File name: | Activation.zip |
Full analysis: | https://app.any.run/tasks/759da05c-e950-4ac8-9e41-499d423bed69 |
Verdict: | Malicious activity |
Analysis date: | January 24, 2022, 22:07:34 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v1.0 to extract |
MD5: | 4674F2AFCF4ABF39C7C49F38AF75AFB9 |
SHA1: | 14C572587B8E77663BDECDBC75AE68BC32B3D2E9 |
SHA256: | 195A48AE157F64294103B83922742F8F16B6EB40F24775B298DF2A8B50081F1F |
SSDEEP: | 98304:SKK+7pxMlYKZUJd3QgdcAtVf6flFCYRC0j17lKlcWvHhWnPZ5HdLxLDI/s/Yaf/8:0+0BZUJdqAtJ0j17wKwEnPXvIUtSdiC |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | KMSAuto Net 2015 v1.4.0 Portable/ |
---|---|
ZipUncompressedSize: | - |
ZipCompressedSize: | - |
ZipCRC: | 0x00000000 |
ZipModifyDate: | 2015:10:17 11:32:20 |
ZipCompression: | None |
ZipBitFlag: | - |
ZipRequiredVersion: | 10 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1256 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Activation.zip" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
276 | "C:\Users\admin\Desktop\Activation\KMSAuto Net 2015 v1.4.0 Portable\KMSAuto Net.exe" | C:\Users\admin\Desktop\Activation\KMSAuto Net 2015 v1.4.0 Portable\KMSAuto Net.exe | Explorer.EXE | ||||||||||||
User: admin Company: MSFree Inc. Integrity Level: HIGH Description: KMSAuto Net Exit code: 3221225547 Version: 1.4.0 Modules
| |||||||||||||||
2520 | cmd /c md "C:\Users\admin\AppData\Local\MSfree Inc" | C:\Windows\system32\cmd.exe | — | KMSAuto Net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
1128 | cmd /c echo test>>"C:\Users\admin\Desktop\Activation\KMSAuto Net 2015 v1.4.0 Portable\test.test" | C:\Windows\system32\cmd.exe | — | KMSAuto Net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
1356 | C:\Windows\System32\cmd.exe /D /c del /F /Q "test.test" | C:\Windows\System32\cmd.exe | — | KMSAuto Net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3820 | "cscript.exe" /nologo C:\Windows\system32\slmgr.vbs /ipk FJ82H-XT6CR-J8D7P-XQJJ2-GPDD4 | C:\Windows\system32\cscript.exe | — | KMSAuto Net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft � Console Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
3632 | C:\Windows\System32\cmd.exe /D /c md "C:\ProgramData\KMSAuto" | C:\Windows\System32\cmd.exe | — | KMSAuto Net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3896 | C:\Windows\System32\cmd.exe /D /c bin.dat -y -pkmsauto | C:\Windows\System32\cmd.exe | — | KMSAuto Net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
1620 | bin.dat -y -pkmsauto | C:\ProgramData\KMSAuto\bin.dat | cmd.exe | ||||||||||||
User: admin Company: Igor Pavlov Integrity Level: HIGH Description: 7z Console SFX Exit code: 0 Version: 9.20 Modules
| |||||||||||||||
2396 | C:\Windows\System32\cmd.exe /D /c del /F /Q "bin.dat" | C:\Windows\System32\cmd.exe | — | KMSAuto Net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
|
(PID) Process: | (1256) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (1256) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (1256) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (1256) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
(PID) Process: | (1256) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
(PID) Process: | (1256) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Activation.zip | |||
(PID) Process: | (1256) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (1256) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (1256) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (1256) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1256 | WinRAR.exe | C:\Users\admin\Desktop\Activation\KMSAuto Net 2015 v1.4.0 Portable\readme\readme_es.txt | text | |
MD5:564031DDACC56EDEC05E41786A798CF7 | SHA256:365AE7C998EEED200995322F2BFDAA68EEFC27F3DE81FF6DD8F855509457A74C | |||
1256 | WinRAR.exe | C:\Users\admin\Desktop\Activation\KMSAuto Net 2015 v1.4.0 Portable\readme\readme_ua.txt | text | |
MD5:A57C260C2BD914D8D29FBBDEFCA1C0B1 | SHA256:59284FBDE0DF5173661AF8AC68D909454C3E85B1DCFBEB0E1035167DB0E95B49 | |||
1256 | WinRAR.exe | C:\Users\admin\Desktop\Activation\KMSAuto Net 2015 v1.4.0 Portable\readme\readme_cn.txt | text | |
MD5:59160ED6FF5FC91D50369612DBB54499 | SHA256:6D4DDE9F36855408AFEFA302DBC5FBA49F1B1DA42CFDAED7EAF71949B1067ACB | |||
1256 | WinRAR.exe | C:\Users\admin\Desktop\Activation\KMSAuto Net 2015 v1.4.0 Portable\readme\readme_fr.txt | text | |
MD5:13A127FE54E0C32C685682898F3B9BF0 | SHA256:8D4B747DDB496DBCA93B513F8A850A2421F9699A91BE771D9C17797733BD8381 | |||
1256 | WinRAR.exe | C:\Users\admin\Desktop\Activation\KMSAuto Net 2015 v1.4.0 Portable\readme\readme_ru.txt | text | |
MD5:3130279E396F2673AB50F63DA65BA3EC | SHA256:F1F70751B549B4B44DDE66D62259279E0C669BEBA8E9961881C9379F98CD027F | |||
1256 | WinRAR.exe | C:\Users\admin\Desktop\Activation\KMSAuto Lite Portable v1.2.2\readme_ru.txt | text | |
MD5:F249B2309DCDCD0400B4306725EE884C | SHA256:3E2F5BC817122CD83FBFC213EAAB3D873AC1E4F4B82FBBB58A552B978D8EA6B7 | |||
1256 | WinRAR.exe | C:\Users\admin\Desktop\Activation\KMSAuto Net 2015 v1.4.0 Portable\readme\readme_bg.txt | text | |
MD5:BE93068E2139DFFB69831764D37101A4 | SHA256:B1993BBEB8471F544F8B0358918AE240EED4336DD0D98808297B6762F43CA7A8 | |||
1256 | WinRAR.exe | C:\Users\admin\Desktop\Activation\KMSAuto Lite Portable v1.2.2\KMSAutoLite.ini | text | |
MD5:0C9C00948D1D02482AAC0C321EFF3494 | SHA256:31C91109145C8D0EB0354C7F177D7EE992620C747548AD421A0F321CDE65B6B4 | |||
1256 | WinRAR.exe | C:\Users\admin\Desktop\Activation\KMSAuto Net 2015 v1.4.0 Portable\readme\readme_kms.txt | text | |
MD5:922BFF8450A1F9E5FEF2D130D50F980A | SHA256:D637E76FCED201C2C88CDBF515E8FED0EFD9C12B477776B322164093B02D532B | |||
1256 | WinRAR.exe | C:\Users\admin\Desktop\Activation\KMSAuto Lite Portable v1.2.2\readme_bg.txt | text | |
MD5:6758A5086860CA4A3A9D030BA305AD6D | SHA256:C58A033D6EC682B28FD124B1FBBC2FBCC6AD7FCA9AA1BBE62618338F4CF4D7B4 |