.exe") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001252.00000000.288816.01A40000.00000004.mdmp, 00000000-00001252.00000000.288816.01AB0000.00000004.mdmp, 00000000-00001252.00000000.288816.03A30000.00000004.mdmp, 00000000-00001252.00000000.288816.061E0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001252.00000000.288816.01A40000.00000004.mdmp, 00000000-00001252.00000000.288816.01AB0000.00000004.mdmp, 00000000-00001252.00000000.288816.03A30000.00000004.mdmp, 00000000-00001252.00000000.288816.061E0000.00000004.mdmp")3e:T483,"cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName="ptun0901" get Manufacturer >"" (Indicator: " win32_networkadapter"; File: "KMSAuto Net.exe"), "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName="ptun0901" get InterfaceIndex >"" (Indicator: " win32_networkadapter"; File: "KMSAuto Net.exe") "SELECT * FROM Win32_BIOs,SerialNumber" (Indicator: " win32_bios"; File: "KMSAuto Net.exe") "Select * FROM Win32_ComputerSystemProduct,UUID" (Indicator: " win32_computersystem"; File: "KMSAuto Net.exe") "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName=\"ptun0901\" get Manufacturer >\"" (Indicator: " win32_networkadapter"; File: "KMSAuto Net.exe"), "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName=\"tapoas\" get Manufacturer >\"" (Indicator: " win32_networkadapter"; File: "KMSAuto Net.exe") "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName=\"ptun0901\" get InterfaceIndex >\"" (Indicator: " win32_networkadapter"; File: "KMSAuto Net.exe"), "cmd.exe /c WMIC Path Win32_NetworkAdapter WHERE ServiceName=\"tapoas\" get InterfaceIndex >\"" (Indicator: " win32_networkadapter"; File: "KMSAuto Net.exe")3f:T631,System.Diagnostics.Process::GetProcessesByName(System.String) at 6ee7f3ecd5111cd5306792fd3141515d-6000238-Form1~Button9_Click System.Diagnostics.Process::GetProcessesByName(System.String) at 6ee7f3ecd5111cd5306792fd3141515d-60001e6-Form1~ActivationRestoreWin81 System.Diagnostics.Process::GetProcessesByName(System.String) at 6ee7f3ecd5111cd5306792fd3141515d-60001e4-Form1~ActivationBackupWin7 System.Diagnostics.Process::GetProcessesByName(System.String) at 6ee7f3ecd5111cd5306792fd3141515d-60001c0-Form1~InstallHook System.Diagnostics.Process::GetProcessesByName(System.String) at 6ee7f3ecd5111cd5306792fd3141515d-60001de-Form1~ActivationBackupWin81 System.Diagnostics.Process::GetProcessesByName(System.String) at 6ee7f3ecd5111cd5306792fd3141515d-60001cb-Form1~InstallDivert System.Diagnostics.Process::GetProcessesByName(System.String) at 6ee7f3ecd5111cd5306792fd3141515d-600025a-Form1~ButtonValidator_Click System.Diagnostics.Process::GetProcessesByName(System.String) at 6ee7f3ecd5111cd5306792fd3141515d-60001e5-Form1~ActivationBackupWin8 System.Diagnostics.Process::GetProcessesByName(System.String) at 6ee7f3ecd5111cd5306792fd3141515d-60001e8-Form1~ActivationRestoreWin7 System.Diagnostics.Process::GetProcessesByName(System.String) at 6ee7f3ecd5111cd5306792fd3141515d-60001e1-Form1~ActivationRestoreWin8 System.Diagnostics.Process::GetProcessesByName(System.String) at 6ee7f3ecd5111cd5306792fd3141515d-60001e7-Form1~ActivationRestoreWin8_81 System.Diagnostics.Process::GetProcessesByName(System.String) at 6ee7f3ecd5111cd5306792fd3141515d-60001c2-Form1~InstallHook240:T8cb,KMSAuto Net.exe has PE file in resource with name: "project16" and filetype: "PE32 executable (console) Intel 80386, for MS Windows" KMSAuto Net.exe has PE file in resource with name: "SppP_x86" and filetype: "PE32 executable (console) Intel 80386, for MS Windows" KMSAuto Net.exe has PE file in resource with name: "Inj_dx64" and filetype: "PE32 executable (console) Intel 80386, for MS Windows" KMSAuto Net.exe has PE file in resource with name: "proplus16" and filetype: "PE32 executable (console) Intel 80386, for MS Windows" KMSAuto Net.exe has PE file in resource with name: "hidecontrol" and filetype: "PE32 executable (console) Intel 80386, for MS Windows" KMSAuto Net.exe has PE file in resource with name: "pdkutils" and filetype: "PE32 executable (console) Intel 80386, for MS Windows" KMSAuto Net.exe has PE file in resource with name: "Inj_dx86" and filetype: "PE32 executable (console) Intel 80386, for MS Windows" KMSAuto Net.exe has PE file in resource with name: "bin_x86" and filetype: "PE32 executable (console) Intel 80386, for MS Windows" KMSAuto Net.exe has PE file in resource with name: "visio" and filetype: "PE32 executable (console) Intel 80386, for MS Windows" KMSAuto Net.exe has PE file in resource with name: "SppP_x64" and filetype: "PE32 executable (console) Intel 80386, for MS Windows" KMSAuto Net.exe has PE file in resource with name: "bin_x64" and filetype: "PE32 executable (console) Intel 80386, for MS Windows" KMSAuto Net.exe has PE file in resource with name: "bin" and filetype: "PE32 executable (console) Intel 80386, for MS Windows" KMSAuto Net.exe has PE file in resource with name: "MSActBackup" and filetype: "PE32 executable (GUI) Intel 80386, for MS Windows" KMSAuto Net.exe has PE file in resource with name: "kmsclient" and filetype: "PE32 executable (console) Intel 80386, for MS Windows" KMSAuto Net.exe has PE file in resource with name: "proplus" and filetype: "PE32 executable (console) Intel 80386, for MS Windows" KMSAuto Net.exe has PE file in resource with name: "visio16" and filetype: "PE32 executable (console) Intel 80386, for MS Windows" KMSAuto Net.exe has PE file in resource with name: "project" and filetype: "PE32 executable (console) Intel 80386, for MS Windows"41:Tc9a,Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/2ede52d6-74bd-40eb-b21f-1ca1f45b77a8/sample.bin at offset 68 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/2ede52d6-74bd-40eb-b21f-1ca1f45b77a8/sample.bin at offset 860286 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/2ede52d6-74bd-40eb-b21f-1ca1f45b77a8/sample.bin at offset 1191759 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/2ede52d6-74bd-40eb-b21f-1ca1f45b77a8/sample.bin at offset 1536681 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/2ede52d6-74bd-40eb-b21f-1ca1f45b77a8/sample.bin at offset 1817404 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/2ede52d6-74bd-40eb-b21f-1ca1f45b77a8/sample.bin at offset 1912715 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/2ede52d6-74bd-40eb-b21f-1ca1f45b77a8/sample.bin at offset 2023444 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/2ede52d6-74bd-40eb-b21f-1ca1f45b77a8/sample.bin at offset 2182035 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/2ede52d6-74bd-40eb-b21f-1ca1f45b77a8/sample.bin at offset 2278370 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/2ede52d6-74bd-40eb-b21f-1ca1f45b77a8/sample.bin at offset 2373967 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/2ede52d6-74bd-40eb-b21f-1ca1f45b77a8/sample.bin at offset 2539467 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/2ede52d6-74bd-40eb-b21f-1ca1f45b77a8/sample.bin at offset 2697238 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/2ede52d6-74bd-40eb-b21f-1ca1f45b77a8/sample.bin at offset 2851161 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/2ede52d6-74bd-40eb-b21f-1ca1f45b77a8/sample.bin at offset 3146114 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/2ede52d6-74bd-40eb-b21f-1ca1f45b77a8/sample.bin at offset 3258250 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/2ede52d6-74bd-40eb-b21f-1ca1f45b77a8/sample.bin at offset 3369808 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/2ede52d6-74bd-40eb-b21f-1ca1f45b77a8/sample.bin at offset 3484994 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/2ede52d6-74bd-40eb-b21f-1ca1f45b77a8/sample.bin at offset 3602370 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/2ede52d6-74bd-40eb-b21f-1ca1f45b77a8/sample.bin at offset 3717812 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/2ede52d6-74bd-40eb-b21f-1ca1f45b77a8/sample.bin at offset 3958242 Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/2ede52d6-74bd-40eb-b21f-1ca1f45b77a8/sample.bin at offset 407351042:T760,"KMSAutoNet.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000098bc210040f84700145c5f77435c5f770cf947000100000094011f0001000000c0f74700935c607740836777d4a05f7745f02f770cf94700010000000100000018bf21000000000090f74700c0f747002cf8470095e15b777d033700feffffffd4a05f771bbe56750000347600000000 (UID: 00000000-00003944) "KMSAutoNet.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077363450726f636573732c6b65726e656c33322e646c6c2c223235323a30323a33352e373936222c52583d302c50583d30003000653d6e65757472616c2c205075626c69634b6579546f6b656e3d623033663566376631316435306133612220616c6c6f77446566696e6974696f6e3d22 (UID: 00000000-00003944) "KMSAutoNet.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310030f5f65f7741e47077f42e8e6418d12100a0358e6411e47077ece3180010bc2100b2f45f7721e47077fce3180000008764000087640000000058e31800f0000000f00087640000000068e3180053000000fce418000000000001000000cce3180040f55f770000000000000000b8e31800 (UID: 00000000-00003944) "KMSAutoNet.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c47ea73f03829008c47ea7300000000f0382900aca71800086d5f77188167770000000060a8180000000000de549768eca7180095e15b7745163700feffffff6b2c607731195775021000000000000000000100c0a71800c89f5f778c47ea730000000000000000 (UID: 00000000-00003944) "KMSAutoNet.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003944)43:T458,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003944.00000000.65379.0164E000.00000002.mdmp") Found URL "http://forum.ru-board.comcalrpca0crre9negotiatenegoextenderkerberosntlmschanneltsssppku2upath=\users\hapubwslocalappdata=c:\users\hapubws\appdata\locallogonserver=\\hapubws-pcnumber_of_processors=2os=windows_ntpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscprocessor_architecture:\windows\system;c:\windows;.;c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\local\programs\python\python38-ts\;c:\users\hap" - Source: "00000000-00003944.00000001.67298.001F0000.00000004.mdmp") Found URL "http://forum.ru-board.comcalrpca0crre9negotiatenegoextenderkerberosntlmschanneltsssppku2upath=\users\hapubwslocalappdata=c:\users\hapubws\appdata\locallogonserver=\\hapubws-pcnumber_of_processors=2os=windows_ntpathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscprocessor_architecture" - Source: "00000000-00003944.00000002.69219.001F0000.00000004.mdmp")44:T75f,"cmd.exe" marked "C:\test.test" for deletion "cmd.exe" marked "C:\ProgramData\KMSAutoS\bin\driver\oas_sert.cer" for deletion "cmd.exe" marked "C:\ProgramData\KMSAutoS\bin\driver\tap0901.cer" for deletion "cmd.exe" marked "C:\ProgramData\KMSAutoS\bin\driver\x86TAP1\devcon.exe" for deletion "cmd.exe" marked "C:\ProgramData\KMSAutoS\bin\driver\x86TAP1\OemVista.inf" for deletion "cmd.exe" marked "C:\ProgramData\KMSAutoS\bin\driver\x86TAP1\ptun0901.cat" for deletion "cmd.exe" marked "C:\ProgramData\KMSAutoS\bin\driver\x86TAP1\ptun0901.sys" for deletion "cmd.exe" marked "C:\ProgramData\KMSAutoS\bin\driver\x86TAP2\devcon.exe" for deletion "cmd.exe" marked "C:\ProgramData\KMSAutoS\bin\driver\x86TAP2\oas_sert.cer" for deletion "cmd.exe" marked "C:\ProgramData\KMSAutoS\bin\driver\x86TAP2\tapoas.cat" for deletion "cmd.exe" marked "C:\ProgramData\KMSAutoS\bin\driver\x86TAP2\tapoas.inf" for deletion "cmd.exe" marked "C:\ProgramData\KMSAutoS\bin\driver\x86TAP2\tapoas.sys" for deletion "cmd.exe" marked "C:\ProgramData\KMSAutoS\bin\driver\x86WDV\FakeClient.exe" for deletion "cmd.exe" marked "C:\ProgramData\KMSAutoS\bin\driver\x86WDV\WdfCoInstaller01009.dll" for deletion "cmd.exe" marked "C:\ProgramData\KMSAutoS\bin\driver\x86WDV\WinDivert.dll" for deletion "cmd.exe" marked "C:\ProgramData\KMSAutoS\bin\driver\x86WDV\WinDivert.inf" for deletion "cmd.exe" marked "C:\ProgramData\KMSAutoS\bin\driver\x86WDV\WinDivert.sys" for deletion "cmd.exe" marked "C:\ProgramData\KMSAutoS\bin\KMSSS.exe" for deletion "cmd.exe" marked "C:\ProgramData\KMSAutoS\bin\KMSSS.log" for deletion "cmd.exe" marked "C:\ProgramData\KMSAutoS\bin\TunMirror.exe" for deletion "cmd.exe" marked "C:\ProgramData\KMSAutoS\bin\TunMirror2.exe" for deletion "cmd.exe" marked "C:\ProgramData\KMSAutoS\KMSAuto Net.exe" for deletion "cmd.exe" marked "C:\ProgramData\KMSAutoS\kmsauto.ini" for deletion45:T7e9,"cmd.exe" opened "C:\test.test" with delete access "cmd.exe" opened "C:\ProgramData\KMSAutoS\bin\driver\oas_sert.cer" with delete access "cmd.exe" opened "C:\ProgramData\KMSAutoS\bin\driver\tap0901.cer" with delete access "cmd.exe" opened "C:\ProgramData\KMSAutoS\bin\driver\x86TAP1\devcon.exe" with delete access "cmd.exe" opened "C:\ProgramData\KMSAutoS\bin\driver\x86TAP1\OemVista.inf" with delete access "cmd.exe" opened "C:\ProgramData\KMSAutoS\bin\driver\x86TAP1\ptun0901.cat" with delete access "cmd.exe" opened "C:\ProgramData\KMSAutoS\bin\driver\x86TAP1\ptun0901.sys" with delete access "cmd.exe" opened "C:\ProgramData\KMSAutoS\bin\driver\x86TAP2\devcon.exe" with delete access "cmd.exe" opened "C:\ProgramData\KMSAutoS\bin\driver\x86TAP2\oas_sert.cer" with delete access "cmd.exe" opened "C:\ProgramData\KMSAutoS\bin\driver\x86TAP2\tapoas.cat" with delete access "cmd.exe" opened "C:\ProgramData\KMSAutoS\bin\driver\x86TAP2\tapoas.inf" with delete access "cmd.exe" opened "C:\ProgramData\KMSAutoS\bin\driver\x86TAP2\tapoas.sys" with delete access "cmd.exe" opened "C:\ProgramData\KMSAutoS\bin\driver\x86WDV\FakeClient.exe" with delete access "cmd.exe" opened "C:\ProgramData\KMSAutoS\bin\driver\x86WDV\WdfCoInstaller01009.dll" with delete access "cmd.exe" opened "C:\ProgramData\KMSAutoS\bin\driver\x86WDV\WinDivert.dll" with delete access "cmd.exe" opened "C:\ProgramData\KMSAutoS\bin\driver\x86WDV\WinDivert.inf" with delete access "cmd.exe" opened "C:\ProgramData\KMSAutoS\bin\driver\x86WDV\WinDivert.sys" with delete access "cmd.exe" opened "C:\ProgramData\KMSAutoS\bin\KMSSS.exe" with delete access "cmd.exe" opened "C:\ProgramData\KMSAutoS\bin\KMSSS.log" with delete access "cmd.exe" opened "C:\ProgramData\KMSAutoS\bin\TunMirror.exe" with delete access "cmd.exe" opened "C:\ProgramData\KMSAutoS\bin\TunMirror2.exe" with delete access "cmd.exe" opened "C:\ProgramData\KMSAutoS\KMSAuto Net.exe" with delete access "cmd.exe" opened "C:\ProgramData\KMSAutoS\kmsauto.ini" with delete access46:T54b,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007836.00000000.67190.03940000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007836.00000000.67190.03940000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007836.00000000.67190.03940000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007836.00000000.67190.03940000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007836.00000000.67190.03940000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007836.00000000.67190.03940000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007836.00000000.67190.03940000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007836.00000000.67190.03940000.00000004.mdmp")47:Tba2,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; Source: "00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; Source: "00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp")48:Td56,Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: DISMHOST.EXE.65E2A83C.bin] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: DISMHOST.EXE.65E2A83C.bin] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: DISMHOST.EXE.65E2A83C.bin] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: DISMHOST.EXE.65E2A83C.bin] Observed import api "GetSecurityDescriptorControl" which can "Retrieves a security descriptor control and revision information" [Source: DISMHOST.EXE.65E2A83C.bin] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: DISMHOST.EXE.65E2A83C.bin] Observed import api "GetSecurityDescriptorGroup" which can "Retrieves the primary group information from a security descriptor" [Source: DISMHOST.EXE.65E2A83C.bin] Observed import api "GetSecurityDescriptorOwner" which can "Retrieves the owner information from a security descriptor" [Source: DISMHOST.EXE.65E2A83C.bin] Observed import api "GetSecurityDescriptorSacl" which can "Retrieves a pointer to the system access control list (SACL) in a specified security descriptor" [Source: DISMHOST.EXE.65E2A83C.bin] Observed import api "GetSidLengthRequired" which can "Returns the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: DISMHOST.EXE.65E2A83C.bin] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: DISMHOST.EXE.65E2A83C.bin] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: DISMHOST.EXE.65E2A83C.bin] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: DISMHOST.EXE.65E2A83C.bin] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: DISMHOST.EXE.65E2A83C.bin] Observed import api "IsValidSecurityDescriptor" which can "Determines whether the components of a security descriptor are valid" [Source: DISMHOST.EXE.65E2A83C.bin] Observed import api "IsValidSid" which can "Validates a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: DISMHOST.EXE.65E2A83C.bin] Observed import api "MakeAbsoluteSD" which can "Creates a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: DISMHOST.EXE.65E2A83C.bin] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: DISMHOST.EXE.65E2A83C.bin] Observed import api "SetSecurityDescriptorGroup" which can "Sets the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: DISMHOST.EXE.65E2A83C.bin] Observed import api "SetSecurityDescriptorOwner" which can "Sets the owner information of an absolute-format security descriptor" [Source: DISMHOST.EXE.65E2A83C.bin]49:T788,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAU6SURBVFhHrZcJUJRlGMd3gTHFQEBtogMNQcWD0ws5hZBGRBAI8UxRFAiPVcADswIElZIcxcKdzBqbQdGcaZC8jdQCRfAgFY8RHZNMRxEVE2R/vR8OtsCegzvzzOx+33v8nv/zPO/zrmzpZBntTWbAJyVGRmo7M2BaxyGaAKRnuhZLmOLKp7E9yEmyJTPOmuRJJiiiTHXO0bqeMQDJCyLZuC6RmnM7Ud07jurv/XBtKw8PzKZghTMjBlrhZPe6cSCGAnySHEX570qan1ykoXwjpzYEU5jkwJ54Jy5tiOVxSQ61BePxc+6J/ZvdDIfQBqAehqTYQEr2ZvDs9iFK0r2IC3qN6WNlJIQJmyBjdrCcb8KtuVuYSu0PQfSz7Y5VdzPDIAwB+Dw5nOY7u/k11QuPfiYsiuqYgCGjZKz070ld4Vy+TXTCstsrAgj2deLAjwuo27eMsQ7mRPq+2Lw9eKJQom8vU86t9uGeMgBriy6dV2D+RBle7nbcP53Orc3j6WEuY0n0/95LEK2luCDShOH9u5E3/V0ebPmA0QOsMTWR64fQFYKFkQLA9Q2eVq7iSo43SdPcUWZ6o1wTiDI7gJzlASgz/FB+5smahW7MChtI4fJB3M0dRdAQG+Qy3eXcUpq6ACRvvV0sqD28kPtb3+fJ3hhUD0Tp/Vsh7Aw8KoO6crh7FNWN73l++mPqi/y5t3Yow+wtJe87p4Akb5iPOQUZ43i8J4qGn3xpPBwqNoql+Xw8qqp4mivE9z8TeH52Ko0nI3hSNIbbOQMx72pG5mKfzgFI6sybYMYEH3se7oik6beJqM5OQnVxClRPhUvCzovfpyPFs9k0V82gYbsH+zM9uHEsAdXVVHFQLe1gbU5FTX1A/ZniQxm+zl3YuXIkDQdnoaqOgxrJZomFPwIJpkIAHA+lbrsPVVmDKcqPoLE6RePmrUAvIfQBSO8XRcmFmfDLej+azqahur4EbsbD9ZlCiWlQGcXlXC/+WOHGji9DqD+n0Oq9uiIak1BTYraWmlQVK+fYc+2IUODKXGFz4MLkFoDtq3w5sC2aR+cVPL+c0gLQ6qWmMEjPtAJoqw4JJCbQjKK8EBrLo0USzqSxLJzb+8axMW04jZeSaVbbuH0H1JgP2u4C2spzRnB3itePoWyVHfUnZnIqcxDzxluxLWNwi9fqnncKQJsK0QE9KN4QSHmWC/XHpnJrkzspMTYUrB3SknSqqy+yXlP/N0oBbQCh3j0p3hREZe5o6g9F8NfXI9oAtN9E7y1J13VMUxj8XHtRnOvPma+8hQLR1OaP1AnQoezaE+m7D6q/l+Z6DBAKZI2icu0w6o9GcCffgxljrUlPfI+nFxQ6a19baPSqpD7A3VEAZI6gYrU79XvH8c8WN0Y7WWHbu2tL3LWVnNGh0Ubl3l8AZHtSuWYkjwRAaZYrluamyOVtG48hIEZ53jrYrX8vitZ5UyEBHAyjJt+PPraW2NlaGJz5HU5DY0gkgJ+/8KE8w4O6I+HcyRtGfLgjuzaFi/M/WWv303kaGgPg6mjDHuF9aZoTD46Hs3uJM6W7p9N85UXn07dWp3PBtZ8VOxWDOKFw4P7JUEqz/akpadt6dUF0GsDFQQCkDaUsdQi1hZ5cXGTLkc0hNIkGpK/m9d4N9MknvXd42wLlMhdOpTlzM8+Vqvl92ZUdSJOe/v/KckCC6G1tzuJgO2q/c0fhaYPv8Hd4JjqhIaXXqQpoVcjMVI6F+OMxJ+CtlounYx8rqg/FGXQJ0RcmQ6LwcoyJOHwkU59kiArq4/8DWw0vgxwLQtIAAAAASUVORK5CYII=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"69a8ae6352cffd366409df8e566e84315b4bffcf5865a4b8079c446123ba1d26","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790266572846,"unified_at":"2026-09-24T16:16:12.846Z","metadata":{"hashes":{"sha256":"69a8ae6352cffd366409df8e566e84315b4bffcf5865a4b8079c446123ba1d26","sha1":"45c92d0e691175a39a8c61228f526f80a7ca94fc","md5":"6ee7f3ecd5111cd5306792fd3141515d","sha512":"1dc9b725115bc703373f5e4759f4081012538366e9fa2a497a06182908a1715659c876c3a471b176ce81e74181965750b7376d2a8492500c403231241522e16c","ssdeep":"196608:0eywBGqyw1lT3ywuywQyw1ywlywaywTyw9lywfywEyw1ywHywwywmIBywyywsywv:IwBGnw1l+wjwNw4wIw3w2w9IwqwJw4w4","ssdeep_chunks":["196608:0eywBGq","196608:eywBGqy","196608:ywBGqyw","196608:wBGqyw1","196608:BGqyw1l","196608:Gqyw1lT","196608:qyw1lT3","196608:yw1lT3y","196608:w1lT3yw","196608:1lT3ywu","196608:lT3ywuy","196608:T3ywuyw","196608:3ywuywQ","196608:ywuywQy","196608:wuywQyw","196608:uywQyw1","196608:ywQyw1y","196608:wQyw1yw","196608:Qyw1ywl","196608:yw1ywly","196608:w1ywlyw","196608:1ywlywa","196608:ywlyway","196608:wlywayw","196608:lywaywT","196608:ywaywTy","196608:waywTyw","196608:aywTyw9","196608:ywTyw9l","196608:wTyw9ly","196608:Tyw9lyw","196608:yw9lywf","196608:w9lywfy","196608:9lywfyw","196608:lywfywE","196608:ywfywEy","196608:wfywEyw","196608:fywEyw1","196608:ywEyw1y","196608:wEyw1yw","196608:Eyw1ywH","196608:yw1ywHy","196608:w1ywHyw","196608:1ywHyww","196608:ywHywwy","196608:wHywwyw","196608:Hywwywm","196608:ywwywmI","196608:wwywmIB","196608:wywmIBy","196608:ywmIByw","196608:wmIBywy","196608:mIBywyy","196608:IBywyyw","196608:Bywyyws","196608:ywyywsy","196608:wyywsyw","196608:yywsywv","393216:0eywBGq","393216:eywBGqy","393216:ywBGqyw","393216:wBGqyw1","393216:BGqyw1l","393216:Gqyw1lT","393216:qyw1lT3","393216:yw1lT3y","393216:w1lT3yw","393216:1lT3ywu","393216:lT3ywuy","393216:T3ywuyw","393216:3ywuywQ","393216:ywuywQy","393216:wuywQyw","393216:uywQyw1","393216:ywQyw1y","393216:wQyw1yw","393216:Qyw1ywl","393216:yw1ywly","393216:w1ywlyw","393216:1ywlywa","393216:ywlyway","393216:wlywayw","393216:lywaywT","393216:ywaywTy","393216:waywTyw","393216:aywTyw9","393216:ywTyw9l","393216:wTyw9ly","393216:Tyw9lyw","393216:yw9lywf","393216:w9lywfy","393216:9lywfyw","393216:lywfywE","393216:ywfywEy","393216:wfywEyw","393216:fywEyw1","393216:ywEyw1y","393216:wEyw1yw","393216:Eyw1ywH","393216:yw1ywHy","393216:w1ywHyw","393216:1ywHyww","393216:ywHywwy","393216:wHywwyw","393216:Hywwywm","393216:ywwywmI","393216:wwywmIB","393216:wywmIBy","393216:ywmIByw","393216:wmIBywy","393216:mIBywyy","393216:IBywyyw","393216:Bywyyws","393216:ywyywsy","393216:wyywsyw","393216:yywsywv","196608:IwBGnw1","196608:wBGnw1l","196608:BGnw1l+","196608:Gnw1l+w","196608:nw1l+wj","196608:w1l+wjw","196608:1l+wjwN","196608:l+wjwNw","196608:+wjwNw4","196608:wjwNw4w","196608:jwNw4wI","196608:wNw4wIw","196608:Nw4wIw3","196608:w4wIw3w","196608:4wIw3w2","196608:wIw3w2w","196608:Iw3w2w9","196608:w3w2w9I","196608:3w2w9Iw","196608:w2w9Iwq","196608:2w9Iwqw","196608:w9IwqwJ","196608:9IwqwJw","196608:IwqwJw4","196608:wqwJw4w","196608:qwJw4w4"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"KMSAuto Net 2015 v1.3.8 Portable.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":6977272,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499293238000,"last_seen":1779243035000,"last_multi_scan":1779243035000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["agent","autokms","evasive","bancteian","cassini_43febc0c","e5","hackkms"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":87},"sandbox_signatures":{"informative_count":192,"suspicious_count":29,"malicious_count":10,"total":231},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"HackTool/Win32.KMSAuto","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"HackTool/Win32.KMSAuto","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"APPL/AgentW32.ToolX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Application.Hacktool.KMSAuto.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"HackTool_Win32_AutoKMS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/grayware_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/HackKMS.I potentially unsafe application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Hacktool.KMSAuto.om.gcza","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Hack.Win32.KMS.vl!c","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Unwanted-Program ( 004fa0b21 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"HackTool.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"Malicious","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"App/KMSActiv-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"GenericRXGD-FP!6EE7F3ECD511","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.GML.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"ApplicUnsaf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"HackTool/KMSAuto","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute application (Dotnet)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Executes echo command"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to control system service controller"},{"type":"informative","value":"Contains ability to execute windows services"},{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"malicious","value":"Found an indicator for a scheduled task trigger"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to add users to a group (API string)"},{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","identifiers":[{"type":"informative","value":"References PATH environment registry keys"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"informative","value":"Reference explorer.exe process"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Marks file for deletion"},{"type":"informative","value":"Opens file with deletion access rights"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"informative","value":"Contains ability to delete files"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"suspicious","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"suspicious","value":"Sample/File contains another embedded binary"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Contains pe file in dotnet resource"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Defense Evasion","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify System Firewall","attack_id":"T1562.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/004","identifiers":[{"type":"suspicious","value":"Able to modify firewall settings"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"},{"type":"informative","value":"Contains the ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"malicious","value":"The input sample is signed with an invalid certificate"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"},{"type":"suspicious","value":"Sample/File contains another embedded binary"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability execute applications in hidden mode (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Able to delete scheduled task(s)"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"malicious","value":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Credential Access","technique":"Unsecured Credentials","attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve windows environment variables"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"References to WMI query strings used to retrieve network adapter information"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"suspicious","value":"Found system commands related strings"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Dotnet code contains ability to query registry"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Discovery","technique":"Permission Groups Discovery","attack_id":"T1069","attack_id_wiki":"https://attack.mitre.org/techniques/T1069","identifiers":[{"type":"informative","value":"Contains ability to enumerate user groups or their members (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to copy files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"malicious","value":"Making HTTPS connections using insecure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to stop windows services"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Impact","technique":"Account Access Removal","attack_id":"T1531","attack_id_wiki":"https://attack.mitre.org/techniques/T1531","identifiers":[{"type":"informative","value":"Contains ability to delete users from a group (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\MidiMapper_modLongMessage_RefCnt\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"},{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll\" at 69D10000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"},{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /c md \"%LOCALAPPDATA%\\MSfree Inc\"\" on 2016-2-10.03:11:30.606\n \"cmd /c echo test>>\"C:\\\\test.test\"\" on 2016-2-10.03:11:31.419\n \"/c del /F /Q \"test.test\"\" on 2016-2-10.03:11:31.497\n \"/c del /F /Q \"kmsauto.ini\"\" on 2016-2-10.03:14:17.379","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"cmd /c md \"%LOCALAPPDATA%\\MSfree Inc\"\" (UID: 00012556-00003856)\n Spawned process \"cmd.exe\" with commandline \"cmd /c echo test>>\"C:\\\\test.test\"\" (UID: 00012607-00003028)\n Spawned process \"cmd.exe\" with commandline \"/c del /F /Q \"test.test\"\" (UID: 00012613-00003736)\n Spawned process \"cmd.exe\" with commandline \"/c del /F /Q \"kmsauto.ini\"\" (UID: 00023229-00001916)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"},{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"kmsauto.ini.788979986\" has type \"UTF-8 Unicode (with BOM) text, with CRLF line terminators\"\n \"test.test.3638224476\" has type \"ASCII text, with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"KMSAuto_Net.My\"\n Heuristic match: \"rum.ru-board.com\"\n Pattern match: \"http://forum.ru-board.com\"\n Pattern match: \"http://goo.gl/eD7s9X\"\n Pattern match: \"http://www.microsoft.com/genuine/validate/\"\n Pattern match: \"osoft.com/genuine/validate/\"\n Pattern match: \"outube.com/watch?v=niXf0ov0S8I\"\n Pattern match: \"habrahabr.ru/post/192986/\"\n Heuristic match: \"p://forum.ru-board.com\"\n Heuristic match: \"DiagPackage.cat\"\n Heuristic match: \"en-us\\en-us.cat\"\n Heuristic match: \"fr-fr\\fr-FR.cat\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"},{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.09187990459","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"},{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%LOCALAPPDATA%\\MSfree Inc\\kmsauto.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"$25","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"10.3.0.20\"\n \"27.0.0.2\"\n \"255.255.255.255\"\n \"127.0.0.2\"\n \"10.3.0.222\"\n \"127.0.0.3\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"},{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"10998d7600000000653c4777c855467700000000d0bb007780120177d62d477700000000\" to virtual address \"0x6FAF1000\" (part of module \"KSUSER.DLL\")\n \"\" wrote bytes \"f852c9ef\" to virtual address \"0x6ACD2AFC\" (part of module \"CLR.DLL\")\n \"\" wrote bytes \"db4d607200000000\" to virtual address \"0x00392000\" (part of module \"KMSAUTO_NET.EXE\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"},{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"\"Found VM detection artifact \"VMware trick\" in \"KMSAuto_Net.exe.bin\" (Offset: 2013758), \"Found VM detection artifact \"CPUID trick\" in \"KMSAuto_Net.exe.bin\" (Offset: 1175692)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"},{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/54 Antivirus vendors marked sample as malicious (24% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"13/54 Antivirus vendors marked sample as malicious (24% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated memory in \"%WINDIR%\\System32\\cmd.exe\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"level":"malicious","category":"Installation/Persistance","name":"Found an indicator for a scheduled task trigger","description":"\"ml version=\"1.0\" encoding=\"UTF-16\"?>\n\n \n 2014-10-15T18:54:19.4648216\n RATIBORUS\n \n \n \n true\n \n \n \n \n S-1-5-32-544\n HighestAvailable\n \n \" (Indicator: \"LogonTrigger\", File: \"KMSAuto_Net.exe.bin\")","origin":"File/Memory","relevance":5,"id":"string-32","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"},{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00011618-00002464)\n Spawned process \"cmd.exe\" with commandline \"cmd /c md \"%LOCALAPPDATA%\\MSfree Inc\"\" (UID: 00012556-00003856)\n Spawned process \"cmd.exe\" with commandline \"cmd /c echo test>>\"C:\\\\test.test\"\" (UID: 00012607-00003028)\n Spawned process \"cmd.exe\" with commandline \"/c del /F /Q \"test.test\"\" (UID: 00012613-00003736)\n Spawned process \"cmd.exe\" with commandline \"/c del /F /Q \"kmsauto.ini\"\" (UID: 00023229-00001916)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$26","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"KMSAuto Net.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file resource with suspicious entropy","description":"$27","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\PhysicalDrive; Source: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptDeriveKey_() failed\" (Indicator: \"CryptDeriveKey\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"CryptCreateHash_() failed\" (Indicator: \"CryptCreateHash\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"CryptAcquireContext_() failed\" (Indicator: \"CryptAcquireContext\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"CryptEncrypt_() failed\" (Indicator: \"CryptEncrypt\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00001252.00000000.288816.03C80000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00001252.00000000.288816.03C80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"The Software Licensing Service reported that the computer could not be activated. The certificate cannot be used because its private key is exportable.\" (Indicator: \"private key\"; File: \"KMSAuto Net.exe\")\n Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00001252.00000000.288816.03C80000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00001252.00000000.288816.03C80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.0802293462559005","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Calls an API typically to import cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001252-00000C29-3518229131\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"KMSAutoNet.exe\" called \"IsWow64Process\" with parameter \"1252\" - (UID: 00000000-00001252)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"KMSAutoNet.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001252)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"FindFirstVolumeA\" (Indicator: \"FindFirstVolume\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"FindNextVolumeA\" (Indicator: \"FindNextVolume\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"SetVolumeMountPointA\" (Indicator: \"SetVolumeMountPoint\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"GetVolumePathNamesForVolumeNameA\" (Indicator: \"GetVolumePathNamesForVolumeName\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"GetVolumePathNamesForVolumeNameA\" (Indicator: \"GetVolumePathName\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"FindVolumeCloseA\" (Indicator: \"FindVolumeClose\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Win32_BIOs,SerialNumber\" (Indicator: \"select * from \"; File: \"KMSAuto Net.exe\")\n Found string \"Select * FROM Win32_ComputerSystemProduct,UUID\" (Indicator: \"select * from \"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_Is64BitOperatingSystem\" in \"KMSAuto Net.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"KMSAutoNet.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set filesystem = CreateObject(\"scripting.Filesystemobject\")\" (Indicator: \"set \"; File: \"KMSAuto Net.exe\")\n Found string \"Set objFolder = objShell.Namespace(filesystem.GetParentFolderName(Wscript.Arguments(0)))\" (Indicator: \"set \"; File: \"KMSAuto Net.exe\")\n Found string \"Set objFolderItem = objFolder.ParseName(filesystem.GetFileName(WScript.Arguments(0)))\" (Indicator: \"set \"; File: \"KMSAuto Net.exe\")\n Found string \"Set objShell = CreateObject(\"Shell.Application\")\" (Indicator: \"set \"; File: \"KMSAuto Net.exe\")\n Found string \"Set colVerbs = objFolderItem.Verbs\" (Indicator: \"set \"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"FileTimeToLocalFileTime error\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindow\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"Found string \"cmd.exe /c netsh interface ip set address\" (Indicator: \"netsh interface \"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumePathNamesForVolumeNameA\" (Indicator: \"GetVolumePathNamesForVolumeName\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve windows environment variables","description":"Found string \"Microsoft Office 15 Sync Maintenance for %COMPUTERNAME%-%USERNAME% %COMPUTERNAME%\" (Indicator: \"%username%\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-557","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"KMSAutoNet.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used to retrieve network adapter information","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-515","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"KMSAutoNet.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Contains ability to add users to a group (API string)","description":"Found reference to API \"NetLocalGroupAddMembers\" (Indicator: \"NetLocalGroupAdd\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-215","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Contains ability to copy files","description":"Observed string: \"cmd.exe /c copy\" (Indicator: \"cmd.exe /c copy\") in Source: KMSAuto Net.exe\n Observed string: \"cmd.exe /c copy SppExtComObjPatcher.exe\" (Indicator: \"cmd.exe /c copy\") in Source: KMSAuto Net.exe\n Observed string: \"cmd.exe /c copy SppExtComObjPatcher.exe\" (Indicator: \"/c copy \") in Source: KMSAuto Net.exe\n Observed string: \"cmd.exe /c copy SppExtComObjHook.dll\" (Indicator: \"cmd.exe /c copy\") in Source: KMSAuto Net.exe\n Observed string: \"cmd.exe /c copy SppExtComObjHook.dll\" (Indicator: \"/c copy \") in Source: KMSAuto Net.exe","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-329","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcess\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"Found reference to API \"NetUserAdd\" (Indicator: \"NetUserAdd\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"NetLocalGroupAddMembers\" (Indicator: \"NetLocalGroupAddMembers\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-214","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Contains ability to execute application (Dotnet)","description":"Observed function \"set_UseShellExecute\" in \"KMSAuto Net.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Contains ability to execute windows services","description":"Found string \"net start dot3svc\" (Indicator: \"net start \"; File: \"KMSAuto Net.exe\")\n Found string \"net start TunMirror\" (Indicator: \"net start \"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-521","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$30","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteSubKeyTree\" in \"KMSAuto Net.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"KMSAuto Net.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"KMSAuto Net.exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenBaseKey\" in \"KMSAuto Net.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"KMSAuto Net.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"KMSAuto Net.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":1,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"KMSAutoNet.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoree.dll\" - [base:0; Status:ffffffffc0000135]\n \"KMSAutoNet.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ole32.dll\" - [base:0; Status:ffffffffc0000135]\n \"KMSAutoNet.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll\" - [base:0; Status:ffffffffc0000135]\n \"KMSAutoNet.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\VERSION.dll\" - [base:0; Status:ffffffffc0000135]\n \"KMSAutoNet.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll\" - [base:0; Status:ffffffffc0000135]\n \"KMSAutoNet.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\uxtheme.dll\" - [base:0; Status:ffffffffc0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"KMSAuto Net.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"SLIsGenuineLocal\" in \"KMSAuto Net.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"http://www.youtube.com/results?search_query=%22KMSAuto%20Net%202015%22\" (Indicator: \"youtube\"; File: \"KMSAuto Net.exe\")\n Found string \"http://www.youtube.com/watch?v=niXf0ov0S8I\" (Indicator: \"youtube\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"KMSAutoNet.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76F50000\n \"KMSAutoNet.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 718C0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"KMSAutoNet.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72E10000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"KMSAutoNet.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75070000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"KMSAuto Net.exe\" was detected as \".NET\" and name: \"Library\"\n \"KMSAuto Net.exe\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"KMSAuto Net.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$32","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"KMSAuto Net.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"KMSAuto Net.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$33","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x69a600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x69a4c8\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"get_Comodo2\" (Indicator: \"comodo\") in Source: KMSAuto Net.exe\n \"Comodo2\" (Indicator: \"comodo\") in Source: KMSAuto Net.exe\n \"nh Antivirus n\" (Indicator: \"antivirus\") in Source: KMSAuto Net.exe","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 444 -p 1252 -ip 1252\" (UID: 00000000-00005752)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1252 -s 1116\" (UID: 00000000-00002772)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1252 -s 1116\" (UID: 00000000-00004480)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Ratiborus MSFree Inc.\" (SHA1: 1A:C5:31:7A:27:ED:D1:4D:25:17:67:BF:CA:3C:38:21:6E:C3:CA:54; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA\" (SHA1: 6C:07:45:3F:FD:DA:08:B8:37:07:C0:9B:82:FB:3D:15:F3:53:36:B1; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US\" (SHA1: 65:43:99:29:B6:79:73:EB:19:2D:6F:F2:43:E6:76:7A:DF:08:34:E4; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"KMSAutoNet.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"KMSAutoNet.exe\" queries basic process information of the \"C:\\KMSAutoNet.exe\" (UID: 1252)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"KMSAutoNet.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config\"\n \"KMSAutoNet.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\8d55d7cad944a3f21aeb1db491f3d6de\\mscorlib.ni.dll.aux\"\n \"KMSAutoNet.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\10e5a0803d11b8b826dbeb56a1f98239\\system.ni.dll.aux\"\n \"KMSAutoNet.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\e4e680611f69d26d704e61dd8bfa4ece\\system.configuration.ni.dll.aux\"\n \"KMSAutoNet.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\53fcc36b6b7c9cc86e5d7484c1f93bd8\\system.core.ni.dll.aux\"\n \"KMSAutoNet.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\638ba173c955ab83f37edbab9b896f44\\system.xml.ni.dll.aux\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Installation/Persistence","name":"References PATH environment registry keys","description":"Found string \"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\Environment\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1574.007","relevance":1,"id":"string-530","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: The input sample contains a known anti-VM trick","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"KMSAutoNet.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mscoree.dll\"\n \"KMSAutoNet.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"KMSAutoNet.exe\" trying to touch file \"C:\\KMSAutoNet.exe\"\n \"KMSAutoNet.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"KMSAutoNet.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"KMSAutoNet.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"KMSAutoNet.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"KMSAutoNet.exe\" trying to touch file \"C:\\Windows\\apppatch\\MergeSdbFilesSource\\sysMerge.sdb\"\n \"KMSAutoNet.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"\n \"KMSAutoNet.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\fltLib.dll\"\n \"KMSAutoNet.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\rpcrt4.dll\"\n \"KMSAutoNet.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ws2_32.dll\"\n \"KMSAutoNet.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ucrtbase.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetAddConnection2A\" (Indicator: \"NetAddConnection\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"WNetAddConnectionA\" (Indicator: \"NetAddConnection\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Found reference to API \"WNetCancelConnectionA\" (Indicator: \"WNetCancelConnection\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetUserEnum\" (Indicator: \"NetUserEnum\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 091f51a7a1c3a4504a224cc081ce9cee\n Observed JA3 fingerprint: 65005c9d9ae0f0ebeaf22c210571d482\n Observed JA3 fingerprint: 46f5131e766d248db0248a86c494b71c\n Observed JA3 fingerprint: 6a5d235ee78c6aede6a61448b4e9ff1e","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinA\" (Indicator: \"EmptyRecycleBin\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"KMSAutoNet.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"KMSAutoNet.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetProcessesByName\" (Indicator: \"GetProcessesByName\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"Process32FirstW\" (Indicator: \"Process32First\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"Process32First\" (Indicator: \"Process32First\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"Process32Next\" (Indicator: \"Process32Next\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"Process32NextW\" (Indicator: \"Process32Next\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate user groups or their members (API string)","description":"Found reference to API \"NetLocalGroupGetMembers\" (Indicator: \"NetLocalGroupGetMembers\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1069","relevance":1,"id":"string-219","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessesByName\" in \"KMSAuto Net.exe\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"GetFileVersionInfoW\" (Indicator: \"GetFileVersionInfo\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfo\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfoSize\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"WHERE PartialProductKey <> null\" (Indicator: \"where \"; File: \"KMSAuto Net.exe\")\n Found string \"WHERE ProductKeyID IS NOT NULL\" (Indicator: \"where \"; File: \"KMSAuto Net.exe\")\n Found string \"WHERE ApplicationId = '59a52881-a989-479d-af46-f275c6370663' AND PartialProductKey <> NULL\" (Indicator: \"where \"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExA\" (Indicator: \"GetComputerName\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"NetUserEnum\" (Indicator: \"NetUserEnum\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"NetGetJoinInformation\" (Indicator: \"NetGetJoinInformation\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"Found string \"cmd.exe /c findstr /c:\"[SR]\"\" (Indicator: \"findstr \"; File: \"KMSAuto Net.exe\")\n Found string \"cmd.exe /c findstr /c:\\\"[SR]\\\"\" (Indicator: \"findstr \"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1552","relevance":1,"id":"string-334","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete users from a group (API string)","description":"Found reference to API \"NetLocalGroupDelMembers\" (Indicator: \"NetLocalGroupDelMembers\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"NetLocalGroupDelMembers\" (Indicator: \"NetLocalGroupDel\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-218","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to control system service controller","description":"Observed function \"ServiceController\" in \"KMSAuto Net.exe\"","origin":"Static Parser","mitre_attack_id":"T1569.002","relevance":1,"id":"static-117","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcessWithLogon\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"cmd.exe /c del /F /Q \"\" (Indicator: \"cmd.exe /c del\") in Source: KMSAuto Net.exe, Observed string: \"cmd.exe /c del /F /Q \"\" (Indicator: \"/c del \") in Source: KMSAuto Net.exe\n Observed string: \"cmd.exe /c del /F /Q \\\"\" (Indicator: \"cmd.exe /c del\") in Source: 60001e1-Form1~ActivationRestoreWin8, Observed string: \"cmd.exe /c del /F /Q \\\"\" (Indicator: \"/c del \") in Source: 60001e1-Form1~ActivationRestoreWin8","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyExA\" (Indicator: \"RegDeleteKey\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"NetUserChangePassword\" (Indicator: \"NetUserChangePassword\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to stop windows services","description":"Found string \"net stop sppsvc /y\" (Indicator: \"net stop\"; File: \"KMSAuto Net.exe\")\n Found string \"net stop TunMirror\" (Indicator: \"net stop\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-522","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found reference to Diagnosis CAB file","description":"\"wushowhide.diagcab\" (Indicator: \".diagcab\")\n \"\\wushowhide.diagcab\" (Indicator: \".diagcab\")\n \"\\\\wushowhide.diagcab\" (Indicator: \".diagcab\")","origin":"File/Memory","relevance":7,"id":"string-47","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"KMSAuto Net.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"KMSAutoNet.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"KMSAuto Net.exe\" has section name .text with entropy \"7.09187990459\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"KMSAutoNet.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00001252)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Able to delete scheduled task(s)","description":"Found string \"cmd /c schtasks.exe /delete /TN KMSAutoNet /F\" (Indicator: \"schtasks.exe /delete\"; File: \"KMSAuto Net.exe\")\n Found string \"/c schtasks.exe /delete /TN KMSAutoNet /F\" (Indicator: \"schtasks.exe /delete\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-629","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WbemScripting.SWbemNamedValueSet\" (Indicator: \"wbemscripting.\"; in File: \"KMSAuto Net.exe\")\n Found string \"WbemScripting.SWbemLocator\" (Indicator: \"wbemscripting.\"; in File: \"KMSAuto Net.exe\")\n Found string \"root\\cimv2\" (Indicator: \"root\\cimv2\"; in File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"$3f","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"TaskList\" (Indicator: \"tasklist\"; File: \"KMSAuto Net.exe\")\n Found string \"ping -n 1 localhost\" (Indicator: \"ping\"; File: \"KMSAuto Net.exe\")\n Found string \"PING from PureBasic\" (Indicator: \"ping\"; File: \"KMSAuto Net.exe\")\n Found string \"cmd.exe /c route -p add\" (Indicator: \"route\"; File: \"KMSAuto Net.exe\")\n Found string \"cmd.exe /c route delete\" (Indicator: \"route\"; File: \"KMSAuto Net.exe\")\n Found string \"sc start\" (Indicator: \"sc start\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"}]},{"level":"suspicious","category":"System Security","name":"Able to modify firewall settings","description":"Found string \"Netsh Advfirewall Firewall delete rule name=\"0pen Port KMS\" protocol=TCP\" (File: \"KMSAuto Net.exe\")\n Found string \"\\System32\\Netsh.exe Advfirewall Firewall delete rule name=\"0pen Port KMS\" protocol=TCP\" (File: \"KMSAuto Net.exe\")\n Found string \"Netsh Advfirewall Firewall delete rule name=\\\"0pen Port KMS\\\" protocol=TCP\" (File: \"KMSAuto Net.exe\")\n Found string \"Netsh Advfirewall Firewall add rule name=\\\"0pen Port KMS\\\" dir=in action=allow protocol=TCP localport=\" (File: \"KMSAuto Net.exe\")\n Found string \"\\\\System32\\\\Netsh.exe Advfirewall Firewall delete rule name=\\\"0pen Port KMS\\\" protocol=TCP\" (File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1562.004","relevance":1,"id":"string-676","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains pe file in dotnet resource","description":"$40","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-109","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"memcmp\" (Source: KMSAuto Net.exe, API is part of module: VCRUNTIME140_CLR0400.DLL)\n Found string \"memmove\" (Source: KMSAuto Net.exe, API is part of module: VCRUNTIME140_CLR0400.DLL)\n Found string \"memcpy\" (Source: KMSAuto Net.exe, API is part of module: VCRUNTIME140_CLR0400.DLL)\n Found string \"memset\" (Source: KMSAuto Net.exe, API is part of module: VCRUNTIME140_CLR0400.DLL)\n Found string \"GetModuleFileNameExW\" (Source: KMSAuto Net.exe, API is part of module: PSAPI.DLL)\n Found string \"GetFileVersionInfoW\" (Source: KMSAuto Net.exe, API is part of module: VERSION.DLL)\n Found string \"GetFileVersionInfoSizeW\" (Source: KMSAuto Net.exe, API is part of module: VERSION.DLL)\n Found string \"VerQueryValueW\" (Source: KMSAuto Net.exe, API is part of module: VERSION.DLL)\n Found string \"GetProcessImageFileNameW\" (Source: KMSAuto Net.exe, API is part of module: PSAPI.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Sample/File contains another embedded binary","description":"$41","origin":"Binary File","mitre_attack_id":"T1027.009","relevance":3,"id":"binary-64","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/grayware_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate chain processed\n but terminated in a root certificate which is not trusted by the trust provider. (0x800b0109)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"KMSAutoNet.exe\" called \"LoadResource with parameter {'hModule': '1974403072', 'hResInfo': '8127984'}\" (UID: 00000000-00003944)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to remove a directory","description":"\"cmd.exe\" called \"RemoveDirectoryW\" with parameter %ALLUSERSPROFILE%\\KMSAutoS (UID: 00000000-00002108)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability execute applications in hidden mode (Dotnet)","description":"Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"KMSAuto Net.exe\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":1,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003944.00000001.67298.001F0000.00000004.mdmp, 00000000-00003944.00000002.69219.001F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"! \" # $ % & ' ( ) * + \n - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \\ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~\" (Indicator: \" ^ \"; Source: \"00000000-00003944.00000001.67298.04CD0000.00000004.mdmp\n 00000000-00003944.00000002.69219.04CD0000.00000004.mdmp\"), Found string \"& ( 2 9 < > D ^ p t\" (Indicator: \" ^ \"; Source: \"00000000-00003944.00000001.67298.04CD0000.00000004.mdmp, 00000000-00003944.00000002.69219.04CD0000.00000004.mdmp\")\n Found string \"[ \\ ] ^ _ ` i\" (Indicator: \" ^ \"; Source: \"00000000-00003944.00000001.67298.062A0000.00000004.mdmp, 00000000-00003944.00000002.69219.062A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"KMSAutoNet.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003944)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"KMSAutoNet.exe\" called \"GetWindowTextW\" with parameter \"Form1\" - (UID: 00000000-00003944)\n \"KMSAutoNet.exe\" called \"GetWindowTextW\" (UID: 00000000-00003944)\n \"KMSAutoNet.exe\" called \"GetWindowTextW\" with parameter \"KMSAuto Net 2015 v1.3.8 by Ratiborus\" - (UID: 00000000-00003944)\n \"KMSAutoNet.exe\" called \"GetWindowTextW\" with parameter \"1f0440043e043904420438042000120430043b04380434043004460438044e04\" - (UID: 00000000-00003944)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"KMSAutoNet.exe\" called \"GetActiveWindow\" (UID: 00000000-00003944)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"KMSAutoNet.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00003944)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$42","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"KMSAutoNet.exe\" called \"LookupAccountSidW\" with param Name A0CrRe9 (UID: 00000000-00003944)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"KMSAutoNet.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003944)\n \"KMSAutoNet.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00003944)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains the ability to enumerate volumes (API string)","description":"Found reference to API \"FindFirstVolumeA\" (Indicator: \"FindFirstVolume\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"FindNextVolumeA\" (Indicator: \"FindNextVolume\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"SetVolumeMountPointA\" (Indicator: \"SetVolumeMountPoint\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"GetVolumePathNamesForVolumeNameA\" (Indicator: \"GetVolumePathNamesForVolumeName\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"GetVolumePathNamesForVolumeNameA\" (Indicator: \"GetVolumePathName\"; File: \"KMSAuto Net.exe\")\n Found reference to API \"FindVolumeCloseA\" (Indicator: \"FindVolumeClose\"; File: \"KMSAuto Net.exe\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"KMSAutoNet.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003944)\n \"KMSAutoNet.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00003944)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"KMSAutoNet.exe\" called \"CreateProcessW\" with parameter \"cmd /c echo test>>\"C:\\\\test.test\"\" - (UID: 00000000-00003944)\n \"KMSAutoNet.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\System32\\cmd.exe /c del /F /Q \"test.test\"\" - (UID: 00000000-00003944)\n \"KMSAutoNet.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /c rd \"%ALLUSERSPROFILE%\\KMSAutoS\" /S /Q\" - (UID: 00000000-00003944)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"KMSAutoNet.exe\" called \"NtCreateNamedPipeFile\" (UID: 00000000-00003944)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Executes echo command","description":"Process \"%WINDIR%\\system32\\cmd.exe\" with commandline \"cmd /c echo test>>\"C:\\\\\\\\test.test\"\" (UID: 00000000-00003740)","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":1,"id":"target-343","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"100011000e03376d@ADVAPI32.dll\"\n \"0d000e002203376d@ADVAPI32.dll\"\n \"0d000e00fe02376d@ADVAPI32.dll\"\n \"0b000c00cc02376d@ADVAPI32.dll\"\n \"10001100da02376d@ADVAPI32.dll\"\n \"150016003cda786d@ADVAPI32.dll\"\n \"0e000f00ecda786d@ADVAPI32.dll\"\n \"0e000f0048db786d@ADVAPI32.dll\"\n \"1100120024e3786d@ADVAPI32.dll\"\n \"11001200c0e3786d@ADVAPI32.dll\"\n \"1200130004e4786d@ADVAPI32.dll\"\n \"120013005ce4786d@ADVAPI32.dll\"\n \"140015008005796d@ADVAPI32.dll\"\n \"140015009805796d@ADVAPI32.dll\"\n \"14001500b005796d@ADVAPI32.dll\"\n \"17001800c805796d@ADVAPI32.dll\"\n \"0d000e00e005796d@ADVAPI32.dll\"\n \"0f0010000c07796d@ADVAPI32.dll\"\n \"140015004c07796d@ADVAPI32.dll\"\n \"140015006407796d@ADVAPI32.dll\"\n \"0c000d00ac07796d@ADVAPI32.dll\"\n \"0c000d00bc07796d@ADVAPI32.dll\"\n \"0e000f00cc07796d@ADVAPI32.dll\"\n \"180019003409796d@RPCRT4.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\cmd.exe /c del /F /Q \"test.test\"\" [Source: 00000000-00003944-00000C41-7400]\n Observed system executable string:\"\"%WINDIR%\\System32\\cmd.exe\" /c rd \"%ALLUSERSPROFILE%\\KMSAutoS\" /S /Q\" [Source: 00000000-00003944-00000C41-7497008349]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"KMSAutoNet.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \"KMSAutoNet.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \"KMSAutoNet.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \"KMSAutoNet.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"\n \"KMSAutoNet.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"cmd.exe\" writes file \"c:\\test.test\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"KMSAutoNet.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003944)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$43","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEFFB56F4785D248D999263F4F5A12]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003944.00000001.67298.001F0000.00000004.mdmp, 00000000-00003944.00000002.69219.001F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"KMSAutoNet.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"755042280\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"KMSAutoNet.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"4244701733\"\n \"cx\": \"1\"\n \"cy\": \"1\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"System Destruction","name":"Marks file for deletion","description":"$44","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"$45","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"KMSAutoNet.exe\" at 00000000-00003944-00000105-5764358","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"KMSAutoNet.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Local\\MSfree Inc\\kmsauto.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"KMSAutoNet.exe\" allocated memory in \"C:\\KMSAutoNet.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007836.00000000.67190.03940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"KMSAutoNet.exe\" called \"GetComputerNameW\" (UID: 00000000-00007836)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"KMSAutoNet.exe\" queried SystemProcessInformation at 00000000-00007836-00000C13-34972298 [PID: 7836]\n \"KMSAutoNet.exe\" queried SystemProcessInformation at 00000000-00007836-00000C13-34973990 [PID: 7836]\n \"KMSAutoNet.exe\" queried SystemProcessInformation at 00000000-00007836-00000C13-35233176 [PID: 7836]\n \"KMSAutoNet.exe\" queried SystemProcessInformation at 00000000-00007836-00000C13-35234740 [PID: 7836]\n \"KMSAutoNet.exe\" queried SystemProcessInformation at 00000000-00007836-00000C13-36530829 [PID: 7836]\n \"KMSAutoNet.exe\" queried SystemProcessInformation at 00000000-00007836-00000C13-36532692 [PID: 7836]\n \"KMSAutoNet.exe\" queried SystemProcessInformation at 00000000-00007836-00000C13-37660331 [PID: 7836]\n \"KMSAutoNet.exe\" queried SystemProcessInformation at 00000000-00007836-00000C13-37661925 [PID: 7836]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"}]},{"level":"malicious","category":"Network Related","name":"Making HTTPS connections using insecure TLS/SSL version","description":"Connection was made using TLSv1.1 [tls.handshake.version: 0x0302]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":10,"id":"network-53","sources":[{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor rax\n rsp in Stream UID: 19360-7-00000001000099F4\n Assembly shows XOR instruction xor eax\n esp in Stream UID: 19360-7-00000001000099F4\n Assembly shows XOR instruction xor rcx\n rsp in Stream UID: 19360-7-00000001000099F4\n Assembly shows XOR instruction xor ecx\n esp in Stream UID: 19360-7-00000001000099F4\n Assembly shows XOR instruction xor rax\n rsp in Stream UID: 19360-27-00000001000087B0\n Assembly shows XOR instruction xor eax\n esp in Stream UID: 19360-27-00000001000087B0\n Assembly shows XOR instruction xor rcx\n rsp in Stream UID: 19360-27-00000001000087B0\n Assembly shows XOR instruction xor ecx\n esp in Stream UID: 19360-27-00000001000087B0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.dll at 19360-1-000000010000F3CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"DISMHOST.EXE.65E2A83C.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"DISMHOST.EXE.65E2A83C.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"DISMHOST.EXE.65E2A83C.bin\" has high imagebase \"0x100000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00001876) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"cmd.exe\" (UID: 00000000-00001876) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"PerfStringBackup.TMP\" has type \"data\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"file/memory contains long string with (Indicator: \"EndGetRequestStream\"; File: \"PerfStringBackup.TMP\")\n file/memory contains long string with (Indicator: \"GetRequestStream\"; File: \"PerfStringBackup.TMP\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"dpmodemx.dll\" [Source: 00000000-00003712.00000001.67758.00AC0000.00000004.mdmp\n 00000000-00003712.00000002.69682.00AC0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"KMSAutoNet.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002604.00000000.89747.FFCB1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$48","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (File: \"00000000-00003712.00000001.67758.00500000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"00000000-00003712.00000001.67758.00500000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 19360-1-000000010000F3CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"DISMHOST.EXE.65E2A83C.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"DISMHOST.EXE.65E2A83C.bin\" claimed CRC 141269 while the actual is CRC 6992996","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"SetSecurityDescriptorDacl\n OutputDebugStringW\n GetModuleFileNameW\n GetVersionExW\n OutputDebugStringA\n VirtualProtect\n GetVersionExA\n GetFileAttributesW\n GetCommandLineW\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n GetTickCount\n MapViewOfFile\n GetProcAddress\n CreateFileMappingW\n CreateThread\n LoadLibraryW\n GetSystemDirectoryW\n FindResourceExW\n GetModuleHandleW\n TerminateProcess\n GetModuleHandleExW\n CreateFileW\n Sleep","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"},{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"The input sample contains a known anti-VM trick"},{"detail":"Possibly checks for the presence of a forensics/monitoring tool"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":96,"dropped_files_count":0,"extracted_files_count":13,"files_written_count":42,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["agent","autokms","evasive","bancteian","cassini_43febc0c","e5","hackkms"],"sample_flags":["Extracted Files","Sample Crashed","User Comment","Multi-Process","Simulated analysis"],"sandbox_reports":[{"id":"66fde060ceff94616000086e","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"KMSAuto Net.exe","analysis_start_time":"2024-10-03T00:08:00+00:00","indicators_count":{"informative":135,"suspicious":28,"malicious":4},"tags":["Sample Crashed","User Comment"],"is_in_unified_schema":true},{"id":"65e223863500a8165208cdb2","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"KMSAuto Net.exe","analysis_start_time":"2024-03-01T18:50:46+00:00","indicators_count":{"informative":154,"suspicious":29,"malicious":5},"tags":["Multi-Process","Extracted Files","User Comment","Simulated analysis"],"is_in_unified_schema":true},{"id":"65e22379b930a7cba30314e3","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"KMSAuto Net.exe","analysis_start_time":"2024-03-01T18:50:33+00:00","indicators_count":{"informative":183,"suspicious":36,"malicious":4},"tags":["Multi-Process","Extracted Files","User Comment","Simulated analysis"],"is_in_unified_schema":true},{"id":"65e2236c00e555382606e368","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"KMSAuto Net.exe","analysis_start_time":"2024-03-01T18:50:20+00:00","indicators_count":{"informative":138,"suspicious":23,"malicious":5},"tags":["Multi-Process","Sample Crashed","User Comment","Simulated analysis"],"is_in_unified_schema":true},{"id":"65e2235e458b9a27fc08e1f8","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"KMSAuto Net.exe","analysis_start_time":"2024-03-01T18:50:07+00:00","indicators_count":{"informative":134,"suspicious":24,"malicious":4},"tags":["Multi-Process","Sample Crashed","User Comment","Simulated analysis"],"is_in_unified_schema":false},{"id":"63520e28a83c935fc10d68b7","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Application.Hacktool.KMSAuto","submit_name":"KMSAuto Net.exe","analysis_start_time":"2022-10-21T03:12:42+00:00","indicators_count":{"informative":38,"suspicious":29,"malicious":6},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":false},{"id":"5a4cf9647ca3e14dc62550b9","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Application.Hacktool.KMSAuto","contacted_countries":["EU","USA"],"submit_name":"KMSAuto Net.exe","analysis_start_time":"2018-01-03T16:40:55+00:00","indicators_count":{"informative":14,"suspicious":14,"malicious":6},"tags":["Network Traffic","Extracted Files","User Comment","TOR analysis"],"is_in_unified_schema":false},{"id":"57840cb3aac2ed8453a3d68f","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Application.Hacktool","submit_name":"KMS.exe","analysis_start_time":"2016-07-11T23:17:36+00:00","indicators_count":{"informative":9,"suspicious":16,"malicious":6},"tags":["Extracted Files","Sample Crashed","User Comment"],"is_in_unified_schema":false},{"id":"56bb1a320e316d930d50a911","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Unwanted","submit_name":"KMSAuto Net.exe","analysis_start_time":"2016-02-10T05:09:18+00:00","indicators_count":{"informative":7,"suspicious":15,"malicious":7},"tags":["Extracted Files","Sample Crashed","User Comment"],"is_in_unified_schema":true},{"id":"55fe8b880e316d280d1150f3","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":66,"malware_family":"AutoKMS","contacted_countries":["USA"],"submit_name":"KMSAuto Net.exe","analysis_start_time":"2015-09-20T05:35:46+00:00","indicators_count":{"informative":8,"suspicious":13,"malicious":5},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":false},{"id":"55fa859d0e316d1e6d786c88","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"suspicious","threat_score":45,"submit_name":"KMSAuto Net 2015 v1.3.8 Portable.exe","analysis_start_time":"2015-09-17T04:21:40+00:00","indicators_count":{"informative":7,"suspicious":11,"malicious":3},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":false},{"id":"55f1f4280e316d2d53bf1246","environment_id":3,"environment_description":"Windows 8.1 32 bit (EN)","state":"SUCCESS","verdict":"suspicious","threat_score":63,"contacted_countries":["USA"],"submit_name":"KMSAuto Net.exe","analysis_start_time":"2015-09-10T16:22:18+00:00","indicators_count":{"informative":7,"suspicious":13,"malicious":4},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":false},{"id":"55d1356a0e316df34768745c","environment_id":5,"environment_description":"W7 32 bit 'Stealthy Mode' with 'DNS Spoof'","state":"SUCCESS","verdict":"suspicious","threat_score":51,"submit_name":"KMSAuto Net.exe","analysis_start_time":"2015-08-16T20:15:46+00:00","indicators_count":{"informative":6,"suspicious":15,"malicious":3},"tags":["Extracted Files","User Comment","Simulated analysis"],"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}],"processes":[{"pid":2464,"ppid":0,"name":"KMSAuto_Net.exe","command_line":"","normalized_path":"","uid":"00011618-00002464","icon":"$49"},{"pid":3856,"ppid":0,"name":"cmd.exe","command_line":"cmd /c md \"%LOCALAPPDATA%\\MSfree Inc\"","normalized_path":"","uid":"00012556-00003856"},{"pid":3028,"ppid":0,"name":"cmd.exe","command_line":"cmd /c echo test>>\"C:\\\\test.test\"","normalized_path":"","uid":"00012607-00003028"},{"pid":3736,"ppid":0,"name":"cmd.exe","command_line":"/c del /F /Q \"test.test\"","normalized_path":"","uid":"00012613-00003736"},{"pid":1916,"ppid":0,"name":"cmd.exe","command_line":"/c del /F /Q \"kmsauto.ini\"","normalized_path":"","uid":"00023229-00001916"}],"all_imported_dlls":["oleaut32.dll","dwmapi.dll","propsys.dll","RpcRtRemote.dll","lpk.dll","mscorlib.ni.dll","avrt.dll","usp10.dll","imm32.dll","ole32.dll","AudioSes.dll","gdi32.dll","cryptbase.dll","Microsoft.VisualBasic.ni.dll","comctl32.dll","System.Windows.Forms.dll","GdiPlus.dll","midimap.dll","ntdll.dll","winmm.dll","ksuser.dll","mscoreei.dll","devobj.dll","System.Drawing.ni.dll","WindowsCodecs.dll","wtsapi32.dll","slc.dll","msacm32.dll","cfgmgr32.dll","mscoree.dll","msvcrt.dll","shlwapi.dll","nlssorting.dll","sppc.dll","setupapi.dll","clbcatq.dll","clrjit.dll","msvcr110_clr0400.dll","version.dll","kernel32.dll","KernelBase.dll","System.Runtime.Remoting.ni.dll","slwga.dll","MMDevAPI.dll","clr.dll","sechost.dll","msctf.dll","uxtheme.dll","rsaenh.dll","advapi32.dll","cryptsp.dll","System.ni.dll","System.Core.ni.dll","System.Windows.Forms.ni.dll","apphelp.dll","rpcrt4.dll","user32.dll","Microsoft.VisualBasic.dll","System.Runtime.Remoting.dll","bcrypt.dll","SHCore.dll","vcruntime140_clr0400.dll","wow64.dll","kernel.appcore.dll","Accessibility.dll","wow64base.dll","wow64cpu.dll","VxSSL32.dll","msvcp_win.dll","WinTypes.dll","ws2_32.dll","fltLib.dll","ucrtbase.dll","combase.dll","bcryptprimitives.dll","shell32.dll","ucrtbase_clr0400.dll","profapi.dll","System.Xml.ni.dll","windows.storage.dll","wow64win.dll","gdi32full.dll","psapi.dll","wow64con.dll","win32u.dll","System.Drawing.dll","System.Configuration.ni.dll","winbrand.dll","mscorrc.dll","rpcss.dll","nsi.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-core-xstate-l2-1-0.dll","powrprof.dll","sspicli.dll","VxSSL64.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"kmsauto.ini","sha256":"af410329685ec2ae82a5c927733d274317b3c9d47db8667604510d018a103a15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"name":"test.test","sha256":"837ccb607e312b170fac7383d7ccfd61fa5072793f19a25e75fbacb56539b86b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"name":"PerfStringBackup.TMP","sha256":"c5432de237ee7000579fa564601064160677bcf9b6c7eaab5b62df0f838b4f7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"name":"PerfStringBackup.INI","sha256":"c5432de237ee7000579fa564601064160677bcf9b6c7eaab5b62df0f838b4f7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"name":"perfh009.dat","sha256":"4c15a8b78cbbc10236a406efce8b016d082c44d9df713c845ca20a3624535062","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"name":"dism.log","sha256":"8932c27b61b4b4d7279496c5b648a1a0310a28d2847ed878f96f44be0d0089e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"name":"perfc009.dat","sha256":"0fc41c7689ed068dcaac5fc958cafde0e2d5930f454ea8b9f2496b0aeeeeb765","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"name":"DISMHOST.EXE.65E2A83C.bin","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"name":"WmiApRpl_new.ini","sha256":"7dad3dd492abede224058514fd7bd43ae34dce0db7defc20de33f32b3b2497b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"name":"WmiApRpl_new.h","sha256":"9f58f4e28982d7c5999b271ee4100c7f4c4092b5f91f5c1c7203aa41b3e932db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"name":"wmiprov.log","sha256":"3d02b9a720a78bab6f03c7109a1727e49d163592588a8c23eaeffbba96f497ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"name":"WmiApRpl.ini","sha256":"7dad3dd492abede224058514fd7bd43ae34dce0db7defc20de33f32b3b2497b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"name":"WmiApRpl.h","sha256":"9f58f4e28982d7c5999b271ee4100c7f4c4092b5f91f5c1c7203aa41b3e932db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"C:\\KMSAuto_Net.exe.config","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.log","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\assembly\\pubpol15.dat","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\536f3c2e6e4137a628f2f64e0dfd407e\\Microsoft.VisualBasic.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\e40da7a49f8c3f0108e7c835b342f382\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\b9f7adbc90a2bcbe8eb9e6e8d2bb975b\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\22ae167d586450ad3a9b9a9ee43ebc86\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\72269ea7cc6281139e4d155e7c57dc67\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\SortDefault.nlp","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Runt73a1fc9d#\\4cfa42c8b69a64e192f3255ec900457d\\System.Runtime.Remoting.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\FONTS\\TAHOMA.TTF","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\FONTS\\MSJH.TTF","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\FONTS\\MSYH.TTF","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\FONTS\\MALGUN.TTF","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\FONTS\\MICROSS.TTF","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUI.TTF","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\media\\Windows Menu Command.wav","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\FONTS\\COUR.TTF","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\FONTS\\COURBD.TTF","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\FONTS\\COURI.TTF","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\FONTS\\COURBI.TTF","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\system32\\en-US\\wdmaud.drv.mui","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\system32\\en-US\\MMDevAPI.DLL.mui","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%WINDIR%\\System32\\wdmaud.drv","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"%LOCALAPPDATA%\\MSfree Inc\\kmsauto.ini","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"path":"C:\\test.test","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"},{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"65e223863500a8165208cdb2"},{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MidiMapper_modLongMessage_RefCnt","sources":[{"report_type":"sandbox","report_id":"56bb1a320e316d930d50a911"}]},{"name":"SM0:1252:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"}]},{"name":"Local\\SM0:1252:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66fde060ceff94616000086e"}]},{"name":"SM0:7836:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"}]},{"name":"Local\\SM0:7836:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"}]},{"name":"SM0:7836:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65e2236c00e555382606e368"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]},{"name":"Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"65e22379b930a7cba30314e3"}]}]}},"report_ids":{"sandbox_job_ids":["65e223863500a8165208cdb2","56bb1a320e316d930d50a911","66fde060ceff94616000086e","65e22379b930a7cba30314e3","65e2236c00e555382606e368"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious HackTool/KMSAuto Sample 69a8ae6352cf… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 69a8ae6352cf…. Malware family: HackTool/KMSAuto. Threat score 100/100. 16/27 AV engines flagged this file. 10 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/69a8ae6352cffd366409df8e566e84315b4bffcf5865a4b8079c446123ba1d26"}],["$","meta","4",{"property":"og:title","content":"Malicious HackTool/KMSAuto Sample 69a8ae6352cf… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 69a8ae6352cf…. Malware family: HackTool/KMSAuto. Threat score 100/100. 16/27 AV engines flagged this file. 10 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/69a8ae6352cffd366409df8e566e84315b4bffcf5865a4b8079c446123ba1d26"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious HackTool/KMSAuto Sample 69a8ae6352cf… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 69a8ae6352cf…. Malware family: HackTool/KMSAuto. Threat score 100/100. 16/27 AV engines flagged this file. 10 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4a","11",{}]]