Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\net.exe' stop osppsvc /y
- '<SYSTEM32>\net.exe' stop sppsvc /y
Modifies file system
Creates the following files
- <Current directory>\.kms_repo_\.git\head
- <SYSTEM32>\sppextcomobjhook.dll
- %TEMP%\ksnxfd1s.dll
- %TEMP%\resff95.tmp
- %TEMP%\cscff94.tmp
- %TEMP%\ksnxfd1s.out
- %TEMP%\ksnxfd1s.cmdline
- %TEMP%\ksnxfd1s.0.cs
- nul
- <Current directory>\.kms_repo_\readme.md
- <Current directory>\.kms_repo_\license
- <Current directory>\.kms_repo_\kms_vl_all_aio.cmd
- <Current directory>\.kms_repo_\.git\index
- <Current directory>\.kms_repo_\.git\refs\heads\master
- <Current directory>\.kms_repo_\.git\refs\tags\v0.38.2
- <Current directory>\.kms_repo_\.git\refs\tags\v0.38.0
- <Current directory>\.kms_repo_\.git\refs\tags\v0.37.0
- <Current directory>\.kms_repo_\.git\refs\tags\v0.36.0
- <Current directory>\.kms_repo_\.git\refs\remotes\origin\master
- <Current directory>\.kms_repo_\.git\objects\pack\pack-5096108264e91d785c3a7f5ebe1b971135d8e5a6.idx
- <Current directory>\.kms_repo_\.git\objects\pack\tmp_pack_299887579
- <Current directory>\.kms_repo_\.git\config
- %WINDIR%\migration\wtr\kms_vl_all.inf
- %WINDIR%\temp\sppchk.txt
Deletes the following files
- %TEMP%\resff95.tmp
- <Current directory>\.kms_repo_\kms_vl_all_aio.cmd
- <Current directory>\.kms_repo_\.git\refs\tags\v0.38.2
- <Current directory>\.kms_repo_\.git\refs\tags\v0.38.0
- <Current directory>\.kms_repo_\.git\refs\tags\v0.37.0
- <Current directory>\.kms_repo_\.git\refs\tags\v0.36.0
- <Current directory>\.kms_repo_\.git\refs\remotes\origin\master
- <Current directory>\.kms_repo_\.git\refs\heads\master
- <Current directory>\.kms_repo_\.git\objects\pack\pack-5096108264e91d785c3a7f5ebe1b971135d8e5a6.pack
- <Current directory>\.kms_repo_\.git\objects\pack\pack-5096108264e91d785c3a7f5ebe1b971135d8e5a6.idx
- <Current directory>\.kms_repo_\.git\index
- <Current directory>\.kms_repo_\.git\head
- <Current directory>\.kms_repo_\.git\config
- %WINDIR%\temp\sppchk.txt
- %TEMP%\ksnxfd1s.dll
- %TEMP%\ksnxfd1s.out
- %TEMP%\ksnxfd1s.cmdline
- %TEMP%\ksnxfd1s.0.cs
- %TEMP%\ksnxfd1s.pdb
- %TEMP%\cscff94.tmp
- <Current directory>\.kms_repo_\license
- <Current directory>\.kms_repo_\readme.md
Moves the following files
- from <Current directory>\.kms_repo_\.git\objects\pack\tmp_pack_299887579 to <Current directory>\.kms_repo_\.git\objects\pack\pack-5096108264e91d785c3a7f5ebe1b971135d8e5a6.pack
Network activity
TCP
- 'gi##ub.com':443
UDP
- DNS ASK gi##ub.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ksnxfd1s.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFF95.tmp" "%TEMP%\CSCFF94.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c .KMS_REPO_\KMS_VL_ALL_AIO.cmd
- '<SYSTEM32>\find.exe' /i "R_Retail" "%WINDIR%\Temp\sppchk.txt"
- '<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionProduct where (ApplicationID='0ff1ce15-a989-479d-af46-f275c6370663' AND NOT Name like '%O365%') get Name
- '<SYSTEM32>\find.exe' /i "Office 14" "%WINDIR%\Temp\sppchk.txt"
- '<SYSTEM32>\find.exe' /i "Office 15" "%WINDIR%\Temp\sppchk.txt"
- '<SYSTEM32>\find.exe' /i "Office 16" "%WINDIR%\Temp\sppchk.txt"
- '<SYSTEM32>\find.exe' /i "Office 19" "%WINDIR%\Temp\sppchk.txt"
- '<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionProduct where (Description like '%KMSCLIENT%' AND NOT Name like '%MondoR_KMS_Automation%') get Name
- '<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingService where version='6.1.7601.17514' call DisableKeyManagementServiceHostCaching 0
- '<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingService where version='6.1.7601.17514' call DisableKeyManagementServiceDnsPublishing 0
- '<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and LicenseStatus='1') get Name /VALUE
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and LicenseStatus='1') get Name /VALUE"
- '<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL) get Name
- '<SYSTEM32>\findstr.exe' /i "Windows"
- '<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingProduct where (LicenseStatus='1' and Description like '%KMSCLIENT%') get Name
- '<SYSTEM32>\findstr.exe' /i "ae2ee509-1b34-41c0-acb7-6d4650168915"
- '<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingProduct where (PartialProductKey is not NULL) get ID
- '<SYSTEM32>\findstr.exe' "1"
- '<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingProduct where ID='ae2ee509-1b34-41c0-acb7-6d4650168915' get LicenseStatus
- '<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and Description like '%KMSCLIENT%') get ID /VALUE
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and Description like '%KMSCLIENT%') get ID /VALUE"
- '<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingService where version='6.1.7601.17514' call SetKeyManagementServicePort 1688
- '<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingService where version='6.1.7601.17514' call SetKeyManagementServiceMachine MachineName="172.16.0.2"
- '<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingService get Version /VALUE
- '<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and Description like '%KMSCLIENT%' and PartialProductKey is not NULL) get Name
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path SoftwareLicensingService get Version /VALUE"
- '<SYSTEM32>\find.exe' /i "Office 19"
- '<SYSTEM32>\find.exe' /i "Office 16"
- '<SYSTEM32>\net1.exe' stop sppsvc /y
- '<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionService where version='14.0.370.400' call DisableKeyManagementServiceHostCaching 0
- '<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionService where version='14.0.370.400' call DisableKeyManagementServiceDnsPublishing 0
- '<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionProduct where ID='6f327760-8c5c-417c-9b61-836a98287e0c' get GracePeriodRemaining /VALUE
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path OfficeSoftwareProtectionProduct where ID='6f327760-8c5c-417c-9b61-836a98287e0c' get GracePeriodRemaining /VALUE"
- '<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionProduct where ID='6f327760-8c5c-417c-9b61-836a98287e0c' call Activate
- '<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionProduct where ID='6f327760-8c5c-417c-9b61-836a98287e0c' get Name /VALUE
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path OfficeSoftwareProtectionProduct where ID='6f327760-8c5c-417c-9b61-836a98287e0c' get Name /VALUE"
- '<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionProduct where ID='6f327760-8c5c-417c-9b61-836a98287e0c' call ClearKeyManagementServicePort
- '<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionProduct where ID='6f327760-8c5c-417c-9b61-836a98287e0c' call ClearKeyManagementServiceMachine
- '<SYSTEM32>\findstr.exe' /i "6f327760-8c5c-417c-9b61-836a98287e0c"
- '<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionProduct where ID='6f327760-8c5c-417c-9b61-836a98287e0c' get Name
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath
- '<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionProduct where (Description like '%KMSCLIENT%') get ID /VALUE
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path OfficeSoftwareProtectionProduct where (Description like '%KMSCLIENT%') get ID /VALUE"
- '<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionService where version='14.0.370.400' call SetKeyManagementServicePort 1688
- '<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionService where version='14.0.370.400' call SetKeyManagementServiceMachine MachineName="172.16.0.2"
- '<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionService get Version /VALUE
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path OfficeSoftwareProtectionService get Version /VALUE" 2>nul
- '<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionProduct where (LicenseFamily='OfficeVisioPro-MAK') get LicenseStatus /VALUE
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path OfficeSoftwareProtectionProduct where (LicenseFamily='OfficeVisioPro-MAK') get LicenseStatus /VALUE" 2>nul
- '<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionProduct where (LicenseFamily='OfficeVisioPrem-MAK') get LicenseStatus /VALUE
- '%WINDIR%\syswow64\cmd.exe' /c "wmic path OfficeSoftwareProtectionProduct where (LicenseFamily='OfficeVisioPrem-MAK') get LicenseStatus /VALUE" 2>nul
- '<SYSTEM32>\find.exe' /i "Office 15"
- '<SYSTEM32>\findstr.exe' /i Windows
- '<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingProduct where (Description like '%KMSCLIENT%') get Name
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\16.0\Common\InstallRoot /v Path
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v VerifierDlls /t REG_SZ /d "SppExtComObjHook.dll"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v Debugger
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v KMS_RenewalInterval /t REG_DWORD /d 10080
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v KMS_ActivationInterval /t REG_DWORD /d 120
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v KMS_Emulation /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v GlobalFlag /t REG_DWORD /d 256
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v VerifierDlls /t REG_SZ /d "SppExtComObjHook.dll"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v Debugger
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFF95.tmp" "%TEMP%\CSCFF94.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ksnxfd1s.cmdline"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -nop -ep bypass -c "$f=[io.file]::ReadAllText('<Current directory>\.KMS_REPO_\KMS_VL_ALL_AIO.cmd') -split ':x64dll\:.*';iex ($f[1]);X 1;"
- '<SYSTEM32>\net1.exe' stop osppsvc /y
- '<SYSTEM32>\find.exe' /i "STOPPED"
- '<SYSTEM32>\sc.exe' query sppsvc
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -nop -ep bypass -c "&{$H=get-host;$W=$H.ui.rawui;$B=$W.buffersize;$B.height=300;$W.buffersize=$B;}"
- '<SYSTEM32>\mode.com' con cols=100 lines=31
- '<SYSTEM32>\sc.exe' query osppsvc
- '%WINDIR%\syswow64\cmd.exe' /c dir /b /ad %WINDIR%\Sysnative\spp\tokens\skus
- '%WINDIR%\syswow64\cmd.exe' /c ver
- '<SYSTEM32>\reg.exe' query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
- '%WINDIR%\syswow64\cmd.exe' /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
- '<SYSTEM32>\reg.exe' query HKU\S-1-5-19
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v KMS_Emulation /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v KMS_ActivationInterval /t REG_DWORD /d 120
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v GlobalFlag /t REG_DWORD /d 256
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v KMS_RenewalInterval /t REG_DWORD /d 10080
- '%WINDIR%\syswow64\cmd.exe' /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\16.0\Common\InstallRoot /v Path" 2>nul
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v Debugger
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path
- '%WINDIR%\syswow64\cmd.exe' /c "reg query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path" 2>nul
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path
- '%WINDIR%\syswow64\cmd.exe' /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2>nul
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path
- '%WINDIR%\syswow64\cmd.exe' /c "reg query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2>nul
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Common\InstallRoot /v Path
- '%WINDIR%\syswow64\cmd.exe' /c "reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Common\InstallRoot /v Path" 2>nul
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Office\14.0\Common\InstallRoot /v Path
- '%WINDIR%\syswow64\cmd.exe' /c "reg query HKLM\SOFTWARE\Microsoft\Office\14.0\Common\InstallRoot /v Path" 2>nul
- '<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionProduct where (PartialProductKey is not NULL) get ID
- '<SYSTEM32>\sc.exe' start sppsvc trigger=timer;sessionid=0
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
- '%WINDIR%\syswow64\cmd.exe' /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d 1688
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d 172.16.0.2
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /v KMS_Emulation
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /v KMS_Emulation
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v KMS_RenewalInterval /t REG_DWORD /d 10080
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v KMS_ActivationInterval /t REG_DWORD /d 120
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v KMS_Emulation /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v GlobalFlag /t REG_DWORD /d 256
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f /v VerifierDlls /t REG_SZ /d "SppExtComObjHook.dll"
- '<SYSTEM32>\reg.exe' query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath
- '<SYSTEM32>\timeout.exe' 5
