File name:

KMS.A.2017.rar

Full analysis: https://app.any.run/tasks/14085024-9e0c-4025-9dc5-20a42b7e6163
Verdict: Malicious activity
Analysis date: December 05, 2023, 19:37:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

8EDE910F58FADCB44F97CD50207FB818

SHA1:

27A2F00BB5E09B58E89B3E332F98D9D1BA18999F

SHA256:

105D3A69121C173309BF924EE69AC95ED6FC89837143DE90DA13CCB9B5FC7CB9

SSDEEP:

98304:aenXXmQCgslG8Hkzv9cQ/5hYbWpGcWOV7IdGE5dssuOnTIxnQD6lc4Ne6pGld215:ru+TVJOXbl2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • KMSAuto Net.exe (PID: 604)
      • wzt.dat (PID: 3512)
      • AESDecoder.exe (PID: 3268)
      • bin_x86.dat (PID: 2128)
      • bin.dat (PID: 3928)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • KMSAuto Net.exe (PID: 604)
      • cmd.exe (PID: 3460)

    • Reads Internet Explorer settings

      • KMSAuto Net.exe (PID: 604)

    • Drops 7-zip archiver for unpacking

      • KMSAuto Net.exe (PID: 604)

    • Starts application with an unusual extension

      • cmd.exe (PID: 3252)
      • cmd.exe (PID: 3408)
      • cmd.exe (PID: 2456)

    • Process drops legitimate windows executable

      • wzt.dat (PID: 3512)
      • bin_x86.dat (PID: 2128)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • KMSAuto Net.exe (PID: 604)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • KMSAuto Net.exe (PID: 604)

    • Starts SC.EXE for service management

      • KMSAuto Net.exe (PID: 604)

    • Drops a system driver (possible attempt to evade defenses)

      • bin_x86.dat (PID: 2128)

    • Application launched itself

      • cmd.exe (PID: 3460)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 3428)
      • KMSAuto Net.exe (PID: 604)

    • Creates or modifies Windows services

      • KMSAuto Net.exe (PID: 604)

    • Executes as Windows Service

      • KMSSS.exe (PID: 3748)

  • INFO

    • Checks supported languages

      • KMSAuto Net.exe (PID: 604)
      • wzt.dat (PID: 3512)
      • certmgr.exe (PID: 1984)
      • AESDecoder.exe (PID: 3268)
      • certmgr.exe (PID: 4008)
      • bin_x86.dat (PID: 2128)
      • bin.dat (PID: 3928)
      • KMSSS.exe (PID: 3748)

    • Creates files or folders in the user directory

      • KMSAuto Net.exe (PID: 604)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 564)

    • Manual execution by a user

      • KMSAuto Net.exe (PID: 2956)
      • KMSAuto Net.exe (PID: 604)

    • Reads Environment values

      • KMSAuto Net.exe (PID: 604)

    • Creates files in the program directory

      • cmd.exe (PID: 3092)
      • wzt.dat (PID: 3512)
      • KMSAuto Net.exe (PID: 604)
      • bin.dat (PID: 3928)
      • bin_x86.dat (PID: 2128)
      • AESDecoder.exe (PID: 3268)
      • KMSSS.exe (PID: 3748)

    • Reads product name

      • KMSAuto Net.exe (PID: 604)

    • Reads the machine GUID from the registry

      • KMSAuto Net.exe (PID: 604)
      • KMSSS.exe (PID: 3748)

    • Reads the computer name

      • KMSSS.exe (PID: 3748)
      • KMSAuto Net.exe (PID: 604)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 3519860
UncompressedSize: 8976672
OperatingSystem: Win32
ModifyDate: 2017:04:08 08:54:30
PackingMethod: Normal
ArchivedFileName: KMS.A.2017\KMSAuto Net.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
51
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs kmsauto net.exe no specs kmsauto net.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs wzt.dat no specs cmd.exe no specs cmd.exe no specs certmgr.exe no specs cmd.exe no specs certmgr.exe no specs cmd.exe no specs cmd.exe no specs bin.dat no specs cmd.exe no specs cmd.exe no specs aesdecoder.exe no specs cmd.exe no specs cmd.exe no specs bin_x86.dat no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs netstat.exe no specs netsh.exe no specs netsh.exe no specs sc.exe no specs sc.exe no specs kmsss.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs reg.exe no specs netsh.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
564"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\KMS.A.2017.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
604"C:\Users\admin\Desktop\KMS.A.2017\KMSAuto Net.exe" C:\Users\admin\Desktop\KMS.A.2017\KMSAuto Net.exe
explorer.exe
User:
admin
Company:
MSFree Inc.
Integrity Level:
HIGH
Description:
KMSAuto Net
Exit code:
0
Version:
1.5.0
Modules
Images
c:\users\admin\desktop\kms.a.2017\kmsauto net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
684C:\Windows\System32\cmd.exe /c echo test>>"C:\Users\admin\Desktop\KMS.A.2017\test.test"C:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1016C:\Windows\System32\reg delete "HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /fC:\Windows\System32\reg.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1128C:\Windows\System32\reg delete "HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f" /fC:\Windows\System32\reg.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1296C:\Windows\System32\cmd.exe /D /c del /F /Q "wzt.dat"C:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1376C:\Windows\System32\Netsh Advfirewall Firewall add rule name="0pen Port KMS" dir=in action=allow protocol=TCP localport=1688C:\Windows\System32\netsh.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1496C:\Windows\System32\cmd.exe /D /c del /F /Q "bin.dat"C:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1556C:\Windows\System32\reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55C92734-D682-4D71-983E-D6EC3F16059F" /fC:\Windows\System32\reg.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1560cmd /c md "C:\Users\admin\AppData\Local\MSfree Inc"C:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
4 642
Read events
4 493
Write events
141
Delete events
8

Modification events

(PID) Process:(564) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(564) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(564) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(564) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(564) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(564) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(564) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(564) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1904) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1376) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
19
Suspicious files
11
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa564.7893\KMS.A.2017\KMSAuto Net.exeexecutable
MD5:D02B35945C18E89DC3BB43BC7F6153BE
SHA256:0B05EA08028F239B11F8C30249B0F0AA86966EE4974D03B01BAE2EE88BEFBBEB
564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa564.7893\KMS.A.2017\Readme\readme_bg.txttext
MD5:6B71EF0D4817D1732B333DF1F6E3C5DC
SHA256:51810E6B0913E46DF2334BA2F14C33FF59A6E063E9E3E4AE071BCA099FE3A5A2
564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa564.7893\KMS.A.2017\Readme\readme_cn.txttext
MD5:B7C069690D9392E4DCAF0B7AD01A65FE
SHA256:E747521AAA6D7C7573040681940FE1E42FA5F5C29810E3C8C228B4650DDD4C41
564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa564.7893\KMS.A.2017\Readme\readme_vi.txttext
MD5:25FCE528C81065CD5309083A0B3F1B5E
SHA256:64F1907B2B2414E4BFD14C367E3A0014F3BBF1E0EEA3319154054F9C1B26E324
3928bin.datC:\ProgramData\KMSAuto\bin\TunMirror.exe.aesbinary
MD5:6D6E295744D3750355227EFD55824BE1
SHA256:F67F0232100F7CC7E469DC14079EDF7D72EC25E48CA3B5AC9B40ED025F1BA0EF
564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa564.7893\KMS.A.2017\Readme\readme_kms.txttext
MD5:352709B6AED3902D4399F6615A7A7E70
SHA256:D3BEF0FEF19603B33B86E1CA431A25CB8A6DF047058E073BBF8BB931533217AA
564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa564.7893\KMS.A.2017\Readme\readme_en.txttext
MD5:B76901F293DD7E86A238569EF3E10263
SHA256:95A0828D28C2F12F821815B1330E64C4554EBA22215A9B1E9D862D2593D2A546
564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa564.7893\KMS.A.2017\Readme\readme_es.txttext
MD5:38E4EC7368615767BF358BE81D95935D
SHA256:7C86BCA7A776AA99FE581D689F6C22676EAFF41D64082FEEF71E0080A049EA13
564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa564.7893\KMS.A.2017\Readme\readme_fr.txttext
MD5:59168B67B69B95DDACF6C845FBA47D2A
SHA256:4B218858BC9848C2CFF531FCDCEEB546E8C7EB1C8F3D237C3299984ABE492D10
564WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa564.7893\KMS.A.2017\Readme\readme_ua.txttext
MD5:9041AF5EE38B10982E2C1F3451E41BED
SHA256:547169CE6EEC95440467061D9C35C233912DE2E53667F9EC81E5BD7A19F73031
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
KMS.A.2017.rar